ISO 27001

AUDITS GUIDE
The audits and associated costs
needed to gain and maintain
ISO 27001 certi�ication
 Audits Schedule
Once certi�ied, an ISO 27001 certi�ied Information Security Management System (ISMS)
must be audited annually to maintain certi�ication. Internal Audits must be done each year by
a third party, like Pivot Point Security, or internal personnel with an appropriate level of expertise
who has not been instrumental in building or running the ISMS. Objectivity is the key here.

ISO 27001 certi�ied organizations are also required to be on a three-year cycle of

Surveillance and Recerti�ication Audits by their certi�ication body (the company that handed you
your certi�icate). As an example, if you were certi�ied in 2018 your audit schedule with your
certi�ication body would look something like this:

Certi�ication Audit Surveillance Audit Surveillance Audit Recerti�ication Audit

2018 2019 2020 2021

Surveillance Audit Surveillance Audit Recerti�ication Audit Surveillance Audit

2022 2023 2024 2025

...and so on

1 info@pivotpointsecurity.com
 Audit Summaries

Performed by: Certi�ication body

CERTIFICATION AUDIT - It’s the �irst
audit performed by the certi�ication
body or registrar and is exactly what
the name suggests. If passed, you will Timing: Performed once (the �irst
receive your ISO 27001 certi�icate. time you receive your certi�icate)

Cost range: $15,000 to $30,000

Often companies need help preparing for a Certi�ication Audit (from a company like Pivot
Point Security) and costs associated with certi�ication preparation from a third party range
from $35,000 to $70,000

Performed by: Independent

INTERNAL AUDIT – It’s a requirement of party with suf�icient expertise
the standard for a certi�ied organization (internal or external resource)
to review its ISMS at planned intervals
(most often annually). The focus is to
ensure each area of the ISMS is reviewed Timing: Performed once every
within the three-year period. This audit year
demonstrates top management’s
commitment to ensuring the effectiveness
of the ISMS, which positions a certi�ied Cost range: $9,000 to $20,000
organization for a successful audit by the for external resource
certi�ication body.

2 info@pivotpointsecurity.com
 Audit Summaries

SURVEILLANCE AUDIT – It’s held in Performed by: Certi�ication body

years one and two after initial

certi�ication, and also in years one &
two following each recerti�ication. The
certi�ication body will focus on clauses
4-10 of ISO 27001 and take a risk-based
approach to Annex A controls. However,
typically all applicable controls are
reviewed during a Surveillance Audit to
ensure effectiveness of each control.
Timing: Performed in years one
and two after certi�ication
(or recerti�ication) audit
Cost range: 65% to 75% of your
Certi�ication Audit cost ($9,750 –
$22,500)

RECERTIFICATION AUDIT – It’s held Performed by: Certi�ication body

every three years with a signi�icant
level of detail, artifacts, and evidence
required to be provided by the
certi�ied organization. The goal is to Timing: Performed once every
continue to demonstrate three years
management’s commitment and
improvement of the ISMS to ensure its
effectiveness.
Cost range: $15,000 to $30,000

3 info@pivotpointsecurity.com
 Overall Costs
If you’re going to use an external resource (like Pivot Point Security) to prepare for your
Certi�ication Audit and subsequent Internal Audits, here is a year-by-year breakdown of the cost
ranges you can expect to achieve and maintain certi�ication:

2018
- Internal Audit performed by independent third party
Certi�ication Audit preparation and Internal - Surveillance Audit performed by certi�ication body
Audit = $35,000 to $70,000
Certi�ication Audit performed by certi�ication
body = $15,000 to $30,000 2019
2018 Total = $50,000 to $100,000 $9,000 to $20,000

$9,750 – $22,500
2020 2019 Total = $18,750 to $42,500
$9,000 to $20,000

$9,750 – $22,500

2019 Total = $18,750 to $42,500 2021

$9,000 to $20,000
Recerti�ication Audit performed by
certi�ication body = $15,000 – $30,000
2022
2021 Total = $24,000 to $50,000
$9,000 to $20,000

$9,750 – $22,500

2019 Total = $18,750 to $42,500

2023

$9,000 to $20,000

$9,750 – $22,500
2024
2019 Total = $18,750 to $42,500
$9,000 to $20,000
Recerti�ication Audit performed by
certi�ication body = $15,000 – $30,000

2021 Total = $24,000 to $50,000

4 info@pivotpointsecurity.com
 Have questions or need
more information?

... reach out!

info@pivotpointsecurity.com