The cost of preparing for a surveillance audit

Preparing for an ISO 27001 surveillance audit is usually far lighter than the original certification - a Surveillance Readiness Check starts from $3,500. Surveillance auditors do not re-audit everything; they check that your prior findings stayed closed and that the ISMS did not drift since certification. If you kept the system running, prep is a confirmation exercise. If you went quiet for a year, it is a rebuild.

That is the real variable in the cost: not the audit itself, but how much drift there is to fix first.

What surveillance prep costs

Situation	Typical
ISMS kept running, evidence current	from $3,500 (a readiness check)
Significant drift since certification	a check, then remediation scaled to the gaps

See the inclusions on the pricing page.

The drift that makes it expensive

The cost climbs when an auditor finds the ISMS was maintained on paper but not in practice. The signals they look for:

• Prior nonconformities closed on paper, but the underlying issue quietly returned.
• A risk register untouched since the certification audit.
• No internal audit or management review run this cycle.
• Access reviews that stopped once the certificate was in hand.
• Evidence all dated to certification week, not spread across the year.

Every one of those is fixable, but fixing them close to the audit costs more than never letting them slip.

The cheaper path: do not let it drift

The reason ISMS Maintenance exists (from $2,000/month) is that steady upkeep is dramatically cheaper than an annual scramble. A monthly evidence check, risk register upkeep and a management-review cadence mean surveillance prep is a light confirmation, not a rescue.

Before you book the auditor

Run a readiness check first so you walk in knowing you will pass. If you want to scope it, the pricing calculator will point you at the right starting point, or book a call and we will size it against your certification date.

Figures are indicative and not a binding quote. Certification and surveillance decisions are made by your accredited certification body; we prepare you and never guarantee the outcome.