Pricing an ISO 27001 engagement
A first ISMS build for a 30-person Canadian company is 25 to 45 consultant days. What decides whether that is a profitable fixed fee or a loss is not the estimate. It is the four sentences in the statement of work about scope, evidence and rework.
Price the build in days by phase, quote a fixed fee for the phases you control, and put the phases you do not control on time and materials with a named cap. The phase that ruins fixed-fee ISO 27001 engagements is always the same one: collecting evidence out of a client who is slower than they promised. Everything below is about pricing that risk rather than absorbing it.
These are Canadian dollar figures for Canadian practices. They are bands built from what the work takes, not a survey, and the buyer-side view of the same numbers is on ISO 27001 cost in Canada, which is worth reading because your prospects have read it. Where the clients come from in the first place is a separate problem.
What the work actually takes, by phase
| Phase | Under 25 staff | 25 to 100 | 100 to 300 | Who controls the pace |
|---|---|---|---|---|
| Scoping and gap assessment | 3 to 5 | 5 to 8 | 8 to 12 | You |
| Risk method, assessment and treatment plan | 4 to 6 | 6 to 9 | 9 to 14 | Shared |
| Statement of Applicability | 2 to 3 | 3 to 4 | 4 to 6 | You |
| Policy and documented information set | 5 to 8 | 7 to 11 | 10 to 16 | You, if you bring templates |
| Control implementation support | 6 to 12 | 10 to 20 | 18 to 40 | The client, entirely |
| Internal audit | 2 to 4 | 4 to 6 | 6 to 10 | You |
| Management review and stage 1 preparation | 2 to 3 | 3 to 4 | 4 to 6 | Shared |
| Audit attendance and finding closure | 2 to 4 | 3 to 6 | 5 to 9 | The certification body |
| Total days | 26 to 45 | 41 to 68 | 64 to 113 |
Read the fourth column before the numbers. Three of the eight phases are not paced by you, and one of them, control implementation support, is both the largest and the least controllable. That is the phase to carve out of any fixed fee.
Day rates, and what moves them
| Who | Day rate (CAD) | When a client pays it |
|---|---|---|
| Solo consultant, first two years | $900 to $1,400 | Referral work and price-led buyers |
| Established solo or small practice | $1,400 to $2,000 | Most of the market |
| Boutique with delivery bench | $1,800 to $2,400 | When the client needs two workstreams at once |
| National consultancy or Big Four adjacent | $2,400 to $4,000 | Procurement requires a firm of a certain size |
| Certification body, for comparison | $2,000 to $3,200 | Not a choice. It is the audit |
Two things move a rate and neither is experience in the abstract. The first is whether you have taken a client through a stage 2 audit with the same certification body the prospect is considering, which converts an estimate into a known quantity. The second is whether the buyer has a date. A company that needs a certificate before a contract renewal is not price sensitive in the way the same company was three months earlier.
Fixed fee or time and materials?
Fixed fee wins the work. Almost every buyer prefers it, because they are budgeting against a certificate rather than against your hours, and a firm that will not quote one looks like it does not know what the job takes. The mistake is quoting fixed for the whole engagement.
| Phase | Basis | Why |
|---|---|---|
| Gap assessment | Fixed, small, sold separately | It is also your qualification step. Sell it standalone and price the build afterwards from what you found |
| Risk, Statement of Applicability, documentation | Fixed | You control the effort and you have done it before |
| Control implementation support | Time and materials, with a cap and a named allowance of days | The client's engineering capacity decides this, and you cannot underwrite somebody else's backlog |
| Internal audit | Fixed, annual, sold as its own engagement | It recurs, and separating it makes the recurrence obvious to both sides |
| Audit attendance and finding closure | Fixed allowance, then daily | Findings are the certification body's decision, not yours |
Never quote a build before a gap assessment
A fixed fee quoted from a discovery call is priced against what the client believes their position is, and that belief is wrong in a predictable direction. Selling a paid gap assessment first solves three problems at once: it is revenue, it qualifies the client's seriousness, and it converts your build quote from a guess into an estimate you can defend line by line. Firms that skip it lose money on roughly one engagement in four.
The four sentences that decide whether you make money
Overrun on these engagements almost never comes from underestimating the work. It comes from the work changing without the fee changing. Four terms in the statement of work stop most of it.
