ISO 27001 certification in India costs ₹1.5–2.5 lakh all-in for a 10–50 person company and ₹3–4.5 lakh for 50–200 people. Those figures include both the consulting work and the accredited certification body's audit fee, because Praxis-Q quotes the engagement end to end rather than leaving the body fee as a surprise at the finish line.
That is the whole price list. It does not change if you are in Mumbai rather than Indore.
What the certificate actually costs
| Organisation size | All-in cost | What it covers |
|---|---|---|
| 10–50 employees | ₹1.5–2.5 lakh | Gap assessment, risk assessment, ISMS documentation, internal audit, Stage 1 and Stage 2 support, certification body fee |
| 50–200 employees | ₹3–4.5 lakh | As above, with wider scope: more locations, more systems, more evidence to gather |
| Annual surveillance (years 2 and 3) | ₹60,000–80,000 per year | Surveillance audit and the evidence pack it requires |
Over the full three-year certificate cycle, a 40-person company should expect roughly ₹2.7–4.1 lakh in total — the year-one figure plus two surveillance audits.
Why the price does not vary by city
A lot of published guidance breaks ISO 27001 pricing down by city, as though Pune were structurally cheaper than Mumbai. It is not, and the reason is simple: almost none of the cost is local.
The certification body fee is set nationally by the accredited body — BSCIC, IRQS or NQA — not by the city its auditor flies from. The consulting effort is driven by your headcount, the number of systems in scope, and how much of the ISMS already exists, none of which changes with your postcode. Audits themselves are now largely remote. What genuinely varies by location is travel for on-site audit days, which on a typical engagement is a rounding error against a ₹2 lakh project.
If a quote moves materially because you are in a metro, ask what specifically got more expensive. There should be a concrete answer.
What actually moves the number
Scope. The single biggest lever. Certifying one product team is a different engagement from certifying an entire company across four offices. Scope is defined at the start and it determines everything downstream.
Your starting position. A company that already runs access reviews, keeps an asset register and has incident records will move through the ISMS build far faster than one starting from nothing. Prior SOC 2 or PCI DSS work transfers particularly well — the evidence overlaps heavily.
Headcount. More people means more roles to define, more training records, more access to review, and a larger sample for the auditor to pull from.
Number of sites and cloud accounts. Each additional location or production environment adds evidence and, occasionally, audit days.
Tooling. Optional. A compliance platform can reduce evidence-gathering effort, but it is not required for certification and adds its own annual licence cost. Plenty of certified companies run the ISMS on documents and a ticket queue.
The floor: below ₹1.5 lakh, something is missing
Offers exist in the market at ₹20,000–50,000, sometimes promising a certificate within days. It is worth being direct about what those are.
An accredited ISO 27001 certificate requires a two-stage audit by a body accredited under an IAF member — Stage 1 reviews your documented ISMS, Stage 2 tests whether it actually operates. The body's own fee alone is a meaningful share of ₹1.5 lakh. Anything materially below that is either a non-accredited certificate, which sophisticated enterprise buyers and government tenders reject on sight, or it is skipping the implementation work and handing you a document your first surveillance audit will unpick.
The practical test: ask which accredited body issues the certificate and check that body's accreditation status yourself. A real answer takes ten seconds to give.
Timeline
Praxis-Q delivers ISO 27001 in weeks rather than the three to six months commonly quoted. The compression comes from running the gap assessment, risk assessment and documentation in parallel rather than in sequence, and from booking the certification body audit slot at the start of the engagement instead of at the end — the audit calendar, not the preparation, is usually what stretches these projects.
What we do not compress is Stage 2. The auditor needs to see controls that have genuinely operated, and there is no version of this where evidence is manufactured to hit a date.
Consultant or compliance platform?
Platforms automate evidence collection and monitoring well. What they do not do is define your scope, write your risk treatment plan, sit in the Stage 2 audit, or answer the auditor when a control is challenged. Most companies certifying for the first time need the judgement more than the automation, and the platform becomes genuinely valuable afterwards, for maintaining the certificate.
Cost matters here too: a platform licence is an annual cost that never stops, while the implementation work is largely one-time. Read the three-year total, not the first invoice.
What you get for the figure above
Gap assessment against all 93 Annex A controls of ISO/IEC 27001:2022. Risk assessment and risk treatment plan. The full ISMS document set including the Statement of Applicability. Internal audit and management review. Stage 1 and Stage 2 audit support, with us present for both. And the certification body fee, through BSCIC, IRQS or NQA, included rather than excluded.
Full scope details are on our ISO 27001 certification service page. For a scoped quote against your actual headcount and systems, get in touch — the bands above are what you should expect it to land in.
Frequently asked questions
Is the certification body fee really included?
Yes. Praxis-Q quotes all-in. We do not write an out-of-scope clause for certification body fees, because a compliance quote that excludes the cost of the certificate is not a real number.
Does ISO 27001 cost more in Mumbai or Bangalore than elsewhere in India?
No. The certification body fee is national, the consulting effort is driven by scope and headcount, and audits are largely remote. Only on-site audit travel varies by location, and it is immaterial against the project total.
What does the annual surveillance audit cost?
₹60,000–80,000 per year in years two and three. The certificate is valid for three years, with a surveillance audit in each of the intervening years and a recertification at the end of the cycle.
Why are cheaper certificates a problem?
Because enterprise procurement and government tenders check the accreditation of the issuing body, not just the certificate. A non-accredited certificate fails that check, which means paying twice — once for the certificate that did not work, and again for the one that does.
How this article was made: drafted with AI assistance from Praxis-Q's audit checklists and engagement experience, then fact-checked and edited by our consultants before publishing. Corrections: hello@praxis-q.com.
Free Consultation
Ready to Get Compliant?
ISO 27001, PCI DSS, HIPAA, SOC 2 & more — fast-track in a few weeks.
Tags
Share this article
Sahil Dubey
Compliance & Security Expert
Praxis-Q’s compliance and offensive-security practitioners deliver ISO 27001, SOC 2, PCI DSS, HIPAA, GDPR and DPDP engagements for banks, payment gateways and regulated fintechs.