# How much does ISO 27001 certification cost in the UK? Separate the audit from preparation costs before comparing an ISO 27001 quote. The Assurance Desk. Published 7 October 2026. Last checked 7 October 2026. Part of the guide [What does ISO 27001 certification take, and who can certify you?](https://theassurancedesk.com/guides/iso-27001-certification-and-who-can-certify-you.md). **The short answer.** Get a quote for the certification audit separately from any help preparing for it. Published consultancy prices are not a full certification price. For example, Fortis lists ISO 27001 consultancy at £795 to £1,095 a unit a day. PGI lists £675 to £1,500 an instance a day ([applytosupply.digitalmarketplace.service.gov.uk, ISO/IEC 27001:2022 Certification Consultancy, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/515501111543662), [applytosupply.digitalmarketplace.service.gov.uk, ISO 27001 Consultancy, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/907632111615747) and [applytosupply.digitalmarketplace.service.gov.uk, ISO 27001 Internal Audit, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/641493740433689), checked 7 October 2026). ## Why is a day rate not the full certification cost? The public listings below cover different services. Fortis offers implementation and certification consultancy. PGI lists work such as risk reviews, policies and internal audit. Romano Security Consulting lists an internal audit service, which can come before the certification audit ([applytosupply.digitalmarketplace.service.gov.uk, ISO/IEC 27001:2022 Certification Consultancy, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/515501111543662), [applytosupply.digitalmarketplace.service.gov.uk, ISO 27001 Consultancy, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/907632111615747) and [applytosupply.digitalmarketplace.service.gov.uk, ISO 27001 Internal Audit, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/641493740433689), checked 7 October 2026). A daily price does not tell you how many days your project needs or what other work is included. Ask each firm to set out the service, the amount of work and the total price for the same brief ([applytosupply.digitalmarketplace.service.gov.uk, ISO/IEC 27001:2022 Certification Consultancy, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/515501111543662), [applytosupply.digitalmarketplace.service.gov.uk, ISO 27001 Consultancy, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/907632111615747) and [applytosupply.digitalmarketplace.service.gov.uk, ISO 27001 Internal Audit, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/641493740433689), checked 7 October 2026). ## What do published UK consultancy prices show? These are supplier prices on the government’s Digital Marketplace. They are examples of advertised services, rather than an average for the UK market or prices for the same package. Keep each listing’s unit when comparing them ([applytosupply.digitalmarketplace.service.gov.uk, ISO/IEC 27001:2022 Certification Consultancy, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/515501111543662), [applytosupply.digitalmarketplace.service.gov.uk, ISO 27001 Consultancy, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/907632111615747) and [applytosupply.digitalmarketplace.service.gov.uk, ISO 27001 Internal Audit, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/641493740433689), checked 7 October 2026). **Published service rates, not complete certification packages** | Supplier | Service in the listing | Published price and basis | | --- | --- | --- | | Fortis | ISO 27001 implementation and certification consultancy | £795 to £1,095 a unit a day | | PGI | ISO 27001 consultancy | £675 to £1,500 an instance a day | | Romano Security Consulting | ISO 27001 internal audit | £750 to £1,000 a unit a day | Source: applytosupply.digitalmarketplace.service.gov.uk, ISO/IEC 27001:2022 Certification Consultancy, Digital Marketplace, https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/515501111543662 (checked 7 October 2026); applytosupply.digitalmarketplace.service.gov.uk, ISO 27001 Consultancy, Digital Marketplace, https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/907632111615747 (checked 7 October 2026); applytosupply.digitalmarketplace.service.gov.uk, ISO 27001 Internal Audit, Digital Marketplace, https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/641493740433689 (checked 7 October 2026) ## What belongs in your ISO 27001 budget? Start by separating preparation from the independent certification work. UKAS accreditation checks the competence of certification bodies. An internal audit is a different piece of work that can take place before the certification audit ([UKAS, Certification Body Accreditation](https://www.ukas.com/accreditation/standards/certification-body-accreditation/) and [applytosupply.digitalmarketplace.service.gov.uk, ISO 27001 Internal Audit, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/641493740433689), checked 7 October 2026). Then ask what the preparation covers. PGI’s listing includes risk work, policies, defining the scope and developing the management system. Fortis says it can tailor services to objectives, budget and timescale. Your quote needs to say which work you want ([applytosupply.digitalmarketplace.service.gov.uk, ISO/IEC 27001:2022 Certification Consultancy, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/515501111543662) and [applytosupply.digitalmarketplace.service.gov.uk, ISO 27001 Consultancy, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/907632111615747), checked 7 October 2026). **Ask for separate prices** - **Preparation and support** - Help with scope, risks and policies. - Work on the management system. - Internal audit where included. - **Certification work** - The certification body’s assessment. - The scope the audit will cover. - A separate quote from the body. The public day rates above cover support work. Get the certification