ISO 27001 Certification Cost in Singapore

ISO 27001 certification cost in Singapore has two separate external bills, ZES consultancy and the accredited certification body's audit. You also need to budget your team's time and any security tools. We quote ZES work after scoping because people, systems, locations, risks and existing controls set the work required.

Talk to a consultant

On this page

Cost parts
Audit time
Audit scope
Three-year cycle
EDGE support
ZES quote
Common questions

A man in a dark polo shirt holds an open laptop beside network cabling in an open server rack in an office.

Key takeaways

There are two external bills, plus internal time and security tools.
ZES quotes after scoping, not from a published ISO 27001 price.
The certification body sets audit time under ISO/IEC 27006-1:2024, not MD 5.
EDGE can support up to 50% of eligible SME first-year costs, if approved. Software, GST and later audits are not supported.

The cost has separate parts

There is no honest single ISO 27001 price before the certificate scope is known. ZES does not publish an ISO 27001 price. The ZES fee is quoted after a free 15-minute EDGE pre-check and a short call or site visit. It depends on headcount, systems, locations, risks and existing controls. The certification body quotes its audit fee separately.

The ISO 27001 certification service sets out the ISMS work we prepare with your team. Our written quote keeps ZES work and the certification body's audit fees on separate lines. This matters because an EDGE application needs both quotations.

The cost parts to budget for
Cost	Paid to	What sets it	EDGE support for an SME
ZES consultancy, scope, risk work, ISMS documents, Statement of Applicability, internal audit and management review support, Stage 1 and Stage 2 preparation	ZES	Scope, systems, locations, risks, existing controls	Supported, up to 50%
Certification body Stage 1 and Stage 2 audit	Accredited certification body	Audit time under ISO/IEC 27006-1:2024	Supported, up to 50%, first year only
Surveillance audits in years 2 and 3 and recertification	Certification body	Audit time for each visit	Not supported
Security tools and software	Your IT provider or vendors	Your risk decisions	Software not supported
Your team's time	Internal	People in scope, records in use	Staff time, not a fee

Both quotations are needed for EDGE. Figures depend on scope.

The general ISO certification cost guide publishes ranges for ISO 9001, ISO 14001 and ISO 45001. Those ranges are not ISO 27001 figures, so this guide does not reuse them.

For the free 15-minute EDGE pre-check, send the customer requirement or security questionnaire, systems and locations in scope, approximate headcount and target date. We reply within one working day, then use a short call or site visit to confirm what belongs in each quotation.

The certification body fee follows ISO/IEC 27006-1:2024

The accredited certification body sets ISO 27001 audit time under ISO/IEC 27006-1:2024 Annex C. IAF MD 5 does not apply to ISO 27001. Its audit basis records the people working in the ISMS scope, the complexity of the ISMS and business, sites, remote activity and scope extensions.

A square-root reduction can apply only to people doing a simple, identical, low-impact activity. It is applied to each category of personnel, not to the full headcount. The certification body must document and justify its criteria and still allow enough time for an effective audit.

The 2024 edition changed the audit time rules, including multiple sites under clause C.6 and scope extensions. Certification bodies had to move to it by 31 March 2026.

The quotation records the audit basis

The certificate scope and the systems, services and locations it covers.
The number of persons used for audit planning and the basis for that number.
The Stage 1 and Stage 2 audit, surveillance visits and recertification visit.
Whether work is remote, which sites are covered and any scope extension.
Accreditation by SAC, or by an internationally recognised accreditation body listed in the ILAC MRA, IAF MRA or APAC MRA, for EDGE eligibility.

Our guide to what happens during an ISO audit explains the two stages. Stage 1 reviews the ISMS. Stage 2 audits how the system is used. Get the certification body quotation before you apply for EDGE, because the application needs its quotation beside ours.

Send the customer requirement or questionnaire, proposed systems and locations, approximate headcount and target date. We reply within one working day. A short call or site visit then confirms the scope wording, audit basis and separate quotation lines.

The audit scope drives the work

Audit planning starts with the certificate scope, not a standard list of controls. ISO/IEC 27001:2022 has 146 requirements in clauses 4 to 10 and 93 Annex A reference controls, using the CSA cross-mapping counts. Annex A controls are considered in the context of your business. They are not all mandatory.

The ISO 27001 requirements and controlsISO/IEC 27001:2022, counts from CSA's 2025 cross-mapping

Requirements in clauses 4 to 10146

Annex A reference controls93

Source: Cyber Security Agency of Singapore, cross-mapping, 15 April 2025; Annex A controls are a reference, applied where relevant, recorded in the Statement of Applicability.

The ISO 27001 requirement counts
Part of the standard	Count
Requirements in clauses 4 to 10	146
Annex A reference controls	93

The Statement of Applicability records which Annex A controls apply, which do not, and the reason for each decision. The certificate scope states the services, systems and locations covered. It must cover what the enterprise customer asked for.

In the scope review, we map the customer requirement or security questionnaire against the proposed services, systems and locations. Each item requested by the customer must be traceable to ISMS evidence. We record whether policies, access lists, supplier arrangements and security procedures already exist. We also record the risk and control owners, and when records can be in normal use before Stage 1. A gap assessment for ISO certification establishes that scope.

