The honest answer is that it depends on four things you can assess yourself in about ten minutes: how many people you have, how wide the ISMS scope is, how many legal entities are in it, and how organised your evidence already is. This article is about how to place yourself against those four, so the conversation starts from a real position rather than a guess.
We do not publish prices. The smallest engagement, the Mini Gap Review, is a fixed-scope package delivered remotely, and its fee is credited in full toward a readiness assessment commissioned within 30 days. Everything is quoted after a short call, because it genuinely differs by market, by scope, and by whether anyone needs to be on site.
What drives your number
| What we look at | Why it moves the price |
|---|---|
| Employee count | More people means more access to review, more joiners and leavers, and more interviews |
| ISMS scope | One product on one cloud account is a different job from five products, two data centres and an on-prem estate |
| Number of legal entities | A group structure multiplies the risk register, the Statement of Applicability and the evidence behind both |
| Audit date | A compressed deadline needs more hands working in parallel, not the same work done faster |
| Evidence quality today | If evidence is already organised the assessment is quick. If it is spread across Drive, Slack and inboxes, finding it is part of the work |
| Where you are | Delivery cost differs by market, and on-site work adds travel |
The last row is why you will not find a single published range here. A number that is right for a 60-person company in one country is wrong for the same company in another, and quoting one range for both would mean overcharging one of them.
Place yourself in about ten minutes
Count your employees. Write down what is in scope - products, environments, entities. Then ask one honest question about evidence: if an auditor asked for proof that access reviews happened last quarter, how long would it take to produce it? If the answer is "an hour", your assessment is at the light end of the work. If it is "I would have to ask three people and search Slack", locating and grading evidence will be a real part of it.
That single question predicts more about the effort than headcount does.
What you actually get
A readiness assessment is not a checklist. It covers clauses 4-10 and Annex A, reviews your risk register and Statement of Applicability, includes interviews and evidence review, and hands back a readiness score, a gap register ranked by audit impact, a view of your Stage 1 and Stage 2 risks, and a 30/60/90 remediation plan. The full inclusions are on the pricing page.
The cheapest way to get a real number
Two routes, both without a sales process. Take the five-question Service Finder to see which engagement fits, or start with the fixed-scope Mini Gap Review - it tells you the size of the problem for a small fixed fee, which comes off the assessment if you continue within 30 days.
Kellwick is an independent advisory practice, not a certification body. We prepare you for certification; the certification body's audit fee is separate and quoted by them.
Want a fixed price for your scope?
Tell us the standards, sites and timeline; you receive a written proposal with scope, deliverables and a fixed price.