ISO 27001 cost for a 50, 100 and 250-person company

Headcount is the single biggest driver of ISO 27001 preparation cost, because it drives how much access, how many people and how much evidence an assessment has to cover. As a rough guide, budget from $4,500 for a 50-person company, around $6,000 for 100 people, and $7,500 or more for 250 - for the readiness assessment. Remediation and any ongoing retainer are separate lines.

This article walks through all three sizes so you can build a realistic budget, not just a single number.

Readiness assessment by size

Company size	Readiness assessment	Why
~50 people	from $4,500	One product, few teams, contained access review
~100 people	from $6,000	More teams, more joiners/leavers, wider evidence
~250 people	from $7,500	Multiple teams and often multiple entities

Get an instant estimate for your exact situation from the pricing calculator, or see the full breakdown on the pricing page.

The three cost lines to budget

ISO 27001 is rarely a single invoice. Plan for up to three:

1. Find the gaps - a readiness assessment (ranges above), or a fixed $1,250 Mini Gap Review if you just need a fast snapshot.
2. Close the gaps - a Remediation Sprint from $8,500, scaled to how many gaps you have.
3. Keep it running - ISMS Maintenance from $2,000/month once you are certified, so the system does not go stale before surveillance.

What scales with headcount

• Access reviews. More people, more systems, more joiners and leavers to evidence.
• Interviews. More control owners to talk to across more teams.
• Entities. A 250-person group is often several legal entities, each multiplying the risk register and Statement of Applicability.
• Evidence volume. More activity produces more evidence - and more places for it to hide.

Worked examples

• 50 people, one product, one entity, AWS-only: readiness from $4,500. If evidence is tidy, closer to the floor.
• 100 people, two products, one entity: readiness around $6,000, plus a likely remediation sprint if this is a first-time certification.
• 250 people, two entities, mixed cloud: readiness $7,500+, and remediation scaled to the gap count. This is where an ongoing retainer usually starts to make sense.

The separate cost people forget

The certification body's audit fee (Stage 1 and Stage 2) is billed by the certification body, not by us, and also scales with your headcount and scope. Ask any CB you shortlist for a quote early - it belongs in the budget from day one.

Figures here are indicative and not a binding quote. Kellwick prepares you for certification; it does not perform it and cannot guarantee the outcome.