The certificate has a three-year cycle

An ISO certificate runs on a three-year cycle. The certification body carries out surveillance audits in years 2 and 3. Recertification takes place before the certificate expires.

Surveillance and renewal audits after the first-year certification are not supported under EDGE. Include them in the budget view from the start. Their audit time is set for each visit by the certification body.

Between visits, the ISMS needs risk-review records, an internal audit, management review and evidence that the agreed procedures are in normal use. Security tools, cloud settings, firewalls and endpoint tools are your IT work or your IT provider's work. We record the risk decisions, Statement of Applicability and evidence. Software costs are not supported under EDGE.

The ISO 27001 service page sets out how we prepare the ISMS and your team for the independent certification body's audit. ZES does not certify.

EDGE can support first-year eligible costs

ISO/IEC 27001 is an EDGE Standards activity. Support is up to 50% for SMEs and up to 30% for non-SMEs, if approved. Supported costs are professional service fees and first-year certification by a body accredited by SAC or by an internationally recognised accreditation body listed in the ILAC MRA, IAF MRA or APAC MRA.

EDGE support levels for ISO 27001Of supported costs, if approved

SMENon-SME

Source: Enterprise Singapore EDGE ISO/IEC 27001 page

For an eligible SME, EDGE support can be up to half of supported first-year costs. The company pays at least the remaining half.

Eligible SME first-year cost splitOf supported first-year costs, eligible SME, if approved

50%EDGE maximum

EDGE support50%
Company share50%

Source: Enterprise Singapore; GST, software and audits after the first year are outside this split

Apply before work starts and before any payment or deposit. Enterprise Singapore assesses every application. Support counts towards the S$100,000 annual cap. It is paid as a reimbursement after the project is completed and fully paid. The project must be completed within 12 months of approval. ZES, through Nachi's PSCMC (SS 680:2021, TÜV SÜD), meets the EDGE vendor requirement. The EDGE grant guide explains the wider programme.

Before you apply, send the customer requirement or questionnaire, systems and locations in scope, approximate headcount and target date. We reply within one working day. The 15-minute EDGE pre-check identifies the two quotations required for the application, then a short call or site visit confirms the written scope.

The ZES quote records the ISMS work in scope

The written ZES scope identifies the ISMS items for your certificate scope. It lists the scope statement, policy, objectives and roles, then the risk method, risk register and treatment plan. It also sets out the Statement of Applicability, scope procedures, incident records, document control, awareness records, internal audit, management review and audit preparation file.

Nachi completed the ISO/IEC 27001:2022 Lead Auditor course (Exemplar Global-certified, 2026). She holds a Diploma in Business Information Technology and spent three years at a global cloud accounting software (SaaS) company. Nachi has experience since 2014. One consultant. From start to finish. The consultant stays with the project from the scope statement through the audit preparation file.

Send the customer's ISO 27001 requirement or security questionnaire, business activity, systems and locations in scope, approximate headcount and target date. We use it to check that the proposed certificate scope covers the stated requirement. We then review which policies, access lists, supplier arrangements and security procedures are already in place, who owns the risks and controls, and when records can be in normal use before Stage 1. For a typical SME, plan around 3 to 6 months from gap analysis to the certification audit. Our ISO certification timeline guide explains how these records and the Stage 1 and Stage 2 dates affect timing.

We reply within one working day and start with the free 15-minute EDGE pre-check. We then arrange a short call or site visit. The written quote separates ZES work from the certification body's audit fees. It lists the scope, ISMS work, documents and people your team needs to provide, and the project timeline.

Common questions

How much does ISO 27001 certification cost in Singapore?

There are separate costs for ZES consultancy and the accredited certification body's audit, plus your internal time and any security tools. We quote after the free 15-minute EDGE pre-check and a short call or site visit because the scope sets the work required.

Why does ZES not publish an ISO 27001 price?

Headcount, systems, locations, risks and existing controls vary between businesses. The certification body also sets its audit fee separately using its audit time assessment.

How many audit days does ISO 27001 need?

The certification body sets audit time under ISO/IEC 27006-1:2024 Annex C. It considers the people within scope, the complexity of the ISMS and business, sites, remote activity and any scope extension.

Does EDGE cover ISO 27001?

ISO/IEC 27001 is an EDGE Standards activity. It can support up to 50% for SMEs and up to 30% for non-SMEs for eligible first-year costs, if Enterprise Singapore approves the application.

Does EDGE pay for security software?

No. Software costs are not supported under EDGE, so include security tools and software in your own project budget.

Are surveillance audits covered by EDGE?

No. Certification and testing costs for surveillance and renewal after first-year certification are not supported. Plan for the audits in years 2 and 3 and recertification before the certificate expires.

Sources

About the author

Nachi Leong

Principal Consultant, ZES Consulting · PSCMC, TÜV SÜD

One consultant. From start to finish. The consultant you meet is the consultant who stays with your project.

About Nachi

ISO 27001 certification cost in Singapore: what sets the price