The strangest thing about ISO 27001 pricing is how hard it is to find. Consultancies quote "it depends". Platforms hide pricing behind demo calls. So here is the actual arithmetic, in public, for a typical SaaS startup.
The three cost buckets
1. Getting audit-ready
This is where the variance lives. The consultant-led route, someone writes your policies, runs workshops, and project-manages you to the audit, typically runs €15,000–€40,000 for a small company. The platform route replaces most of that labour with software: Certixa is €149/month for companies up to 25 people, which over a four-month journey is roughly €600.
2. The certification audit
Paid directly to an accredited certification body (they must be independent, nobody can sell you both the preparation and the certificate). For a company under 25 people, expect roughly €5,000–€9,000 for the initial Stage 1 + Stage 2 cycle, then €2,000–€4,000 per year for surveillance audits. Body quotes vary enough that comparing three is worth an afternoon, we introduce customers to three.
3. Your team's time
The honest, usually-omitted line item. Consultant-led projects still consume 100–200 internal hours (workshops, reviews, evidence hunting). Automation compresses the mechanical work: policies arrive drafted, evidence collects itself, and internal time concentrates on genuine decisions, realistically 30–60 hours spread over a few weeks.
The comparison, for a 20-person startup
- Consultant route: €15K–€40K prep + ~€7K audit + heavy internal time → €22K–€47K to certificate.
- Platform route: ~€600 prep (4 months × €149) + ~€7K audit + light internal time → under €8K to certificate.
The audit fee is the floor, nobody can discount independence. Everything above the floor is preparation cost, and preparation is what software has made cheap.
The ongoing cost
Certification lasts three years with annual surveillance. The trap is treating year one as the finish line: an ISMS that decays costs a painful recertification later. Budget the platform subscription plus surveillance audit, and let continuous evidence collection keep year-two effort near zero.
What it buys
One enterprise deal usually pays for the whole programme several times over, which is why the sharpest framing isn't "what does ISO 27001 cost?" but "what does not having it cost per quarter in stalled deals?" More on that in ISO 27001 vs SOC 2.