What ISO 27001 certification costs in Ireland, from the certification bodies' own pages

As read on 30 October 2026, in euro, on each organisation's own pages. Where a cost is not in the table, nobody whose pages were read publishes it.

A certificate comes from a certification body after its own audit. On 30 October 2026 the directory of the Irish National Accreditation Board (INAB) listed three certification bodies accredited by INAB with ISO/IEC 27001 in their scope: Amtivo (Ireland) Limited in Dublin 12, NSAI in Dublin 9, and West Assured Solutions Limited in Galway.

Of the three, only Amtivo publishes a figure. NSAI says it returns a quotation specific to each organisation once its request form is completed, and West Assured's FAQ says the way to find out what certification will cost is to ask it for a quote. What the standard itself asks of a business is in ISO 27001 in plain words.

Amtivo's guide says a small business with fewer than 10 staff, operating from one location, might expect to pay between €4,500 and €7,000 for initial certification. The guide is dated 26 November 2024 and does not say whether the figure includes VAT. After certification comes a three-year cycle of yearly audits, which the guide says are typically much shorter because they assess ongoing maintenance.

The same guide lists what changes the price: the number of sites, the number of employees, the industry, the complexity of the organisation, the types of data handled, and how prepared the business already is. It says accredited certification bodies do not charge for a quotation.

NSAI quotes from its Request for Quotation form for ISO/IEC 27001 and ISO/IEC 27701 (form AD-27-01, revision 10), which it says helps it tailor its certification proposal to the organisation. The form asks for:

Certification bodies calculate audit time under ISO/IEC 27006-1:2024, the standard they are accredited against for ISO 27001 work. INAB's notice NF44 says that edition updated the audit time calculation, and that certification bodies had to use it for all clients no later than 31 March 2026.

European Accreditation (EA) quotes the rule in its FAQ 48.5: the total audit time for the on-site audit is calculated from the total number of persons doing work under the organisation's control, irrespective of their location. People who work from home are counted with everyone else. ISO/IEC 27006-1 itself was not read for this page, so its tables are not given here.

NSAI lists the steps as application and quotation, a Stage 1 audit (preliminary assessment), a Stage 2 audit (certification assessment), ongoing surveillance audits and recertification at defined intervals. Amtivo describes Stage One as checking that the standard's mandatory requirements are met and that the system can proceed, and Stage Two as checking that it is implemented and operational. Amtivo says the certificate lasts three years, with mandatory audits, and that a reassessment audit at the end renews it for another three.

NSAI's contract terms set out how its fees run. Fees are invoiced as the quotation letter says, and are payable in advance where it says so. Where the quotation says so, an annual registration fee or surveillance fee may be charged. Fees are subject to VAT, are reviewed from time to time with notice, and extra work caused by a change in the client's instructions or a failure to meet NSAI's requirements can be charged on top.

Amtivo's guide says to check that a quote covers the Stage 1 and Stage 2 audits, compliance and administration tasks, auditors' travel and management fees. It says certification logos can cost extra, depending on the body, and warns that a very low fee may come with a short or inflexible contract. It says the standard is a three-year contract.

Ask each body for the full three years in one quote: the initial audits, each surveillance audit, recertification, any annual registration fee, travel, and its terms for moving an audit date. Compare those totals, not the first-year figure.

No certification body read for this page publishes a day rate for ISO 27001 audits, or a price for surveillance or recertification audits. Nor do they price the work before the audit, which falls to the business: deciding the scope, assessing the risks, writing the Statement of Applicability and running an internal audit. Amtivo's guide says that documentation and internal audit stage may demand the greatest investment of money, time and resources.

If a customer has asked for "a security standard" and not named one, find out which before paying for any of this. CyFun, ISO 27001 and Cyber Essentials sets out what each one involves, and ISO 27001 readiness is the preparation before a certification body is called in.