ISO 27001 FAQ

ISO/IEC 27001 is the international standard for an Information Security Management System (ISMS). Certification means an accredited certification body audited your ISMS (Stage 1 + Stage 2) and issued a certificate valid for three years, with annual surveillance audits.

Only an accredited certification body (CB) — accredited by a national accreditation body like UKAS, ANAB, DAkkS, or RvA. Consultants, auditors-for-hire, and software platforms cannot issue certificates.

Stage 1 is a documentation review: the CB checks your scope, policies, risk assessment, SoA, internal audit, and management review. Stage 2 tests effectiveness: interviews, sampling, and evidence that the ISMS actually operates.

Published 2026 ranges: Stage 1 + Stage 2 audit fees around $8,000–$25,000 for a small-to-mid company; first-year all-in $15,000–$50,000 for SMBs. See the cost guide for sourced figures.

3–9 months from kickoff to certificate for a first certification, plus annual surveillance audits in years two and three and recertification in year four.

The current version of the standard, published October 2022, replacing the 2013 version. Its Annex A restructured 114 controls into 93 across four themes: organizational, people, physical, and technological.

Many small companies self-implement with templates or an automation platform, then hire only the CB for audits. Consultants help when you lack internal security expertise or time — but a consultant cannot certify you.

No — not for the same ISMS. Accreditation rules require the certification body to be independent of the consulting. A CB that also does consulting must keep the teams and decisions separate; verify this in the proposal.

The document listing which of the 93 Annex A controls apply to your ISMS, which don't (with justification), and how each is implemented. Stage 1 audits scrutinize it.

There is no pass/fail — there are findings. Minor nonconformities must be addressed within an agreed window; major nonconformities block certification until a follow-up audit closes them, typically adding $1,500–$6,000 and 1–3 months.

Usually not for B2B: enterprise procurement routinely rejects unaccredited certificates. Accredited audits cost more because of oversight requirements — that premium buys the only certificate that counts.

Yes. Certificates can be transferred between accredited CBs, usually at a surveillance or recertification point. The new CB reviews your audit history before accepting the transfer.

US customers ask for SOC 2; international and enterprise customers ask for ISO 27001. Many SaaS companies get both, often in a combined program. See our comparison guide.

Audit days are set by ISO/IEC 27006 tables based on in-scope headcount and complexity, multiplied by the CB's day rate (published ranges: $1,500–$2,200/day US, £1,000–£1,500/day UK in 2026). That's why scoping tightly is the cheapest lever.

Accreditation for ISO 27001, named audit team, audit-day calculation, fixed fee and what breaks it, surveillance pricing, and transfer policy. See our RFP guide.

Search the accreditation body's directory (UKAS, ANAB, DAkkS, RvA) for the CB's name and confirm ISO 27001 is in its accredited scope. IAF CertSearch (iafcertsearch.org) also verifies issued certificates.