Skip to main content
010 447 2445Contact
Arke Technologies home
Request a hardware quoteTalk to us
Arke Technologies home
An operations analyst in a headset works across several monitors in a busy operations room.

ISO 27001 certification price, time and steps in South Africa

Last reviewed: September 2026

The ISO 27001 certification price in South Africa has four parts: an accredited certification body's audit fees, set by the people in scope and the complexity; building the information security management system (ISMS); closing security gaps; and training. Arke Technologies, in Johannesburg, prepares organisations and public bodies for certification.

Request a security assessmentSee ISO 27001 readiness
Insights

ISO 27001 certification price, time and steps in South Africa

Last reviewed: September 2026, 15 min read

The ISO 27001 certification price in South Africa has four parts: an accredited certification body's audit fees, set by the people in scope and the complexity; building the information security management system (ISMS); closing security gaps; and training. Arke Technologies, in Johannesburg, prepares organisations and public bodies for certification.

Last reviewed: September 2026, 15 min read

On this page

What is ISO 27001? Meaning and purpose

ISO/IEC 27001 is the international standard for an information security management system (ISMS): the policies, risk assessments, controls and reviews through which an organisation manages the security of its information. The current edition, ISO/IEC 27001:2022, is titled Information security, cybersecurity and privacy protection — Information security management systems — Requirements, and ISO and the IEC publish it jointly.

What is ISO 27001 intended to ensure? That the confidentiality, integrity and availability of your information are protected in proportion to the risks, and that the protection keeps improving. The ISO 27001 meaning in practice is a management discipline, not a product: leadership sets objectives, the organisation assesses its risks, chooses controls, measures whether they work and fixes what does not.

What is ISO 27001 compliance, then? Working to the standard's requirements, which any organisation can claim. Certification means an accredited certification body has audited the ISMS and issued a certificate, and that certificate is the evidence tenders, enterprise customers and cyber insurers ask for.

The standard descends from BS 7799, a British Standard first published by BSI in 1995, whose requirements part became ISO/IEC 27001 in 2005. It was revised in 2013 and 2022, and a 2024 amendment added a requirement to consider whether climate change is relevant to the ISMS. You will see it written as ISO/IEC 27001, ISO IEC 27001, ISOIEC 27001, ISO27001, ISO standard 27001 or simply 27001; common mistypings such as 1so 27001, ISO 270001 and ISO 2700 usually mean the same standard.

An analyst in a headset watches monitoring dashboards across two screens in a daylight office.

The ISO 27000 family: 27001, 27002, 27003 and more

ISO 27001 belongs to a family of ISO security standards, often called the ISO 27000 series. ISO/IEC 27001 is the one an ISMS is certified against, so there is no ISO 27000 certification; the other ISO 27000 standards below define terms and give guidance.

StandardWhat it coversCan you certify to it?
ISO/IEC 27000Overview and vocabulary for the whole familyNo
ISO/IEC 27001Requirements for an ISMS, including the Annex A controlsYes
ISO/IEC 27002Guidance on implementing each controlNo
ISO/IEC 27003Guidance on establishing and running an ISMSNo
ISO/IEC 27005Information security risk managementNo
ISO/IEC 27035Information security incident managementNo

In practice the ISO IEC 27001 standard and ISO/IEC 27002 do most of the work: 27001 says what the ISMS must achieve, and 27002 explains how each control can be implemented. When a tender asks for ISO security certification, or refers to ISO data security, IT security or cyber security standards, it almost always means ISO/IEC 27001 certification.

ISO 27001 requirements: clauses 4 to 10

The ISO 27001 requirements sit in clauses 4 to 10, which share their structure with ISO 9001 and the other ISO management system standards:

  1. Context (clause 4)

    The internal and external issues, interested parties and legal duties that shape your ISMS, and its scope.

  2. Leadership (clause 5)

    Top management's commitment, the information security policy, and assigned roles and responsibilities.

  3. Planning (clause 6)

    The risk assessment and risk treatment process, the Statement of Applicability and measurable security objectives.

  4. Support (clause 7)

    Resources, competence, awareness, communication and documented information.

  5. Operation (clause 8)

    Carrying out the risk assessments and the risk treatment plan.

  6. Performance evaluation (clause 9)

    Monitoring and measurement, internal audit and management review.