- The scope statement is fixed at signature, and a change to it is a change order. Name the entities, locations, services and systems in the contract itself. A client who adds a second product to the certificate scope in month four has bought a different engagement, and the scope statement drives every other number including the certification body's day count.
- Evidence collection is the client's obligation, with a named owner and a response time. Five business days is normal. Without this, the engagement stretches and your utilisation collapses while the fee stays fixed.
- Rework caused by a change of direction by the client is chargeable. Rewriting the risk method because the new CTO prefers a different scale is not defect correction.
- Certification body findings are covered for a named number of days, and beyond that at day rate. You do not control the auditor. A firm that promises unlimited remediation has written a blank cheque against a third party's judgement.
Add a fifth if the client is running a compliance platform you did not choose: state which platform, because migrating evidence between them mid-engagement is a week you did not price.
Packaging, and what to sell after the certificate
The engagement most firms sell ends the day the certificate arrives, which means every January starts at zero. The management system has mandatory annual work in it that the client cannot do alone at small scale, and selling that from the start changes the shape of the practice.
| Offer | Price band (CAD) | Recurs | What the client is buying |
|---|---|---|---|
| Gap assessment | $6,000 to $18,000 | No | A defensible plan and a real number |
| ISMS build to certificate | $25,000 to $70,000 | No | The certificate, on a date |
| Annual upkeep: internal audit, management review facilitation, risk refresh, surveillance preparation | $8,000 to $25,000 | Yes, every year | Not losing the certificate |
| Three-year value of one 30-person client | $55,000 to $120,000 | Against $25,000 to $70,000 for the build alone |
The upkeep line is the one to sell hardest and the one clients resist least, because a surveillance audit arrives whether they prepared for it or not and the internal audit has to be run by someone who did not build the system. That independence requirement is written into clause 9.2, so at small scale the client is buying it from somebody. It should be you, and the fact that you built the system does not prevent it as long as the auditor you assign did not.
Pricing mistakes that show up in year two
- Pricing by headcount alone. Audit day tables start from persons in scope, so consultants copy the shape. Two 40-person companies with different scopes are different engagements by a factor of two.
- Discounting the gap assessment to win the build. It trains the client to treat the first deliverable as free and it removes the only paid qualification step you had.
- Quoting against the certification body's number. Clients anchor on the audit fee because it is the one they can compare. Your work is usually two to three times it, and explaining why in day counts is more persuasive than discounting.
- Absorbing platform administration. Configuring somebody's compliance platform and chasing its automated evidence tasks is real work that nobody quoted, and it lands on the phase you fixed.
- No termination clause tied to client inactivity. Engagements that stall for a quarter still consume account management. Name a pause fee or a right to close the file.
Get in front of buyers who already have a date
The companies asking here have usually been given a deadline by a customer or a tender. Listing your firm puts your pricing in front of them.
List your firmCommon questions
What should I charge for an ISO 27001 gap assessment?
$6,000 to $18,000 CAD depending on size and scope, delivered in three to eight days. Price it as a standalone engagement with its own deliverable rather than as a free discovery call, because the deliverable is what the client uses to get budget approved internally. Firms that give it away lose both the fee and the qualification.
Should I publish my prices?
Publish bands and the arithmetic behind them. The buyer's first search is what it costs, almost nobody answers with a number, and a firm that does ranks against firms that do not. The objection that every engagement is different is true and is exactly why a band with the drivers named beats silence: it filters out the buyers you cannot serve before they book a call.
Can I run my client's internal audit if I built the ISMS?
Yes, with care. Clause 9.2 requires objectivity and impartiality, and the usual reading is that the auditor must not audit their own work. A firm with more than one consultant can assign someone who did not build the system and document that separation. A solo consultant who built the ISMS should not audit it, and the honest move is to subcontract that piece to a peer and take the same work back from them.
How do I compete with a compliance platform bundling readiness?
Not on price. Platforms bundle a generic control set and a light advisory layer, and they are genuinely good value for a small cloud company with a simple scope. Where they break is scope decisions, the risk method and the justification column of the Statement of Applicability, all of which need a human who has sat in a stage 2. Sell against the specific failure rather than against the category.
Is time and materials ever the right basis for the whole job?
For a client with no internal capacity and a moving scope, yes, and you should expect to lose most competitive bids run that way. The workable middle is a fixed fee for the phases you control with an explicit day allowance for the ones you do not, which reads as a fixed price to a buyer and prices your actual risk.