body’s own audit quote. Source: UKAS, Certification Body Accreditation, https://www.ukas.com/accreditation/standards/certification-body-accreditation/ (checked 7 October 2026); applytosupply.digitalmarketplace.service.gov.uk, ISO/IEC 27001:2022 Certification Consultancy, Digital Marketplace, https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/515501111543662 (checked 7 October 2026); applytosupply.digitalmarketplace.service.gov.uk, ISO 27001 Consultancy, Digital Marketplace, https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/907632111615747 (checked 7 October 2026); applytosupply.digitalmarketplace.service.gov.uk, ISO 27001 Internal Audit, Digital Marketplace, https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/641493740433689 (checked 7 October 2026) ## What should you ask before accepting a quote? Ask the supplier to name the work, explain the pricing unit and estimate the days. Ask what changes the total. The published ranges alone do not settle those questions for your project ([applytosupply.digitalmarketplace.service.gov.uk, ISO/IEC 27001:2022 Certification Consultancy, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/515501111543662), [applytosupply.digitalmarketplace.service.gov.uk, ISO 27001 Consultancy, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/907632111615747) and [applytosupply.digitalmarketplace.service.gov.uk, ISO 27001 Internal Audit, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/641493740433689), checked 7 October 2026). Ask whether VAT, expenses, software, follow up work and later audits are included. Also plan for your own team’s time. Put the answers beside the price so you can compare the whole offer. ## What to do 1. Write the same short brief for each firm you approach. 2. Ask for preparation, internal audit and certification work to be priced clearly ([applytosupply.digitalmarketplace.service.gov.uk, ISO/IEC 27001:2022 Certification Consultancy, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/515501111543662), [applytosupply.digitalmarketplace.service.gov.uk, ISO 27001 Consultancy, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/907632111615747) and [applytosupply.digitalmarketplace.service.gov.uk, ISO 27001 Internal Audit, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/641493740433689), checked 7 October 2026). 3. Ask what each pricing unit means and how many days are expected ([applytosupply.digitalmarketplace.service.gov.uk, ISO/IEC 27001:2022 Certification Consultancy, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/515501111543662), [applytosupply.digitalmarketplace.service.gov.uk, ISO 27001 Consultancy, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/907632111615747) and [applytosupply.digitalmarketplace.service.gov.uk, ISO 27001 Internal Audit, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/641493740433689), checked 7 October 2026). 4. Record what is included, what costs extra and what your own team must do. ## Common questions ### Is a consultancy day rate the cost of certification? No. The examples here are consultancy and internal audit listings. Internal audit can be carried out before the certification audit ([applytosupply.digitalmarketplace.service.gov.uk, ISO/IEC 27001:2022 Certification Consultancy, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/515501111543662), [applytosupply.digitalmarketplace.service.gov.uk, ISO 27001 Consultancy, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/907632111615747) and [applytosupply.digitalmarketplace.service.gov.uk, ISO 27001 Internal Audit, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/641493740433689), checked 7 October 2026). ### Can you rank these firms from cheapest to most expensive? Not from these figures alone. They describe different services and pricing units. Ask for quotes against the same brief ([applytosupply.digitalmarketplace.service.gov.uk, ISO/IEC 27001:2022 Certification Consultancy, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/515501111543662), [applytosupply.digitalmarketplace.service.gov.uk, ISO 27001 Consultancy, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/907632111615747) and [applytosupply.digitalmarketplace.service.gov.uk, ISO 27001 Internal Audit, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/641493740433689), checked 7 October 2026). ### Can the support be tailored to our project? Fortis’s listing says its services can be tailored to objectives, budget and timescale. Ask the provider what its own offer includes ([applytosupply.digitalmarketplace.service.gov.uk, ISO/IEC 27001:2022 Certification Consultancy, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/515501111543662), checked 7 October 2026). ## Where next - [What does ISO 27001 certification take, and who can certify you?](https://theassurancedesk.com/guides/iso-27001-certification-and-who-can-certify-you.md) - [ISO 42001 or ISO 27001: which do you need, and which first?](https://theassurancedesk.com/guides/iso-42001-or-iso-27001.md) - [How to find UKAS accredited ISO 27001 certification bodies](https://theassurancedesk.com/guides/ukas-accredited-iso-27001-certification-bodies.md) ## Sources - applytosupply.digitalmarketplace.service.gov.uk, ISO/IEC 27001:2022 Certification Consultancy, Digital Marketplace: https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/515501111543662 (checked 7 October 2026) - applytosupply.digitalmarketplace.service.gov.uk, ISO 27001 Consultancy, Digital Marketplace: https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/907632111615747 (checked 7 October 2026) - applytosupply.digitalmarketplace.service.gov.uk, ISO 27001 Internal Audit, Digital Marketplace: https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/641493740433689 (checked 7 October 2026) - UKAS, Certification Body Accreditation: https://www.ukas.com/accreditation/standards/certification-body-accreditation/ (checked 7 October 2026) --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.