ISO 27001 certification typically costs a Singapore SME S$15,000 to S$60,000 in year one. The certification audit itself runs S$8,000 to S$20,000, and the remainder is split between consultants or software and internal staff time. Certification runs on a three-year cycle with annual surveillance audits, so budget recurring costs of roughly a third of year one.
What does the certification audit cost?
The certification audit typically costs a Singapore SME S$8,000 to S$20,000, and it comes in two parts. A stage 1 audit reviews your documentation and readiness. A stage 2 audit then tests whether your information security management system (ISMS) actually operates the way the documents claim. Both stages are priced into that range.
Certification bodies price in auditor-days. More staff means more days. So does a second office, and so does an ambitious scope statement. A 20-person software company certifying one office sits near the bottom of the range; a firm with several sites and a data centre in scope sits near the top. Get two or three quotes, because rate cards differ more than you would expect for identical scope.
One decision matters more than price. Choose a certification body accredited by the Singapore Accreditation Council (SAC). An unaccredited certificate is cheaper and worth close to nothing, because tender evaluators and procurement teams check the accreditation, and a certificate nobody recognises fails at exactly the moment you need it to work. The SAC register is public. Checking a certification body against it takes about a minute.
Consultant, platform, or both?
You have three ways to build the ISMS the audit will test. Hire a consultant to build it with you. Buy a compliance platform and do the work yourself. Or run a platform with a few consultant days bolted on. As typical ranges, consultant-led projects run S$20,000 to S$40,000 in fees, platforms run S$7,000 to S$15,000 a year, and hybrids land in between.
A consultant earns the fee by doing the heavy lifting: gap assessment, risk assessment, policy and control documentation, and usually your first internal audit. You move faster and burn fewer internal hours. The trade is that the knowledge can walk out the door when the engagement ends.
A platform is the cheaper cash outlay, but it is tooling, not labour. It structures the control set and keeps the evidence and the risk register in one place, while your team still does the thinking. The hybrid path is common for a reason. The platform handles day-to-day structure, and a consultant takes the two jobs that benefit most from an outside eye, the risk assessment and the internal audit.
Treat every figure here as a typical range, not a quote. A number well outside these bands deserves questions about scope before you sign anything.
What internal time should you budget?
Budget 300 to 500 internal hours in year one for a typical SME, concentrated in whoever owns the ISMS. This is the line most budgets miss, and hiring a consultant does not delete it. Someone inside still has to make the decisions and produce the evidence.
By role, the split usually looks like this. The ISMS owner or project lead carries 150 to 250 hours. IT and engineering spend 60 to 100 hours implementing controls and pulling evidence. Leadership gives 20 to 40 hours across risk workshops, policy sign-off and the management review, and every employee sits through an hour or two of security awareness training.
A worked example. A 30-person firm might log 200 hours for the lead, 80 for engineering, 30 for leadership and 45 across staff training. Call it 355 hours. At a fully loaded cost of S$60 an hour, that is about S$21,000 of salary redirected into the project. No invoice ever arrives for it, which is why a do-it-yourself certification is rarely as cheap as the cash figure suggests.
Putting the numbers together, a year-one budget breaks down like this:
| # | Cost item | Typical year-one range | Notes |
|---|---|---|---|
| 1 | Certification audit (stage 1 + stage 2) | S$8,000 to S$20,000 | SAC-accredited body; scales with headcount, sites and scope |
| 2 | Consultant fees (consultant-led path) | S$20,000 to S$40,000 | Covers gap and risk assessment, documentation, internal audit |
| 3 | Compliance platform (software-led path) | S$7,000 to S$15,000 | Annual subscription; your team does the build |
| 4 | Internal staff time | S$10,000 to S$25,000 equivalent | 300 to 500 hours across roles; a real cost with no invoice |
| 5 | Year-one total (typical SME) | S$15,000 to S$60,000 | Row 2 or row 3, not both at full weight |
What are the recurring costs?
Certification is not a one-off purchase. The certificate runs on a three-year cycle: a surveillance audit in each of years two and three, then a full recertification audit at the end of year three. Budget roughly a third of your year-one spend as the annual recurring cost.
Surveillance audits are shorter and cheaper than the initial audit because they sample the ISMS rather than reassess all of it. On top of the audit fee, the platform subscription renews, or you buy a smaller block of consultant days. The maintenance work carries on as well: internal audits, management reviews, risk register updates, corrective actions.
The expensive mistake is letting the ISMS decay between audits. An organisation that reconstructs a year of evidence in the fortnight before surveillance pays twice, once in staff overtime and again in findings that drag into the recertification.
Auditors recognise backfilled evidence when they see it.
Can grants reduce the bill?
Yes. The Enterprise Development Grant (EDG), administered by EnterpriseSG, supports up to 50% of qualifying costs for eligible SMEs, and consultancy-led certification projects are a common use of it. On a S$40,000 consultant-led build, that level of support can bring the cash cost close to what the do-it-yourself route would have cost anyway.
Two practical notes. Apply before the project starts, because grants are not awarded retrospectively. And check what counts as a qualifying cost, since support typically attaches to the consultancy work rather than to every line in your budget. Criteria and support levels change, so confirm the current terms with EnterpriseSG before you build the grant into the plan.
Whichever path you take, the audit mostly examines three things: your control register, your risk register and your evidence. Zavior keeps all three in one place, which is most of what a stage 1 auditor asks to see. For how the standard compares with its most common sibling, see our guide to ISO 27001 versus SOC 2.
Frequently asked questions
How long does certification take?
Most Singapore SMEs take six to twelve months from kickoff to certificate. The audit is the short part. The timeline is set by how long it takes to build the ISMS and let it run, because a stage 2 auditor wants to see a system that has operated, not a binder of freshly written policies.
Is ISO 27001 mandatory in Singapore?
No. No Singapore law makes ISO 27001 compulsory; it is a voluntary standard. The pressure comes from customers instead. Enterprise buyers and government tenders increasingly treat certification as a condition of doing business, which is why most SMEs pursue it.
What is the cheapest legitimate route?
Build the ISMS in-house on a compliance platform, keep the certification scope narrow, and spend the audit budget on an SAC-accredited certification body. That lands around S$15,000 to S$25,000 in cash for year one. Do not economise on the accreditation itself; an unaccredited certificate fails procurement checks and buys you nothing.
Zavior · Cyber Security
Most of your ISO 27001 budget is the internal hours behind the controls, not the audit fee. Zavior takes the security work that eats those hours: vulnerability assessments, phishing simulations, staff training, and an incident response plan that names who acts. For regulated Singapore firms we fold in fintech cyber security and regulatory compliance, so one programme feeds the certificate instead of two.
Book a free 30-minute business assessment →This is general information, not legal advice.