ISO 27001 cost guide · India
Three budgets, one certificate, and the audit days behind the bill.
Ask five suppliers what ISO 27001 costs and you get five numbers that cannot be compared, because each is pricing something different. This guide prices nothing. It lists every line you will pay for, who you pay, which lines come back every year, and the one rule that decides the certification body’s fee — so the quotes you collect can finally be set side by side.
Reviewed 6 November 2026 · 13 sources cited
The short answer
ISO 27001 certification cost in India comes in three budgets: the accredited certification body’s audits (Stage 1 and Stage 2, a surveillance audit in each of the next two years, recertification in year three); the implementation work, paid to a consultant, in your own staff’s time, or both; and remediation and tooling for the gaps found. The audit fee follows auditor-days, which ISO/IEC 27006-1 ties to the people in scope. Fix the scope first — it moves every line.
The honest answer
There is no single price. There are three budgets.
Search for ISO 27001 certification cost in India and you will find figures for the same size of company that differ several times over. Most of that spread is not dishonesty. People are pricing different things: some quote only the certification audit, some a consultant’s package, a few add internal time, and almost nobody adds years two and three.
A certificate is paid for in three budgets. The certification body — an accredited, independent auditor you appoint — charges for audit days: Stage 1 and Stage 2, a surveillance audit in each of the next two years, and a recertification audit before the three-year certificate runs out. The implementation — gap assessment, risk assessment, Statement of Applicability, policies, internal audit — is paid to a consultant, in your own staff’s time, or both. Remediation and tooling is paid to whoever builds or licenses the controls you turn out not to have.
Each scales with something different: the audit fee with auditor-days, implementation with your starting point and how much your team can carry, remediation with the gaps. The one decision that moves all three is scope — which entities, sites, systems and people the certificate covers.
So this guide gives you no number; one would be wrong for most readers and would read as a quote. It gives you every cost line, who you pay, whether it recurs, and the questions that make quotes comparable. For how we run the programme, see our ISO 27001 service.
The bill, itemised
Every line you will pay for, and who you pay
Eleven lines across three years. Use it as the skeleton of your budget, and ask each supplier which lines their quote covers.
| Cost line | Who you pay | One-off or recurring | What scales it | Ask before you sign |
|---|---|---|---|---|
| Scoping and gap assessment | Consultant, or your own team | One-off; repeat if scope changes | Entities, sites and systems in scope; what already exists | Is every gap costed, with an owner? |
| Risk assessment, Statement of Applicability, policies | Consultant plus internal time — control owners must take part | Built once, reviewed yearly | Processes, systems and suppliers in scope | Written for you, or a renamed template pack? |
| Operating the controls | Mostly internal time; your IT vendor | Recurring | The gaps; cloud or on-premises; number of suppliers | Who performs access and log reviews each month? |
| Remediation and tooling | Whoever builds or licenses it — multi-factor login, backup, logging, device management | Build one-off; licences recur | The gaps; headcount, as most licences are per user | Which gaps need a purchase, and which only configuration? |
| Independent testing evidence | Testing provider | Usually yearly, and after major change | Applications, IP addresses and APIs in scope | Retest included? Findings mapped to Annex A? |
| Awareness training | Trainer, platform or internal | Recurring | Headcount | Dated attendance records? |
| Internal audit and management review | Consultant or trained internal auditor — never the certification body | Recurring, every year | Size of scope | Is the auditor independent of the work audited? |
| Stage 1 and Stage 2 certification audit | Accredited certification body, directly | Once per three-year cycle | Auditor-days: people in scope, complexity, sites | Days per stage, how calculated, travel included? |
| Surveillance audits, years 2 and 3 | Certification body | Recurring, each year | Planned from the initial audit | Days fixed in the contract now? |
| Recertification audit, year 3 | Certification body | Every three years | Recalculated from the organisation as it is then | Priced now, or left open? |
| Keeping evidence current | Internal time, a platform, or both | Recurring | Number of controls and frameworks | Who collects it, and when does it expire? |
Certificates run on a three-year cycle. Budget years two and three when you approve year one — they are the lines most often missing from a comparison.
The verifiable driver
How a certification body works out audit time
The one part of the bill governed by a published rule. ISMS audit time comes from ISO/IEC 27006-1:2024, Annex C — not from IAF MD 5, which many cost pages quote but which covers quality, environmental and health-and-safety systems.
-
1
Count the people in scope
Annex C starts from the number of persons doing work under the organisation’s control within the scope, wherever they sit — wider than the payroll. The 2024 edition added a way to treat groups performing identical activities (clause C.3.4), relevant to support centres and BPO floors.
Ask: what headcount did you use, and who is in it?
-
2
Adjust for what you actually do
Headcount is the starting point, not the whole calculation. The certification body must also weigh the other factors affecting audit time that ISO/IEC 17021-1 lists. A regulated payments platform does not take the same audit as a design studio of the same size.
