An ISO 27001 surveillance audit has no universal price. Start with the certification body’s written scope, calculated audit time and fee schedule, then budget separately for travel, internal preparation and any follow-up work. The worksheet below helps compare proposals without treating an invented dollar or pound range as a market benchmark.
Table of Contents
Copy the annual surveillance budget record.
Those figures demonstrate a planning range, not ISO-set prices. Your actual invoice depends on the number of people within the certified scope, organisational complexity, locations, changes to the ISMS, audit delivery method, the certification body, and whether additional follow-up work is required.
The most useful budgeting approach is therefore not to ask, “What does an ISO 27001 surveillance audit cost?” in isolation. Ask instead: How many audit days will our certification body require this year, what is included in its rate, and what internal work will we need before and after the audit?
What is an ISO 27001 surveillance audit?
ISO/IEC 27001 certification is not a one-time inspection. The current standard, ISO/IEC 27001:2022, establishes requirements for an information security management system, or ISMS, that has to be maintained and continually improved after certification.
A successful initial certification audit is therefore followed by ongoing surveillance. Certification provider NQA describes ISO 27001 certificates as valid for three years and maintained through annual surveillance audits, followed by recertification on the three-year cycle.
A surveillance audit is narrower than the initial certification exercise. The auditor generally samples parts of the ISMS rather than repeating every part of Stage 1 and Stage 2 from scratch. The audit still needs enough evidence to establish that the management system remains operational, effective, and responsive to change.
Expect attention to areas such as previous nonconformities, corrective actions, internal audits, management review, information security objectives, risk management, changes to the organisation, selected controls, and evidence that the ISMS is being maintained rather than merely preserved as a collection of documents.
How much does an ISO 27001 surveillance audit cost in 2026?
No ISO document publishes a dollar or pound tariff for surveillance audits. ISO/IEC 27006-1:2024 instead establishes requirements for organisations that audit and certify ISMSs. The ISO/IEC 27006-1:2024 standard overview explains that it supplements ISO/IEC 17021-1 with requirements specific to ISO 27001 certification.
Scroll the table horizontally on small screens. Keyboard users can focus the table region and use the arrow keys.
| Quote input | Record for each provider |
|---|---|
| Scope and cycle | Certified scope, locations, personnel basis, changes since the last audit, and the surveillance visit being quoted. |
| Audit effort | Calculated auditor-days, rate, remote/on-site split, preparation/reporting included, and the rationale for adjustments. |
| External cash | Audit fee, travel basis, administrative fees, applicable tax and any separately charged follow-up. |
| Internal capacity | Evidence preparation, interviews, internal audit, management review and corrective-action work, with named owners. |
| Currency and terms | USD or GBP as quoted, tax treatment, quote expiry, payment schedule, rescheduling and cancellation conditions. |
| Uncertainty | Unpriced items, scope-change conditions, follow-up day rates and the person responsible for confirmation. |
Compare like-for-like proposals within a currency. A converted USD price is not a UK market quote; an amount excluding VAT is not the same cash total as an amount including it.
The ranges should not be treated as a quote. A 20-person SaaS company with one tightly defined product scope and mature documentation can be a very different audit from a 20-person company operating several regulated platforms across multiple locations.
The same warning applies to comparisons between the US and UK. A US dollar estimate cannot simply be converted into pounds and presented as a UK market price. Certification-body rates, taxes, travel arrangements, auditor availability, and accreditation markets differ.
The real surveillance audit budget has more than one line
The auditor’s invoice is only the visible tip of the spreadsheet. A sensible surveillance budget separates at least five possible cost categories.
- Certification-body audit fee: auditor time, technical review, reporting, and whatever certification administration the quotation includes.
- Travel and expenses: potentially relevant when auditors or technical specialists attend a physical site.
- Internal staff time: evidence preparation, interviews, management review, internal audit, risk updates, and coordination.
- Corrective action: engineering, policy, process, or documentation work required before or after the audit.
- Optional outside support: consultants, outsourced internal auditors, compliance platforms, specialist security testing, or legal and privacy support where genuinely required.
This distinction matters because reducing the certification body’s fee by $1,000 does not necessarily reduce the total cost by $1,000. A disorganised audit can consume expensive engineering, security, HR, legal, and management time even when the auditor’s invoice looks modest.
What determines the certification body’s price?
1. People within the ISMS scope
Headcount matters because audit time has to be sufficient for the scale of the management system being sampled. The relevant population is not always identical to the total number printed on the company’s LinkedIn page or payroll report.
Employees, contractors, distributed teams, and other personnel may affect the calculation depending on how they participate in activities covered by the ISMS. Give certification bodies an accurate and consistent description when requesting competing quotations.
