Total cost at a glance: in our engagements, the first year of ISO 27001 certification costs about ₹6 to 10 lakh. That is our consulting fee plus the certification body's Stage 1 and Stage 2 audit. After that, budget ₹1.5 to 2.5 lakh a year for surveillance audits. These are CyberWave GRC's own fees and what we see in our engagements, not universal market prices.
The certificate is issued by an accredited certification body, not by CyberWave GRC. We prepare you for the audit; the certification body carries it out. You can check a certification body's accreditation with the National Accreditation Board for Certification Bodies (NABCB) or IAF CertSearch.
What makes up the cost
| Cost part | Our fees / what we see |
|---|---|
| Consulting, small company | About ₹3 lakh |
| Consulting, mid-size company | About ₹5 lakh |
| Certification body audit (Stage 1 and Stage 2) | About ₹3 to 5 lakh |
| Yearly surveillance audit | About ₹1.5 to 2.5 lakh |
How company size and scope change the cost
Your employee count and number of sites decide how many days the certification body's auditors must spend, and that sets the audit fee. A wider scope, covering more business units, products or locations, adds consulting work as well. For a view of how different types of consulting firms compare, see our ISO 27001 consulting firms comparison.
What pushes the cost up
- Employee count and number of sites. These set the number of auditor days.
- A wide scope. Many business units, products or locations.
- Starting from zero. No policies, risk assessment or asset inventory in place.
How to keep the cost down
Scope the certification to the business units and sites your customers care about. If you already have policies, a risk assessment or an asset inventory, use them as your starting point.
Typical timeline
About 3 to 4 months from start to finish.
A typical engagement
*Illustrative scenario. This is not a specific client.*
An 80-person IT services company with one office in Bengaluru needs ISO 27001 certification. Consulting costs about ₹5 lakh, plus the certification body's fee. The work is finished in about 4 months.
Get an ISO 27001 quote
Tell us your headcount, number of sites and scope, and we'll send you a quote. Request a quote or see our ISO 27001 certification consulting and Bengaluru office pages.