Ask: which factors moved the figure, and by how much?
-
3
Account for every site
Where people work from several locations, clause C.6 generally calculates audit time on the total headcount across all of them; adding up separate per-site figures is allowed only for documented reasons, and only if it gives a larger total. European Accreditation confirmed in 2024 that ISO/IEC 27006-1 governs here.
Ask: which sites are visited, and which audited remotely?
-
4
Split the initial audit into two stages
Stage 1 checks readiness: scope, documented ISMS, Statement of Applicability. Stage 2 tests whether the system operates as documented.
Ask: how many days per stage, and how many on site?
-
5
Plan years two and three
Surveillance and recertification audits carry their own audit time. For quality, environmental and health-and-safety systems, IAF MD 5 puts yearly surveillance at about one third of the initial audit time and recertification at about two thirds. The ISMS figures sit in ISO/IEC 27006-1, a paid standard — have the body show you the ones it applies.
Ask: are those days written into the contract?
-
6
Multiply by the day rate
Audit days times the day rate, plus travel where auditors come on site, plus any certificate or administration fee. Day rates differ between bodies; audit days for the same scope should not differ much, because every accredited body works from the same standard.
Ask: what is charged besides audit days?
Two quotes for the same scope should show similar audit days. If they do not, one body has counted your people, sites or complexity differently — find out which before comparing prices.
Typical, not promised
How long a first certification usually takes
Typical for a few dozen to a few hundred people with a clear scope. Your starting point and your own people’s time move these more than any consultant can.
-
Weeks 1–3
Scope and gap assessment
- Agree the entities, sites, systems and people in scope — the largest single lever on cost
- Assess clauses 4 to 10 and all 93 Annex A controls against what exists today
- Send the written scope to two or three accredited certification bodies for quotes
-
Months 1–4
Build and operate
- Risk assessment and a treatment plan management can actually discuss
- Statement of Applicability, with a reason for every inclusion and exclusion
- Controls switched on and running, so records exist — Stage 2 needs operating history to examine
-
Months 3–5
Internal audit and management review
- An internal audit of the whole ISMS (clause 9.2), by someone independent of the work audited
- A management review with minutes (clause 9.3), and nonconformities closed
-
Months 4–6
Stage 1
- The certification body reviews scope, documentation and readiness
- Findings closed, and Stage 2 booked — typically a few weeks later
-
Months 5–9
Stage 2 and the decision
- The body tests whether the ISMS operates as documented
- You answer any nonconformities with corrections and corrective actions
- The body decides on its own judgement — no consultant can decide it for you
-
Years 2–3
Surveillance and recertification
- A surveillance audit in each of the two years after certification
- Recertification before the three-year certificate expires
Which version
ISO 27001:2022 is the only version you can buy
The transition is over. A quote or template pack still built on 2013 tells you how current the supplier is.
| ISO/IEC 27001:2013 | ISO/IEC 27001:2022 | |
|---|---|---|
| Annex A controls | 114 controls in 14 clauses | 93 controls in 4 themes |
| What changed | — | 11 new controls, 24 merged from older ones, 58 updated |
| New certifications | None — from 30 April 2024 at the latest, initial and recertification audits were to 2022 only | ✓ |
| Existing certificates | Expired or withdrawn at the end of the transition, 31 October 2025 | The only valid basis |
| What it means for your budget | An old certificate not transitioned in time means a new initial certification | Gap assessment, SoA and policies must use the 2022 control set |
Dates and counts from IAF MD 26:2023, the mandatory transition document for ISO/IEC 27001:2022. Certification bodies also had to move to ISO/IEC 27006-1:2024 — NABCB set 30 September 2025 for the bodies it accredits.
Like for like
Twelve checks before you compare two quotes
Tick only what a quote states in writing, one quote at a time. A low score means the quote is not yet comparable — and the gap is usually where the next invoice comes from.
Red flags
Five offers to walk away from
What people assume“We implement your ISMS and certify it too — one package, one invoice.”
What is actually trueISO/IEC 17021-1 forbids a certification body, and any entity under its control, from offering management-system consultancy. Where a related body has consulted, the certification body must not certify that system for at least two years. That certificate fails the first informed customer who asks.
What people assume“Use our recommended certification body — it will be quicker and cheaper.”
What is actually trueA certification body may not state or imply that certification is simpler, easier, faster or less expensive if a particular consultancy is used. Choose the body yourself, on its accreditation and its quote. We help you compare quotes, and we do not mark up any certification body’s fee.
What people assume“Any certificate with an ISO logo is valid.”
What is actually trueThe logo proves nothing. The test is accreditation: is the body accredited for ISO/IEC 27001 by NABCB, or by another accreditation body in the international recognition arrangement? Check its own directory before you pay — your customers will check yours.
