Estimate the internal time, tooling and external costs involved in preparing for ISO/IEC 27001:2022 certification. Adjust the assumptions to match your scope, starting point and product complexity.
The calculator shows its assumptions and does not assume that outsourcing is automatically cheaper.
Employees included in the certification scope, not necessarily total company headcount.
60 employees (51-150 employees)A subset of policies, risks or controls is already documented.
Sensitive health data, several suppliers and customer-security requirements.
Fully loaded monthly cost (€)
Stage 1 and Stage 2 must be performed by an independent accredited body. The same requirement applies whether you prepare internally or work with Asteron.
Planning estimate, not a quote. ISO/IEC 27001 does not prescribe a fixed implementation cost, timeline, number of documents or requirement to purchase a GRC platform. Certification-body fees are separate whether you prepare internally or with Asteron.
A transparent component comparison. Asteron prepares the ISMS but cannot conduct the certification audit or issue the certificate - the certification body must remain independent.
| Cost or effort | DIY preparation | Asteron ISO 27001 project |
|---|---|---|
| Internal effort | Calculator result | 25-40 client hours for an eligible standard scope |
| Internal-time cost | Calculator result | Not included in the Asteron professional fee; depends on which client roles participate |
| Professional-services fee | None unless external support is added | Asteron professional fee: €26,900 |
| Estimated preparation cost | €24,200-€43,000 | €26,900 (professional fee) + client-time participation |
| GRC or compliance tooling | Manual tracking (no licence cost) | Separate or optional - confirm during scoping |
| Internal audit | Qualified internal person | Separate - not included in the professional fee unless explicitly stated in scope |
| Independent certification audit | Separate | Separate |
| Timeline | 7-10 months | Audit-ready in 12 weeks for an eligible standard scope |
| Eligibility | Based on entered assumptions | Subject to Asteron eligibility and agreed scope |
The two routes are not automatically equivalent. DIY cost reflects estimated internal time and selected tools; the Asteron figure is a professional-services fee and still requires client participation. Certification-body fees remain separate in both cases.
Cost varies with scope boundaries, current security maturity, technical complexity, the number of legal entities and locations, supplier dependencies, the quality of existing evidence, and how consistently management is available for reviews and decisions. Two organisations of the same headcount can differ significantly on all of these axes.
Use the result for internal budgeting and to compare delivery models. It is not a certification quote and does not guarantee an audit duration. Actual figures depend on scope choices agreed with your certification body, remediation work and how quickly your team can produce evidence.
We'll walk you through the process, timeline and scope - no commitment required.
