How Much Does ISO 27001 Implementation Cost?

Tuesday, February 15, 2011

Dejan Kosutic


This is usually one of the first questions I receive from the potential client. To their disappointment, I cannot give them the exact figure right away - here is why.

First of all, the total cost of implementation will depend on the size of your organization (or the size of the business unit(s) that will be included in the ISO 27001 scope), the level of criticality of information (for instance, information in banks is considered more critical and demands a higher level of protection), the technology the organization is using (for instance, the data centers tend to have higher costs because of their complex systems), and the legislation requirements (usually the financial and government sectors are heavily regulated with regards to information security).

Second, you won't be able to calculate the exact costs before you know which level of protection you need - first you have to perform risk assessment, because such analysis will tell you which security measures are required.

When you know the results of risk assessment, you will have to take into account the following costs:

1. The cost of literature and training

Implementation of ISO 27001 requires changes in your organization, and requires new skills. You can prepare your employees by buying various books on the subject and/or sending them to courses (in-person or online) - the duration of these courses varies from 1 to 5 days (read How to learn about ISO 27001 and BS 25999-2).

And don't forget to buy the ISO 27001 standard itself - too often I run across companies implementing the standard without actually seeing it.

2. The cost of external assistance

Unfortunately, training your employees is not enough. If you don't have a project manager with deep experience in ISO 27001 implementation, you'll need someone who does have such knowledge - you can either hire a consultant or get some online alternative (this is what we do at Information Security & Business Continuity Academy).

The greatest value of someone with experience helping you with this kind of project is that you won't end up in dead end streets - spending months and months doing activities that are not really necessary or developing tons of documentation not required by the standard. And that really costs.

However, be careful here - do not expect the consultant to do the whole implementation for you - ISO 27001 can be implemented by your employees only.

3. The cost of technology

It might seem funny, but most companies I've worked with did not need a big investment in hardware, software or anything similar - all these things already existed. The biggest challenge was usually how to use existing technology in a more secure way.

However, you do need to plan such investment if it proves to be necessary.

4. The cost of employees' time

The standard isn't going to implement itself, neither can it be implemented by a consultant only (f you hire one). Your employees have to spend some time figuring out where the risks are, how to improve existing procedures and policies or implement new ones, they have to take some time to train themselves for new responsibilities and for adapting to new rules.

5. The cost of certification

If you want to obtain public proof that you have complied with ISO 27001, the certification body will have to do a certification audit - the cost will depend on the number of man days they will spend doing the job, ranging from under 10 man days for smaller companies up to a few dozen man days for larger organizations. The cost of man day depends on the local market.

You have to be very careful not to underestimate the true cost of ISO 27001 project - if you do, your management will start looking at your project in a negative light. On the other hand, forecasting all costs correctly will show your level of professionalism; and don't forget - you always have to present both the cost and the benefits - read Four key benefits of ISO 27001 implementation.

Cross posted from ISO 27001 & BS 25999 blog - 

*   *   *

FREE WEBINAR - February 16 - ISO 27001 & BS 25999-2: Why is It Better to Implement Them Together?

February 16, February 22 - Internal Audit: How to Conduct it According to ISO 27001 and BS 25999-2

February 16, February 23 - ISO 27001 Lead Auditor Course Preparation Training

February 17, February 23 - BS 25999-2 Foundations Part 1: Business Impact Analysis

February 21 - ISO 27001 Foundations Part 2: Implementation, Monitoring and Reviewing, Maintaining and Improving the ISMS

February 22, March 7 - ISO 27001 Foundations Part 3: Annex A Overview

FREE WEBINAR - February 23 - ISO 27001: An Overview of ISMS Implementation Process

February 24, March 9 - BS 25999-2 Foundations Part 2: Business Continuity Strategy

March 8, March 21 - Risk Management Part 1: Risk Assessment Methodology and Risk Assessment Process

FREE WEBINAR - March 9 - BS 25999-2: An Overview of BCM Implementation Process

March 9, March 22 - How to Become ISO 27001 / BS 25999-2 Consultant

March 10, March 23 - BS 25999-2 Foundations Part 3: Business Continuity Planning

March 22, April 4 - Risk Management Part 2: Risk Treatment Process, Statement of Applicability and Risk Treatment Plan

FREE WEBINAR - March 23 - ISO 27001 Implementation: How to Make It Easier Using ISO 9001

March 23, April 6 - ISO 27001 / BS 25999-2 Management Responsibilities: What Does Management Need to Know?

March 24, April 18 - How to Write Four Mandatory Procedures for ISO 27001 and BS 25999-2

April 5, April 19 - ISO 27001 A.6 & A.8: Organization of Information Security; External Parties; Raising Awareness, Training and HR Management

April 5, April 20 - ISO 27001 and ISO 27004: How to Measure the Effectiveness of Information Security?

FREE WEBINAR - April 6 - ISO 27001/BS 25999-2: The Certification Process

April 6, April 19 - ISO 27001 A.7: Asset Management and Classification

Possibly Related Articles:
Compliance Training Security Audits ISO 27001 BS 25999-2
Post Rating I Like this!
The views expressed in this post are the opinions of the Infosec Island member that posted this content. Infosec Island is not responsible for the content or messaging of this post.

Unauthorized reproduction of this article (in part or in whole) is prohibited without the express written permission of Infosec Island and the Infosec Island member that posted this content--this includes using our RSS feed for any purpose other than personal use.