2. The boundaries of your certified scope
A certificate covering one SaaS service, one legal entity, and a defined set of supporting teams is not equivalent to an enterprise-wide scope containing several products, offices, infrastructure environments, and business units.
A narrower scope can reduce audit effort when that scope truthfully reflects the security assurance customers actually need. Artificially carving essential processes out simply to save audit money is another matter: the boundary still has to make operational sense and withstand auditor scrutiny.
3. Sites and organisational structure
Multiple physical locations can increase audit planning, sampling, travel, and coordination. Acquisitions, reorganisations, new offices, outsourcing arrangements, and major staffing changes can also alter the audit picture between certification and surveillance.
4. Security and operational complexity
Two companies with similar headcounts can still require materially different audit effort. Data sensitivity, technical architecture, outsourcing, customer obligations, regulatory exposure, and the complexity of business processes all influence the work required to obtain reasonable audit evidence.
New technology can quietly expand this complexity. For example, unmanaged generative-AI tools, AI meeting assistants, browser extensions, and employee accounts can create new information flows that were not considered during the original certification. The Kioptrix guide to AI shadow IT risk provides a useful companion checklist for identifying those less obvious changes before audit week.
5. Findings from previous audits
An organisation that arrives with previous findings properly closed, current evidence available, and clearly assigned responsibilities generally creates a cleaner audit process than one still reconstructing what happened six months earlier.
Additional review can also arise when corrective-action evidence has to be submitted and assessed. Ask explicitly whether follow-up review for nonconformities is included in the quoted fee or charged separately.
6. Remote versus on-site work
Remote audit activity may reduce travel and accommodation expenses where it is appropriate and accepted by the certification body. It does not automatically reduce the required professional audit effort. The auditor still needs sufficient evidence, interviews, document review, and sampling to reach a defensible conclusion.
Do not automatically use “one-third of the initial audit” as your budget
You may encounter older ISO 27001 guidance and online articles saying that surveillance takes about one-third of the initial certification audit time. That rule of thumb has historical grounding in earlier certification guidance, but buyers should be careful about turning it into a guaranteed 2026 pricing formula.
The current ISMS certification-body standard is ISO/IEC 27006-1:2024. Your certification body should calculate the appropriate audit duration for your circumstances. Even where audit time is significantly shorter than the initial audit, your invoice will not necessarily be exactly one-third of the original invoice because travel, administration, minimum engagement structures, specialist involvement, and scope changes can affect the commercial total.
The better question is simple: “How many audit days have you calculated for this surveillance audit, and what changed that calculation from our initial certification?”
What can make surveillance more expensive than expected?
- A significant increase in people covered by the ISMS.
- A new product, legal entity, office, data centre, or geographic region entering scope.
- Major architecture or cloud-platform changes.
- Material outsourcing or new critical suppliers.
- Unclosed findings from the previous audit.
- Poorly maintained risk assessments or Statement of Applicability records.
- Missing internal-audit or management-review evidence.
- Extra auditor travel or specialist expertise.
- Adding related standards or extending the certification scope.
- Having to reconstruct evidence shortly before the audit instead of maintaining it continuously.
Customer pressure can also expose gaps indirectly. A large buyer may ask questions about incident response, testing, encryption, access control, business continuity, or suppliers long before your surveillance auditor arrives. Keeping a disciplined evidence library for a customer security questionnaire can therefore reduce duplicated work between sales assurance and ISO surveillance.
Penetration testing is a separate cost
Do not assume the ISO surveillance fee includes penetration testing, vulnerability scanning, cloud security reviews, or other technical security work. A certification auditor evaluates the management system and samples evidence; the auditor is not being hired to become your penetration-testing provider.
If penetration testing forms part of your risk treatment, customer commitment, contractual obligation, or established security programme, budget for it separately. The Kioptrix breakdown of penetration testing cost explains the main pricing variables, while the comparison of penetration testing versus vulnerability scanning helps distinguish continuous automated checking from a deeper human-led assessment.
The money-saving lesson here is not to buy every security service before surveillance. It is to know which tests your own risk assessment, Statement of Applicability, customers, contracts, and internal security programme actually require, then preserve credible evidence that those activities occurred and findings were handled.
How to reduce surveillance costs without weakening the ISMS
Keep the scope accurate before asking for quotes
Send each prospective certification body the same scope statement, personnel information, locations, and relevant organisational details. Otherwise you are comparing different audits disguised as different prices.
Maintain evidence throughout the year
Surveillance becomes expensive internally when the organisation spends two frantic weeks rediscovering twelve months of activity. Keep internal audit records, management-review outputs, risk decisions, access reviews, incident records, supplier reviews, security metrics, corrective actions, and control evidence current as part of normal operations.
