ISO 27001 Certification Cost in the UK (2026)
Short answer: ISO 27001 certification body fees for UK businesses with fewer than 20 employees typically start from about £1,200 for initial certification, with annual surveillance audits from £700. Larger scopes, more locations and more complex technology estates need more audit days and cost more.
What you pay for
| Stage | When | Typical fee |
|---|---|---|
| Initial certification (Stage 1 + Stage 2 audit) | Year 1 | from about £1,200 for organisations under 20 employees |
| Surveillance audit | Years 2 and 3 | from £700 per year |
| Recertification audit | Before the certificate expires (3-year cycle) | quoted on audit days |
These are certification body fees only. Travel outside the quoted area and extra audits after major nonconformities are not included unless the written quote says so.
What changes the price
- Effective number of employees and locations: audit time is set from headcount and sites using the IAF MD 5 tables.
- ISMS scope: the number of information assets, cloud services, products and outsourced processes in scope changes the audit time.
- Annex A controls in the Statement of Applicability: a wider set of applicable controls means more evidence to sample.
- Integration with ISO 9001 or ISO 27701: shared processes can reduce combined audit time.
Before you compare quotes
- Check which accreditation body stands behind the certificate and that ISO 27001 is within that body's accreditation scope; UniCert's ISO 27001 accreditation status is confirmed in writing with every quote. Some UK public tenders ask specifically for UKAS-accredited certificates, so check the tender wording first.
- Make sure each quote covers the same audit days for the same headcount and sites.
- Ask whether surveillance and recertification are included in the three-year price.
Estimate your fee with the price calculator or request a quote. See ISO 27001 certification in the UK for the audit process, and ISO certification in the UK for other standards.
Frequently Asked Questions
How much does ISO 27001 certification cost for a small UK business?
For a UK business with fewer than 20 employees, ISO 27001 certification body fees typically start from about £1,200, with annual surveillance audits from £700.
What makes ISO 27001 certification more expensive?
More employees and locations, a wider ISMS scope, more cloud services and a larger set of applicable Annex A controls all add audit days.