What might ISO 27001 or SOC 2 cost you?

Because your actual scope sets the price. Two companies of the same headcount can land far apart depending on how many systems and cloud accounts are in scope, which Trust Services Criteria you include, and how much is already in place. The band here is a planning aid; the firm figure comes from a short scoping call and is then quoted as one fixed fee.

Scope and starting point, more than headcount. Bigger or more complex infrastructure means more controls to design and more evidence to collect, and starting from scratch costs more than walking in with controls already running. The audit fee itself — the certification body for ISO 27001, the CPA firm for SOC 2 — is a smaller, fairly predictable slice.

No. The timeline shown is readiness work — getting your controls designed, implemented, and evidenced. A SOC 2 Type II report then tests those controls across a separate 3–12 month observation window that runs after readiness. If a customer deadline is in play, that window is why starting early matters.

No. It is an indicative estimate based on a few inputs, grounded in our published cost guides. It is not a fixed price or a commitment, and it is not a guaranteed certification timeline. Share your scope and we will give you a fixed-fee quote for your situation.