View the original post here.
While it can be difficult to pin down a definitive cost for any compliance certification, ISO 27001 is particularly variable. Our experts recommend starting your compliance journey early, so your company can avoid the accrued costs associated with pushing off ISO 27001.
Before diving into specifics, the list below defines most of the variables encountered when factoring ISO 27001 costs into your annual budget.
- How many employees do you have?
- Where are offices and people located geographically?
- What data does the application ingest?
- Does your platform live on multiple cloud platforms?
We’ve compiled a breakdown of costs in the post below to guide your budgeting decisions as you strive to become ISO 27001 certified.
ISO 27001 Design and Implementation Cost
Implementing ISO 27001 can be lengthy and costly. The main variable is workflow automation and guidance from an ISO 27001 expert. You’ll need to scope your ISMS, perform a gap analysis to identify the control areas which need to be established, and walk through the implementation of those controls.
From a people perspective, ISO 27001 will touch most of your organization. It requires dedicated time from key stakeholders over a period of a few months. The cost incurred will be based on time sunk from salaried employees or the hiring of a compliance team to handle design and implementation.
The average ranges for design and implementation cost:
- Compliance Manager Salary (US): $115,000 annually
- Cost of Compliance Software and Tools: $20,000 – $150,000 annually
- Time Needed: 2-3 months
Cost of Assessing Risk and Internal Audit
Like a surveillance audit (see below), a business becoming ISO 27001 compliant for the first time needs to execute an independent internal audit prior to determining readiness for an external audit.
The key here is “independent.” Larger businesses may be able to assign employees who have not been involved with implementation to the internal audit. However, it’s likely that you’ll need to hire an outside firm to perform this step.
Keep in mind, these auditors do not have to be certified ISO 27001 auditors. The associated cost will likely be on a per-hour basis and depend on the size and scope of your ISMS.
The average ranges for risk assessments and internal audits:
- Compliance Consultant Cost: $140/hour
- Time Needed: 24 – 160 hours
External Audit and Certification Cost
The formal audit for ISO 27001 typically takes place in person, and the length of time is dependent on the size of your business. While a small business with 5 employees and 1 location might only require a few days of auditing, a larger, multi-site company could take up to 1 month of auditing.
The average ranges for audit and certification:
- ISO 27001 Auditor Cost: $5,500 – $18,000
- Time Needed: 3 – 10 days
Surveillance Audits Cost
ISO 27001 pricing depends on each audit firm (there are only 21 audit firms in the United States!). Surveillance audits are required in year 2 and year 3 after the initial formal certification. Surveillance audits can determine whether or not the company is still operating as was originally represented in the initial certification year.
To stay in compliance, you’ll need to keep your ISMS up-to-date along with the relevant controls. This will require time from a compliance consultant or salaried employee, on top of the cost of auditors.
The average ranges for surveillance audits:
- Compliance Specialist Salary: $75,000 – $90,000 annually
- Cost of ISO 27001 Audit: $5,500 – $12,000
- Time Needed: 1 – 4 days
We can’t express this enough: these price ranges are just estimates. The cost of your ISO 27001 certification depends on so many factors, including the buy-in from your team, the readiness of your product and engineering squads, the size of your business, and much more.
Reach out to our team if you have any questions!
Writing by Mary 