| Document | Clause | Audit stage |
|---|
| ISMS scope | 4.3 | Stage 1 |
| Security policy | 5.2 | Stage 1 |
| Risk assessment method | 6.1.2 | Stage 1 |
| Statement of Applicability | 6.1.3 d) | Stage 1 |
| Risk treatment plan | 6.1.3 e), 6.2, 8.3 | Both stages |
| Security objectives | 6.2 | Stage 1 |
| Competence records | 7.2 | Stage 2 |
| Risk treatment results | 8.2, 8.3 | Stage 2 |
| Monitoring results | 9.1 | Stage 2 |
| Internal audit programme | 9.2 | Stage 1 |
| Internal audit results | 9.2 | Stage 2 |
| Management review results | 9.3 | Stage 2 |
| Corrective action results | 10.2 | Stage 2 |
| Inventory of assets | A.5.9 | Stage 2 |
| Acceptable use of assets | A.5.10 | Stage 1 |
| Incident response procedure | A.5.26 | Stage 1 |
| Statutory requirements list | A.5.31 | Stage 1 |
| IT operating procedures | A.5.37 | Stage 1 |
| Security roles | A.6.2, A.6.6 | Stage 1 |
| Security configurations | A.8.9 | Stage 2 |
| User activity logs | A.8.15 | Stage 2 |
| Secure engineering principles | A.8.27 | Stage 1 |
How Much Do ISO 27001 Requirements Cost a Small or Mid-Sized Team in 2026?
The cost figures below come from one vendor blog, so treat them as an estimate. Audit effort scales with headcount. That vendor puts a 50-person company at 8 to 10 initial audit days. Mid-sized firms get 8 to 12. A second source counts only 3 to 7 days for both stages. Ask each certification body for its day count. Stage 1 is priced at $1,500 to $4,500 per day. Smaller scopes can total $5,000 to $10,000 in audit fees.
Year-one spend runs $10,000 to $35,000 all-in for a 1 to 50 person company. A 50-person company often pays $12,000 to $22,000 in certification-body fees alone. For 50 to 250 employees, expect $30,000 to $80,000.
The hidden cost is staff time. Implementation eats 200 to 600 hours over four to eight months. A mid-sized company should budget 200 to 500 internal hours in year one. At a blended $75 per hour, those hours are worth $15,000 to $37,500. A fully do-it-yourself approach runs 300 to 600 hours. At $75 an hour, 600 hours is $45,000. That is more than the small-team total above, so that range probably leaves some staff time out.
Surveillance audits in years two and three run $3,000 to $10,000 per year. Recertification is priced at 60 to 80 percent of the original Stage 2 fee. Total annual maintenance lands between $5,000 and $25,000.
For a second read, see ISO 27001 certification cost for small businesses. Also compare SOC 2 compliance cost for startups and HIPAA compliance cost for a small practice. Tooling adds more, so check a GRC platform cost breakdown.
| Size | Audit days | Year-one spend | Internal effort | Years two and three |
|---|
| Small team, 1 to 50 | 8 to 10 at 50 people | $10,000 to $35,000 all-in | 200 to 600 hours | $3,000 to $10,000 a year |
| Mid-sized, 50 to 250 | 8 to 12 audit days | $30,000 to $80,000 | 200 to 500 hours, about $15,000 to $37,500 at $75 an hour | $3,000 to $10,000 a year, then recertification at 60 to 80 percent of Stage 2 |
| Enterprise, 250 or more | Larger, multi-site fees alone exceed $50,000 | Routinely over $100,000 | Not given in the source | Not given in the source |
How Long Does the Certification Cycle Actually Take?
Preparation usually takes 6 to 9 months. Stage 1 then runs 1 to 2 days and Stage 2 runs 2 to 5 days. Closing major nonconformities and receiving the decision takes 2 to 6 weeks more.
The certificate then runs for three years. Year zero carries 3 to 7 audit days for both stages. Years one and two each carry a 1 to 2 day surveillance audit. Year three carries a 2 to 4 day recertification audit over the full scope.
If you held a 2013 certificate, the transition deadline was 31 October 2025. That date came from IAF Mandatory Document MD26, published by the International Accreditation Forum.
Is ISO 27001 Worth It for Your Business or Your Career in 2026?
Two decisions sit here, and they point opposite ways.
For a business, pick ISO 27001 when enterprise customers or a regulator ask for a certificate. Pick SOC 2 when one customer asks for a report. SOC 2 is an attestation against American Institute of Certified Public Accountants trust services criteria. ISO 27001 is a certifiable standard with a three-year cycle and mandatory documents.
For a career, the standard has implementer and auditor credentials. Every certified company must run internal audits (Clause 9.2) and management reviews (Clause 9.3). The ISO/IEC 27001 Lead Implementer scheme from PECB sets the entry gate. It asks for five years of work experience, including two years in information security management. It also asks for 300 hours of ISMS project activity. The course runs five days, with the exam on day five.
For scale, the ISO Survey 2024 counted 96,709 valid ISO/IEC 27001 certificates worldwide, covering 179,877 sites.
Next Steps
- Write the ISMS scope. List sites, services, and data.
- Run a risk assessment. It picks your Annex A controls.
- Build the 22 documents. Start with scope, policy, and the Statement of Applicability.
- Quote two certification bodies. Compare per-day rates.
- Budget 6 to 9 months before Stage 1.
Photo: websubs, Pixabay Content License, via Pixabay (https://pixabay.com/photos/io-centers-security-access-card-2673322/)
Fazlur Rahman