  7. Improvement (clause 10)

    Continual improvement, nonconformities and corrective action.

Every clause is mandatory for certification. The Annex A controls are not all mandatory: you select them through your risk assessment and record each decision, with its justification, in the Statement of Applicability.

ISO 27001 controls: the 2022 Annex A list

Annex A of ISO/IEC 27001:2022 lists 93 controls in four themes. The standard spells the first theme "organizational controls"; in British English, organisational controls.

ThemeNumber of controlsExamples
Organisational controls (5.1 to 5.37)37Policies, asset inventory, access control, supplier security, incident management, business continuity
People controls (6.1 to 6.8)8Screening, terms of employment, awareness and training, remote working
Physical controls (7.1 to 7.14)14Secure areas, physical entry, equipment protection, secure disposal
Technological controls (8.1 to 8.34)34Endpoint devices, privileged access, malware protection, vulnerability management, logging, backup, secure development

The ISO 27001 2022 controls include 11 new ones: threat intelligence, information security for cloud services, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering and secure coding. These new ISO 27001 controls cover cloud services, data protection and threat awareness, areas the 2013 list did not address directly.

The ISO 27001 2013 controls were arranged as 114 controls in 14 domains, A.5 to A.18. The 2022 edition merged and updated them, so an ISMS built on the 2013 list maps across, and since the transition period ended on 31 October 2025 every valid certificate is to ISO/IEC 27001:2022.

ISO incident management (controls 5.24 to 5.28) covers planning, assessing events, responding, learning from each incident and collecting evidence, and lines up with POPIA's duty to report security compromises. ISO physical security (controls 7.1 to 7.14) covers perimeters, entry, offices, monitoring, equipment and disposal. The ISO 27001 technical controls in the technological theme are where most IT effort goes, and ISO/IEC 27002 gives the full ISO 27001 security controls list with guidance on each.

The ISO 27001 certification process, step by step

The ISO 27001 certification process has ten steps. The first seven are yours, with whatever help you choose; the last three belong to the certification body.

  1. Scope and commitment

    Decide what the ISMS covers, whether the whole organisation or defined sites, services or systems, and secure leadership's commitment and budget.

  2. Gap analysis

    Compare current practice with the clauses and the Annex A controls, and rank the gaps.

  3. Risk assessment and treatment

    Identify the risks to your information, decide how to treat each one and produce the Statement of Applicability.

  4. Policies and controls

    Write the required policies and implement the controls the treatment plan calls for.

  5. Awareness and competence

    Make sure staff know their responsibilities and the people running the ISMS are competent to do so.

  6. Operate and measure

    Run the ISMS long enough to produce records: incidents handled, access reviewed, backups restored in a test, objectives measured.

  7. Internal audit and management review

    An objective, impartial internal audit (clause 9.2), then a management review (clause 9.3) that acts on its findings.

  8. Stage 1 audit

    The certification body reviews your documentation and readiness.

  9. Stage 2 audit

    The certification body tests whether the ISMS works in practice, through interviews, records and observation.

  10. Certification and surveillance

    A certificate valid for three years, with a surveillance audit in each of the two years after certification and a recertification audit before it expires.

How long does it take? Most of the time goes into steps 3 to 6, and it depends on where you start: an organisation with multi-factor authentication, managed devices, tested backups and written policies moves much faster than one starting from scratch. We agree a realistic timeline with you at the gap analysis.

ISO 27001 certification price: what it costs and what drives it

Last reviewed: September 2026.

There is no single ISO 27001 price. The total has four cost lines, and only one is paid to the certification body.

Cost lineWhat it coversWhat drives it
Certification body auditsStage 1 and stage 2, then annual surveillance audits and recertificationAudit days, which follow the people in scope, the number of sites and complexity
ISMS implementationGap analysis, risk assessment, policies, Statement of Applicability, internal auditScope, starting maturity and how much you do in-house
Security controlsMulti-factor authentication, device management, logging, backups, penetration testingThe gaps the risk assessment finds, and the licences you already own
TrainingStaff awareness, internal auditor, lead implementer and lead auditor coursesHeadcount, and who will run and audit the ISMS

The ISO 27001 cost of the audits depends on audit time. Certification bodies calculate audit days from the number of people within the ISMS scope and the organisation's complexity, following the accreditation rules in ISO/IEC 27006, so a 50-person firm on one site pays far less than a 2,000-person organisation across several provinces.

