Compare quotations based on the same scope and allocation of responsibilities. Separate one-off implementation from ongoing management so you can decide what to do yourselves and where to purchase support. The ISO 27001 standard page helps you define that requirement.
Which cost items belong in the budget?
Show the following items separately. This avoids comparing a low price for guidance with a quotation that also includes implementation work.
- Internal effort: coordination, interviews, decisions, implementation and gathering evidence. Calculate hours using your own internal cost rate.
- Implementation support: initial assessment, risk assessment, planning and agreed implementation support.
- Software: the licence for managing standards, risks, tasks and evidence.
- Improvements: for example, changes to access management, recovery facilities or supplier arrangements, where the risk assessment calls for them.
- Assessment: an internal audit and, if you want certification, the certification body's external audit.
- Maintenance: recurring checks, changes, training and follow-up after certification.
A certificate is issued by an independent body. Request a separate quotation for certification. Read ISO's explanation of certification.
How much does DCA support cost?
The published starting price for implementation support is €2,080 per month excluding VAT. This is based on 4 hours per week × €120 × 52 weeks ÷ 12 months. It is an average monthly estimate for support, not a fixed total price for a certification project.
The Compliance Tool is separate: from €295 per month with an annual subscription (€3,540 per year), or from €320 per month with a subscription cancellable monthly. With an annual subscription and 4 hours of support per week, the combined estimate is €2,375 per month excluding VAT.
The calculator uses 4 to 40 support hours per week, in increments of 2. Your own hours are shown as capacity, but their cost is not added to the total in euros. View the current prices and calculation.
Within the agreed scope, DCA supports analysis, documents, controls and audit preparation. You remain involved in providing information, carrying out your own actions, validation and decisions. More implementation work by DCA requires a different allocation of resources. Record this in the implementation support agreement.
Which costs are not included in that monthly estimate?
The support price does not include a software licence, internal salary costs, technical improvements or the external certification audit. The calculator adds only the chosen software licence to the support. Have other work and any additional costs listed separately in the quotation.
For an internal audit, DCA publishes a daily rate of €1,000 for software customers and €1,500 for other organisations, including preparation, travel time and reporting. The required scope is agreed. See the internal audit rates and scope. This audit is a separate service, not a certification audit.
Ask the certification body what is included for stage 1, stage 2, any additional assessment, surveillance audits and recertification. Audit duration and price depend on factors including scope and complexity. BSI describes how certification depends on scope.
How do you create a verifiable estimate?
Which choices increase or reduce the work?
Multiple services, locations, systems and suppliers often increase the coordination required. The quality of existing processes and evidence also determines how much work remains. Start with an initial assessment rather than basing the budget solely on headcount.
Reuse suitable processes and agree on one location for evidence. Avoid having different people answer the same questions. At the same time, ensure internal owners retain time for implementation: a written policy does not take over their daily work.
Use the certification roadmap to connect costs to concrete outcomes at each stage.
Frequently asked questions
Is €2,080 per month the full cost of ISO 27001 certification?+
No. It is the average starting price for 4 hours of DCA support per week at €120 per hour, excluding VAT. Software, internal time, improvements and external certification are separate cost items.
Can I purchase the Compliance Tool on its own?+
Yes. Implementation support is optional. You then carry out the implementation yourselves and arrange the required assessments.
What should I continue to budget for after certification?+
Allow for internal management, your chosen software and support, internal audits, certification body audits and improvements. Have the frequency and scope included in the separate agreements.
Sources for this article
- ISO: the role of the certification bodyAccessed on 19 September 2026
- BSI: certification process and cost factorsAccessed on 19 September 2026
- DCA: published prices and calculatorAccessed on 19 September 2026
Explore this topic further
This is general guidance and does not replace an assessment of your situation or the official standard.