ISO 27001 certification cost in Australia

The certification body's audit fee scales with the size of the organisation being certified and the number of sites or services in scope, since a larger scope means more auditor time on-site. On top of the audit itself, most businesses also spend on preparation: gap analysis against the standard, writing the required policies and risk documentation, and staff training, either done internally or through a consultant.

The audit fee then repeats every year as a smaller surveillance audit, with a larger recertification audit every three years.

The process starts with a gap analysis against the standard's Annex A controls, followed by writing the required policies, risk register and Statement of Applicability. Most businesses run an internal audit against their own management system before inviting the certification body in. The external audit itself happens in two stages: Stage 1 checks the paperwork is in place and scopes the Stage 2 visit, and Stage 2 is the substantive audit of whether the controls are actually being followed in practice, not just documented. A business with no existing security documentation typically spends several months on the preparation work before Stage 1 can even happen; a business that already runs a mature, well-documented environment moves faster. Timeframes vary with how much of that documentation and internal process work already exists: a business starting from nothing typically spends several months on preparation before Stage 1 is even worth scheduling, and the two audit stages themselves are usually weeks apart rather than the same visit, so the whole first certification is realistically a multi-month project, not a single booking. None of that is unique to any one provider or certification body; it's how the standard's own two-stage audit structure works for any business pursuing it.

Of the real, on-file ISO/IEC 27001 certificates in MSP Pie's own register, 109 of 111 held under the current 2022 revision are accredited through JAS-ANZ, Australia's own national accreditation body and a full member of the International Accreditation Forum; the other two are accredited through ANAB and IAS, both also IAF members. That accreditation chain is what separates a real certificate from a document a business wrote itself: JAS-ANZ accredits the certification body, and the certification body then audits and certifies the individual business directly, so JAS-ANZ never touches an individual business's audit. See our guide on verifying a certificate for how to check that chain for a specific provider.

Certification says a business has an information security management system that's been independently audited against a recognised international standard, covering the exact scope stated on the certificate. It doesn't say the business is immune to a breach, and it doesn't cover anything outside the stated scope. See "What certification does not mean" on our guide to what ISO 27001 actually is.

Across every certification currently on file with MSP Pie: 111 Australian IT providers hold ISO/IEC 27001:2022 (information security), 51 hold ISO 9001:2015 (quality management), 16 hold ISO 14001:2015 (environmental management), 7 hold ISO/IEC 42001:2023 (AI management systems), and 6 hold ISO 45001:2018 (work health and safety). A provider holding more than one has usually built out a broader management-system practice rather than certifying against ISO 27001 in isolation, which is part of why audit cost varies so much between providers: a business layering ISO 27001 onto an existing ISO 9001 management system reuses processes (document control, internal audit, management review) the first certification already built, while a business starting from nothing pays for all of that from scratch.

We looked at whether to estimate a range from the certification records we hold, but MSP Pie doesn't have real Australian pricing data for ISO 27001 audits, and inventing a number, even a broad range clearly labelled as indicative, would be worse than not answering at all: it would look like real data with nothing behind it. What we do have is real data on who holds the certification, what the accreditation chain looks like, and what the process actually involves, covered above and below. If you're comparing quotes from certification bodies or consultants, ask each one for a written scope and fee proposal specific to your business size and current documentation state; that's the only number that will actually mean anything for your situation, and it's the number we'd rather you get from a real quote than a guess from us. What we can do instead is point you at real, already-certified providers directly: our certified providers register lists every Australian IT provider MSP Pie has a real, on-file certificate for, filterable by location and team size, so you can shortlist a few and ask them for a quote alongside whichever certification body or consultant you're comparing them to.