Buyers often ask about the ISO 27001 accreditation cost, but strictly, organisations are certified and certification bodies are accredited, in South Africa by SANAS (the South African National Accreditation System) or by another member of the International Accreditation Forum (IAF). Check that a certification body's accreditation covers ISO/IEC 27001 before you pay for an audit; an unaccredited certificate carries little weight with a tender panel.

The largest variable is usually internal: your own people's time. Controls already included in your Microsoft 365 or Google Workspace licences need no new licence, only the time to configure them, which is why the gap analysis comes first. Training adds a cost per delegate, with the ISO 27001 lead implementer price and lead auditor fees the highest. We quote readiness work per project after the gap analysis.

ISO 27001 lead auditor, lead implementer and internal auditor certification

Organisations earn ISO/IEC 27001 certification; people earn course certificates that show their competence.

QualificationWho it suitsWhat it covers
FoundationAnyone working in or with the ISMSTerms, structure and the Annex A controls
Internal auditorStaff who will run internal audits under clause 9.2Planning, running and reporting internal audits
Lead implementerThe person who builds and runs the ISMSScope, risk assessment, controls, documentation and readiness for certification
Lead auditorPeople who lead audits, including auditors at certification bodiesAudit principles and leading stage 1, stage 2 and surveillance audits

An ISO 27001 lead auditor certification usually follows a five-day course and exam; choose a course on the 2022 edition, because an ISO 27001 2022 lead auditor certification reflects the controls auditors now test. Leading audits for a certification body also takes supervised audit experience. An ISO 27001 certified auditor on your own staff is useful but not required: the standard asks only that internal auditors are objective and impartial, which in a smaller organisation often means an outside ISO 27001 internal auditor. When comparing ISO 27001 ISMS lead auditor courses, check the edition, the exam and who certifies the course.

ISO 27001 alongside NIST, ISO 9001 and POPIA

NIST and ISO frameworks work well together. The NIST Cybersecurity Framework is voluntary and has no certification; it describes outcomes in six functions (govern, identify, protect, detect, respond and recover) and suits board reporting. Many organisations report to the board in NIST terms, certify to ISO/IEC 27001 and use the CIS Controls as a prioritised list of technical safeguards.

ISO 9001 and 27001 share the same clause structure, so an organisation certified for quality can extend its document control, internal audit and management review to information security, and certification bodies commonly audit the two together. Our team built ISOcore, a platform for ISO 9001, 14001 and 45001 documentation, corrective actions and audit scheduling, so we understand how an integrated management system works in practice.

ISO 27001 also supports POPIA. Section 19 requires reasonable technical and organisational measures to secure personal information, with due regard to generally accepted information security practices, and an ISMS certified to ISO/IEC 27001 is strong evidence of exactly that. It does not make an organisation POPIA-compliant on its own, because the Act's other conditions still apply; see our POPIA compliance checklist. For boards, an ISMS provides evidence of the data, information and technology governance that King V Principle 10 asks of them, and public bodies can use it to support PFMA or MFMA risk management and audit.

ISO 27001 audit checklists: stage 1 and internal audit

Use these two checklists before you book the certification body.

ISO 27001 stage 1 audit checklist: the documented information auditors expect to see

  • The ISMS scope (clause 4.3) and the information security policy (clause 5.2).
  • The risk assessment and risk treatment process, with the results (clauses 6.1.2, 6.1.3, 8.2 and 8.3).
  • The Statement of Applicability, with justified inclusions and exclusions.
  • Information security objectives and how they are measured (clauses 6.2 and 9.1).
  • Evidence of competence and awareness (clauses 7.2 and 7.3).
  • Operating procedures for the controls you selected.
  • The internal audit programme and its results (clause 9.2).
  • Management review minutes and decisions (clause 9.3).
  • Nonconformities and corrective actions (clause 10.2).

ISO 27001 internal audit checklist: what an internal auditor tests

  • Do records show that the controls in the Statement of Applicability actually operate?
  • Were access reviews, leaver processes and privileged accounts handled as the policies say?
  • Were incidents logged, assessed, closed and learned from?
  • Were backups restored in a test, and patches applied within the agreed period?
  • Do suppliers with access to your information meet your security requirements?
  • Are last year's findings closed?