What people assume“A 2013 certificate is cheaper and just as good.”
What is actually trueEvery 2013-edition certificate expired or was withdrawn at the end of the transition period on 31 October 2025. There is nothing current to buy.
What people assume“Certified in a month, or your money back.”
What is actually trueOnly the certification body decides, after Stage 1 and Stage 2, on its own judgement — and Stage 2 needs an ISMS with some operating history to examine. A consultant promising speed is promising someone else’s decision.
Next step
Get a fixed quote for the part that is ours.
Tell us roughly what you want certified and who is asking for it. We reply to arrange a 30-minute scoping call — no charge — then send a written scope and a fixed price for readiness, implementation, internal audit and evidence.
The written scope is yours to send to any accredited certification body, which you contract and pay directly.
- A written scope — entities, sites, systems, headcount — ready for certification bodies to quote against
- A fixed price for our work, with what your own team must do stated in hours
- Every line from the cost table marked as ours, the certification body’s or yours
- An honest view of whether your target date is realistic
We reply within one business day. SemperWise is not a certification body and does not issue ISO certificates.
Thank you
Your enquiry has reached us. A member of the SemperWise team will get back to you within 24 business hours.
If it is urgent, call +91-95851-60363.
Where SemperWise fits
The work before, between and around the audits
Services are people doing the work; SemperWise One is the platform that keeps evidence current between audits. Each row says which.
“Where do we actually stand?”
A fixed-scope gap assessment against clauses 4 to 10 and all 93 Annex A controls, every gap costed with a named owner.
Our ISO 27001 approach“We need the ISMS built, not a template pack.”
Risk assessment, Statement of Applicability and policies written with your control owners — or the whole programme run for you on a subscription, into the surveillance years.
Compliance as a service“The internal audit has to be independent.”
An internal audit and management-review support, run as a genuine dry run so nonconformities surface with us, not with your certification body.
Compliance readiness“Year two always turns into a fire drill.”
Evidence Collection stores each artefact with its collection date and expiry, and the Compliance Calendar holds surveillance and review dates.
SemperWise One“Other customers want SOC 2 as well.”
One control set mapped across frameworks, so a control implemented once evidences ISO 27001, SOC 2 and the rest.
Unified control model“Our technical controls need testing evidence.”
Penetration testing with every finding confirmed by a person, mapped to Annex A, and a retest included.
VAPT“Nobody owns the ISMS full time.”
A named senior practitioner a few days a month to own the programme, chair the management review and handle the auditor.
Virtual CISOPlain words
The terms on an ISO 27001 quote
- Certification body
- The independent organisation that audits your ISMS and decides whether to certify it. It must be accredited to be internationally recognised, and may not consult on the system it certifies.
- NABCB
- The National Accreditation Board for Certification Bodies, a constituent board of the Quality Council of India — India’s accreditation body for ISO 27001 certification bodies.
- International recognition arrangement
- The mutual-recognition agreement between accreditation bodies: the IAF MLA until 1 January 2026, when Global Accreditation Cooperation Incorporated replaced IAF and launched its own arrangement.
- ISO/IEC 27006-1
- The extra requirements for bodies certifying ISO 27001, including Annex C on audit time. The 2024 edition replaced ISO/IEC 27006:2015.
- Auditor-day
- The unit audit time is calculated and charged in — one auditor for one working day.
- Stage 1 and Stage 2
- The two parts of the initial audit: readiness and documentation first, then whether the ISMS operates as documented.
- Surveillance audit
- The audit in each year between certification and recertification.
- Statement of Applicability
- Every Annex A control, whether it applies and why — the first document a certification auditor reads.
Questions
What buyers ask about next.
The follow-up questions this subject raises, answered in full.
How much does ISO 27001 certification cost in India?
It depends on scope more than anything else, which is why we do not publish a figure: one number would be wrong for most readers. The cost comes in three budgets — the accredited certification body’s audits over three years, the implementation work paid to a consultant or in staff time, and remediation and tooling for the gaps found. The certification fee follows auditor-days, which ISO/IEC 27006-1 ties to the people in scope. We scope in a 30-minute call at no charge, then quote a fixed price for our part. See our ISO 27001 page.
How do certification bodies calculate ISO 27001 audit days?
Under Annex C of ISO/IEC 27006-1:2024. The starting point is the number of persons doing work under your organisation’s control within the scope, wherever they are; the body then weighs the other factors affecting audit time that ISO/IEC 17021-1 lists. Multi-site organisations are generally calculated on their total headcount. The table sits in the paid standard, so ask each body to show its calculation. Do not rely on IAF MD 5: it governs quality, environmental and health-and-safety audits, not information security, though many cost pages quote it.
What does ISO 27001 cost after the first year?
