ISO 27001 Certification Cost in Australia: What Really Drives the Price
By Jack Yumulu, ISO consultant and founder of UMISUS
"How much will ISO 27001 cost us?" is usually the first question I hear from a SaaS founder or IT manager once a client, investor or tender has asked for certification. The useful answer is that there is no single figure. The total is made up of three separate parts, and each one moves with your scope, your headcount and how mature your security practices already are.
This article explains what those parts are, what makes each one larger or smaller, and how to keep the total under control without weakening the result.
The three parts of the cost
Certification Body fees. The external audits are carried out by an independent Certification Body. In Australia, choose one accredited by JAS-ANZ, the Joint Accreditation System of Australia and New Zealand. JAS-ANZ was established by a 1991 treaty between the Australian and New Zealand governments, and its accreditation is what allows your certificate to be recognised by customers here and overseas.
Implementation support. This is the work of building the Information Security Management System (ISMS): scoping, risk assessment, the Statement of Applicability, policies, procedures, training and an internal audit. Some organisations do this themselves; most SMEs bring in a consultant.
Your own internal effort. Staff time for workshops, reviews and training, plus any security improvements your risk assessment shows you need.
How Certification Bodies work out audit time
Certification Body fees are driven mainly by audit days. For ISO 27001, Certification Bodies follow ISO/IEC 27006 Part 1, which sets minimum audit time based on the number of persons doing work under the organisation's control. In practice, headcount within scope is the starting point for every quote you receive.
From there, the Certification Body adjusts the time up or down. Factors listed in published guidance include the complexity of the ISMS, the type of business, the number of sites (including disaster recovery sites), outsourcing, in house system development, the diversity of technology in use, and the number of regulations that apply. A mature, well prepared ISMS and low risk activities can reduce the time.
There is also a specific allowance for groups of staff who perform the same simple, repetitive work under direction, such as a large service desk. European Accreditation guidance confirms that for each such group the Certification Body may use the square root of the headcount, rounded up, as the effective number. The Certification Body must document and justify this, and it must still allocate enough time for a complete and effective audit.
The initial certification audit is split into two stages. Stage 1 is a readiness review of your scope, documentation and preparedness. Stage 2 is an evidence based audit that checks the ISMS is implemented and operating effectively.
Budget for three years, not one
An ISO 27001 certificate is valid for three years. Surveillance audits are held during that period, typically annually, and a recertification audit is needed at the end of the cycle.
As a rule of thumb published by one audit firm, each surveillance audit takes about one third of the initial certification audit time, and recertification takes about two thirds. When you compare Certification Bodies, ask each for a quote covering the full three year cycle and the number of audit days at each stage. That is the only fair way to compare them.
What drives the implementation effort
Scope. Certifying the whole company is more work than certifying the one platform or service your customers actually care about. A narrower scope can be entirely legitimate, provided it covers what your customers and contracts require. Check that before you lock it in.
Your starting point. Many technology businesses already have multi factor authentication, backups and access controls in place. What is usually missing is the management system around them: a documented risk assessment and treatment plan, a Statement of Applicability, internal audit, management review and the records that prove it all happens. Closing that gap is where most of the implementation effort goes.
Annex A. ISO/IEC 27001:2022 contains 93 Annex A controls grouped into four themes: 37 organisational, 8 people, 14 physical and 34 technological. Your Statement of Applicability must address every one of them and justify each inclusion or exclusion. A fully remote business may find the physical controls lighter, but it still needs to deal with remote working, equipment off premises and supplier security.
Locations, suppliers and development. More sites, more cloud and outsourced providers, and in house software development all add risks to assess and evidence to collect.
Documentation style. A lean system written around how your team actually works is quicker to build, easier to maintain and easier to audit than a large library of generic templates nobody reads.
The costs people forget
Staff time. Risk workshops, policy reviews, awareness training, the internal audit and the management review all need people from across the business, not just IT.
Fixing gaps. The risk assessment may show you need new tools, tighter processes or technical testing. These are business decisions, but they belong in the budget.
Nonconformities. If the Stage 2 audit raises findings, they must be addressed before certification is granted. Remediation can take from a few weeks to a few months, which delays the certificate and can delay the contract that depended on it.
Ongoing maintenance. After certification, the ISMS has to keep running: risk reviews, internal audits, management reviews and corrective actions every year, ready for each surveillance audit.
Practical ways to keep the cost under control
Confirm what your customer or tender actually requires before you set the scope.
Get quotes from more than one JAS-ANZ accredited Certification Body and compare audit days across the full three year cycle.
Keep documentation lean and specific to your business.
Run a genuine internal audit and management review before Stage 1, so problems are found by you rather than by the Certification Body.
Engage implementation support on a fixed fee, so the scope of work is agreed up front and there are no surprises.
How UMISUS approaches ISO 27001 fees
UMISUS implements ISO 27001 for a fixed fee, quoted on request after a short scoping conversation. Because UMISUS is run by one consultant with no overheads, fees are highly competitive, and you work with me from the first workshop through to the certification audit. Certification Body fees are separate and paid directly to the Certification Body you choose. If you are weighing up ISO 9001 as well, see our ISO 9001 cost guide.
Frequently asked questions
Are Certification Body fees included in a consultant's fee?
Generally no. Certification Bodies must remain independent of whoever helped build your ISMS, so you engage and pay them directly.
How long does ISO 27001 certification take?
Published guidance puts preparation at roughly three to twelve months, depending on your readiness, scope and how much time your team can commit.
Do we pay for audits every year?
Yes. Surveillance audits are held during the three year certificate cycle, typically annually, followed by a recertification audit.
Can a narrower scope reduce the cost?
It can, because headcount and activities in scope drive audit time and implementation effort. The scope must still cover what your customers and contracts require, or the certificate will not do its job.
Does it matter which Certification Body we use?
Yes. Use a Certification Body accredited by JAS-ANZ so your certificate carries recognised accreditation. Ask to see their accreditation scope for ISO/IEC 27001 before you sign.
UMISUS offers fixed fee ISO 27001 implementation and internal audits for businesses across Australia and New Zealand, delivered remotely by Jack Yumulu from start to finish.
