Cost
What does ISO 27001 certification cost?
In short
For a Swedish company with 10–100 employees, the first-year total for ISO 27001 normally lands between SEK 150,000 and 700,000. The certification body’s audit is SEK 60,000–150,000 whichever route you take. The difference is in implementation: consultant support costs SEK 80,000–300,000 according to public price guides, traditional ISMS platforms SEK 30,000–100,000 a year, while Isodora costs SEK 20,400 a year for the platform and the ISO 27001 project. Your own time is the item most often forgotten.
Last reviewed: September 2026
Calculator
Estimate your ISO 27001 certification
Ranges are based on public Swedish price data (sources at the bottom of the page). Your own time is valued at the hourly cost you enter. Use the result as input for quote requests.
Estimated total cost
173,289–328,733 kr
first year, excluding VAT
Breakdown
- Certification audit (stage 1 + 2)
- 68,889–103,333 kr
- Consultant support
- 0 kr
- Platform (Isodora)
- 20,400 kr
- External internal audit
- 0–30,000 kr
- Own working time
- 84,000–175,000 kr
- Own hours
- 120–250 h
Surveillance audits in years 2 and 3 add SEK 30,000–70,000 per year. Certification bodies price by audit days; request quotes from at least two Swedac-accredited bodies.
The cost items, one by one
All amounts exclude VAT and assume a company with 10–100 employees and a bounded scope. Ranges come from public Swedish price guides and the certification bodies’ own descriptions; sources are listed at the bottom.
| Item | Typical range, year 1 |
|---|---|
| Certification audit (stage 1 + stage 2, accredited body) | SEK 60,000–150,000 |
| Surveillance audits, years 2 and 3 | SEK 30,000–70,000 per year |
| Consultant support for implementation (if hired) | SEK 80,000–300,000 |
| Traditional ISMS/GRC platform | SEK 30,000–100,000 per year |
| Isodora: platform SEK 500/month + ISO 27001 project SEK 1,200/month | SEK 20,400 per year |
| External internal audit (if purchased) | SEK 40,000–80,000 |
| Your own working time | 120–800 hours depending on route |
| Missing technical measures (MFA, backup, logging) | SEK 0–100,000 |
Three routes and what they cost
| Route | Estimated total, year 1 |
|---|---|
| Consultant-led project | SEK 300,000–700,000. Consultant 150,000–300,000, audit 60,000–150,000, internal audit 40,000–80,000, own time 100–200 hours. Public guides quote SEK 200,000–600,000 overall; a fully outsourced project can cost considerably more. |
| Do it yourself in Excel and Word | SEK 150,000–400,000. Audit 60,000–150,000, no consultant, but 400–800 hours of own time that is rarely counted — and the highest risk of failing stage 2. |
| Platform (Isodora) | SEK 100,000–250,000. Licence 20,400, audit 60,000–150,000, own time 120–250 hours, possibly a few hours of external review. |
What decides where in the range you land
- Scope: more sites, systems and people mean more audit days. Certification bodies price by audit days under IAF guidance.
- Starting point: if you already have MFA, backups, logging and a named owner, half the job is done.
- Who does the work: consultant hours cost SEK 1,200–2,000; your own hours are cheaper per hour but dearer if taken from development or sales.
- Choice of certification body: request quotes from at least two Swedac-accredited bodies. The price differences are real.
Run the numbers for your own case
The calculator above gives a range based on size and route. It uses the same public ranges as the tables and values your own time at the hourly cost you enter. Treat the result as input for a quote request, not as a price.
What Isodora costs for ISO 27001
The platform fee is SEK 500 a month and the ISO 27001 project SEK 1,200 a month, so SEK 20,400 a year excluding VAT. You pay by card with no commitment beyond the period, and can add the management-system module (SEK 500/month) when you run several frameworks in one system.
Requirement text verbatim, under licence from SIS
You work against the standard’s actual text, not a paraphrase, which makes the audit simpler.
Replaces the consultant’s documentation
Policies, risk assessment and statement of applicability are generated against the requirements and owned by you.
Cuts your own time
Gap analysis, owned tasks and automated evidence collection remove weeks of manual work.
The audit is extra
You pay the certification body’s fee to them. We help you prepare so stage 2 does not have to be repeated.
Amounts for consultants, platforms and certification bodies are ranges from public sources in September 2026 and vary with scope and supplier. Certification is issued by an accredited body after its own audit.
Frequently asked questions
- What does ISO 27001 certification cost for a small company?
- Expect SEK 150,000–700,000 in the first year for 10–100 employees, where the certification audit accounts for SEK 60,000–150,000 and the rest is implementation: consultant, tooling and own time. With a platform instead of a consultant, many land in the lower part of the range.
- What does the audit itself cost?
- Certification bodies price per audit day. For a company with 10–100 employees and a bounded scope, stage 1 and stage 2 together usually cost SEK 60,000–150,000, and the surveillance audits in years 2 and 3 about half. Request quotes from several Swedac-accredited bodies.
- Can you get ISO 27001 certified without a consultant?
- Yes. The standard requires a working management system, not a consultant. With a platform that keeps requirements, controls and evidence together, many 10–100-person companies run the project themselves and buy a few hours of review before the audit if needed.
- What does it cost to keep the certificate?
- Surveillance audits in years 2 and 3 cost SEK 30,000–70,000 a year, and recertification every third year roughly as much as a new stage 2. Add ongoing work: internal audit, management review and evidence upkeep, which a tool reduces but does not remove.