Close previous findings early
Do not wait for the next auditor to remind you about the last auditor. Track each corrective action to completion, retain evidence of the correction, and check whether the underlying cause rather than only the visible symptom was addressed.
Tell the certification body about major changes before audit week
If headcount doubled, a company was acquired, the certified service moved to another cloud architecture, or the ISMS scope expanded, disclose that during audit planning. Surprises tend to be poor cost-control tools.
Ask for the entire certification-cycle cost
When choosing or renewing a certification body, request the projected structure for initial certification or recertification, subsequent surveillance audits, administrative fees, travel rules, and likely follow-up charges. A low first invoice can be less interesting once the full cycle is visible.
US and UK buyers should verify accreditation separately
ISO itself recommends evaluating several certification bodies and checking whether the body is appropriately accredited. Accreditation is distinct from ISO certification: the accreditation body evaluates the competence of the certification body, while the certification body audits the company seeking ISO 27001 certification.
In the United States, ANAB publishes information on its ISO/IEC 27001 accreditation programme and provides access to its directory of accredited management-system certification bodies.
In the United Kingdom, buyers can use the UKAS directory of accredited organisations and UKAS CertCheck to verify relevant accreditation and management-system certification claims.
This check is especially worthwhile when ISO certification is being purchased because a customer, tender, investor, insurer, or supply-chain programme specifically expects accredited certification. Do not rely solely on a provider’s logo wall or the word “international” in its marketing copy.
Questions to ask before accepting a surveillance audit quote
- What exact ISO/IEC 27001 scope is this quotation based on?
- What personnel count did you use for the audit-time calculation?
- How many surveillance audit days are included?
- Has the audit duration changed since initial certification, and why?
- Is the certification body accredited for ISO/IEC 27001 certification?
- Are report preparation and technical review included?
- Are certificate administration or maintenance fees separate?
- Will the audit be remote, on site, or hybrid?
- Are travel and expenses included?
- Could a technical specialist create an additional charge?
- How is review of corrective-action evidence billed?
- What happens to the fee if headcount, sites, or scope change?
- What are the cancellation and rescheduling terms?
- For UK quotes, is VAT included or additional?
- What should we budget for surveillance and recertification across the entire cycle?
A simple way to build your surveillance budget
Instead of placing a single “ISO audit” number in the annual budget, use this model:
Annual ISO 27001 maintenance budget = certification-body surveillance fee + travel/expenses + internal preparation time + remediation + required security testing + optional specialist support.
Keep the categories separate. That makes it much easier to explain why a year became more expensive and to identify which costs are controllable.
For example, moving an audit partly online may affect travel costs. Tightening a genuinely overbroad certification scope may affect audit effort. Better evidence management may reduce staff disruption. None of those changes eliminates the need to operate an effective ISMS.
Copy an annual surveillance budget record
Provider / accreditation verification / proposal reference: Quote date / expiry / currency / tax basis: Certified scope and visit / changes disclosed: Audit days / rate / remote and on-site allocation: Quoted audit fee (A): Travel, administration and other external fees (B): Separately priced testing, support and follow-up (C): Expected external cash = A + B + C: Internal preparation and remediation hours: Approved allocation rate / allocated capacity cost (D): Resource envelope = A + B + C + D: Reserve and assumptions shown separately: Year-two / recertification items excluded from this visit: Items already funded elsewhere / overlap removed: Unknown charges / confirmation owner / due date:
Leave unknown charges blank and flag them for confirmation. An allocated staff cost describes resource use; it is not automatically extra payroll cash. If a fixed quoted audit fee is provided, do not add auditor-days × rate again.
The bottom line
For planning, request the provider’s calculated auditor-days and rate in a current scoped quote. The comparison fields above identify the information needed; they do not establish a market price or a headcount tariff.
But the headline price is less important than the machinery underneath it. ISO 27001 surveillance cost is driven by audit time, scope, people, complexity, sites, organisational change, and the certification body’s commercial rate. Internal preparation and remediation can add just as much budget pressure as the audit invoice itself.
Before approving a quote, verify the certification body’s accreditation, make sure competing providers are quoting the same scope, request the calculated audit days, identify every additional fee, and look at the full three-year certification cycle. That turns surveillance from an annual invoice surprise into a predictable part of running the ISMS.
Budgeting tools reviewed: 2026-10-23. Replaced hypothetical price ranges with comparable-quote fields and a blank cash-and-capacity worksheet. No certification-body quote or market-price survey was obtained for this update.
Technical guidance updated: 2026-10-13. Relabeled unsupported surveillance-price ranges as hypothetical budgeting inputs and removed unverified market and headcount claims.