Treat the internal audit as a rehearsal for the ISO 27001 audit itself, and run it the way the certification body will.

How we prepare organisations for ISO 27001

Arke Technologies is not itself certified to ISO/IEC 27001 and does not issue certificates; only an accredited certification body can. Our role is readiness: we work to ISO/IEC 27001 and help you reach stage 2 with an ISMS that works in practice, not only on paper.

  • Gap analysis against the clauses and Annex A, with a ranked plan and a budget your board can approve.
  • Risk assessment support, the Statement of Applicability and the policies that go with it.
  • Technical controls: Microsoft 365 hardening, Entra ID governance and Microsoft Sentinel logging, as our team delivers in managed security operations, plus device management and backup and recovery.
  • Testing: penetration tests we scope, perform and retest, as evidence for controls 8.8 and 8.29; see our guide to penetration testing cost.
  • Operating evidence: under a managed agreement, monitoring checks each managed computer every 15 minutes, faults become tickets automatically, and a monthly service review and report adds to the monitoring and measurement records clause 9 asks for.

Arke Technologies is a Level 1 B-BBEE contributor (sworn affidavit available on request); company documents, our CSD number and tax compliance status are available on request. The ISMS, its records and every credential stay yours. More detail is on our ISO 27001 readiness page and in our cybersecurity services; for the basics, read what cyber security is, one of our insights and guides.

Related services

Related guides

Related work

Get our guides by email

Plain, sourced guides for the people who decide on and buy technology, sent to your inbox.

Topics (optional)

Leave these clear to receive everything.

By signing up, you agree that Arke Technologies (Pty) Ltd may email you guides and updates. Every email includes an unsubscribe link. Read our privacy notice.

Frequently asked questions

How much does it cost to get ISO 27001 certified? Show answer

The cost of getting ISO 27001 certified is the sum of four lines: certification body audits, ISMS implementation, security controls and training. Audit fees follow audit days, which depend on the people in scope and the organisation's complexity, while implementation costs depend on your starting point. A gap analysis turns those variables into a reliable budget.

How long does it take to become ISO 27001 certified? Show answer

Becoming ISO 27001 certified takes months rather than weeks, because the certification body needs to see an ISMS that has operated, with an internal audit and a management review completed, before the stage 2 audit. Organisations that already have strong controls and written policies move fastest, and a gap analysis sets a realistic target date.

How do you become ISO 27001 certified? Show answer

You become ISO 27001 certified by building an ISMS that meets the standard and passing a two-stage audit by an accredited certification body. Define the scope, run a gap analysis and risk assessment, implement controls, operate the system, complete an internal audit and management review, then book stage 1 and stage 2. The certificate lasts three years.

Is ISO 27001 certification mandatory in South Africa? Show answer

No, ISO 27001 certification is voluntary in South Africa; no law requires it. The demand comes from tenders, enterprise customers and cyber insurers, which often ask for it. POPIA section 19 requires reasonable security measures with due regard to generally accepted information security practices, and an ISMS certified to ISO/IEC 27001 is strong evidence that you meet that duty.

What is the difference between ISO 27001 and ISO 27002? Show answer

ISO 27001 sets the requirements an ISMS must meet and is the standard you are certified against, while ISO 27002 gives guidance on implementing each security control. Annex A of ISO 27001 lists the 93 controls briefly; ISO 27002 explains the purpose of each and how to apply it. Organisations are certified against ISO 27001, never against ISO 27002.

How much does an ISO 27001 course cost? Show answer

An ISO 27001 course costs more as the level rises: foundation courses are the shortest and cheapest, internal auditor courses sit in the middle, and lead implementer or lead auditor courses, usually five days with an exam, cost the most. Fees also vary with format, online or classroom, and with whether the exam fee is included.

Can an organisation be certified to ISO 27000? Show answer

No, there is no ISO 27000 certification: ISO/IEC 27000 is the overview and vocabulary for the family of standards. Organisations are certified against ISO/IEC 27001, the requirements standard, so a search for ISO 27000 certification leads to the same place: an ISMS audited against ISO/IEC 27001 by an accredited certification body.

Start with a gap analysis

We compare your organisation with ISO/IEC 27001, rank the gaps and give you a plan and a budget your board can approve. Call 010 447 2445 or talk to us.

Request a security assessment