More than most budgets allow for. An accredited certificate runs on a three-year cycle, so years two and three each carry a surveillance audit, and year three a recertification audit. Between audits the controls must keep operating — access reviews, log reviews, supplier checks, training — and someone has to collect the evidence, often including yearly independent testing. Year two is cheap only for organisations whose evidence is collected as controls run, not assembled the month before the auditor arrives. Compliance as a service is built for that.
Can the consultant who builds our ISMS also certify it?
No. ISO/IEC 17021-1 forbids a certification body, any part of the same legal entity and any entity under its control from offering management-system consultancy. Where a body related to the certification body has consulted, the certification body must not certify that system for at least two years. ISO/IEC 27006-1 adds that it must be independent of whoever performs your internal ISMS audit. So the work splits cleanly: a consultant such as SemperWise builds the system and runs the internal audit; an accredited body you appoint audits it and decides.
How do I check that a certification body or certificate is genuine?
Start with the accreditation body’s own directory. NABCB listed 16 accredited ISMS certification bodies when we checked on 6 November 2026, alongside withdrawn and suspended accreditations; bodies accredited by other members of the international arrangement are legitimate too. To check a certificate, search IAF CertSearch — but participation is voluntary for certification bodies, so a missing certificate is a reason to ask the issuer, not proof of a fake. IAF ceased operations on 1 January 2026; its successor, Global Accreditation Cooperation Incorporated, says existing accreditations continue to be recognised.
How long does ISO 27001 certification take in India?
Typically four to nine months from scoping to the certification decision. A tight scope, reasonable IT discipline and an internal owner with real time can get you audit-ready in about four; a broad scope, few existing controls and nobody owning the work push it to nine or beyond. Two things cannot be compressed: controls need some operating history before Stage 2 has anything to test, and both stages must be booked with the certification body, with a gap between them. Treat any fixed promise of a date with suspicion.
Is ISO 27001:2013 still valid?
No. Under IAF MD 26, every certificate issued against the 2013 edition expired or was withdrawn at the end of the transition period on 31 October 2025, and initial and recertification audits have been to the 2022 edition only since 30 April 2024 at the latest. The 2022 edition has 93 Annex A controls in four themes, down from 114 in fourteen clauses: 11 are new, 24 merged and 58 updated. A certificate not transitioned in time means a new initial certification, with the Statement of Applicability rebuilt on the 2022 control set.
Do remote audits make ISO 27001 cheaper?
They can cut travel and expenses, which matters when auditors would otherwise fly in. Whether they change the audit time itself is the certification body’s calculation to show you, not something to assume. ISO/IEC 27006-1:2024 was updated for remote audits and for organisations with few or no physical sites, so a cloud-first company should ask how the body treats it. Physical and people controls stay in scope when nobody visits: offices, remote working and equipment disposal all need evidence. Ask which parts will be audited remotely, and write it into the quote.
Sources
Checked by our research desk on 6 November 2026. Regulations and figures move; where a number here matters to a decision, follow it to the source.
- ISO/IEC 17021-1:2015 — Requirements for bodies providing audit and certification of management systems (preview, clause 5.2) — ISO/IEC, 2015 (preview pages via iTeh Standards)
- ISO/IEC 27006-1:2024 — Requirements for bodies providing audit and certification of ISMS, Part 1 (preview: foreword, clause 5.2.2, contents incl. Annex C) — ISO/IEC, March 2024 (preview pages via iTeh Standards)
- Question 48.5: Audit time determination to ISO/IEC 27006-1:2024 for multisite (C.6) — European Accreditation, September 2024
- IAF MD 5:2023 — Determination of audit time of quality, environmental and OH&S management systems — International Accreditation Forum, June 2023
- ISO/IEC 27001:2022 — Information security management systems — Requirements (preview) — ISO/IEC, October 2022 (preview pages via iTeh Standards)
- IAF MD 26:2023 — Transition requirements for ISO/IEC 27001:2022 — International Accreditation Forum, 2023
- NABCB Policy on Transition for ISO/IEC 27006-1:2024 — NABCB, August 2024
- National Accreditation Board for Certification Bodies — a constituent board of the Quality Council of India — NABCB
- Member details: NABCB — accreditation body and MLA signatory, ISO/IEC 27001 (ISMS) scope — International Accreditation Forum (archived site)
- Management system certification — accredited certification bodies, ISMS — NABCB, checked 6 November 2026
- Global Accreditation Cooperation Incorporated launch unifies international accreditation organisations — International Accreditation Forum, 1 January 2026
- IAF CertSearch — validate accredited certifications — International Accreditation Forum (archived site)
- IAF CertSearch information guide for certification bodies (participation rules) — IAF CertSearch
Next step
Know every line before you sign any of them.
A 30-minute scoping call, no charge. You leave with a written scope any certification body can quote against, and a fixed price for the work that is ours. The certificate comes from an accredited body you appoint.