CB Comparison
ISO 27001 Certification Bodies Compared: Fees, Reputation, and How to Choose
Choosing the right certification body can save you 30-50% on audit fees without compromising certificate credibility. Here is a vendor-neutral comparison of 10 major CBs with real pricing data.
What Is a Certification Body?
A certification body (CB) is the independent third-party organisation that conducts your ISO 27001 audit and, if successful, issues your certificate. CBs must be accredited by a national accreditation body to issue recognised certificates.
Key accreditation bodies include UKAS (United Kingdom), ANAB (United States), JAS-ANZ (Australia/New Zealand), DAkkS (Germany), and COFRAC (France). A certificate from a CB accredited by any of these is recognised internationally under the IAF Multilateral Recognition Arrangement (MLA).
This means an NQA certificate (UKAS-accredited, budget pricing) carries the same formal validity as a BSI certificate (UKAS-accredited, premium pricing). The difference is brand recognition, not certificate validity.
Certification Body Fee Comparison
Year 1 total certification cost (Stage 1 + Stage 2 + admin fees) by company size tier. Excludes preparation costs.
| CB | Tier | Accreditation | Small | Medium | Large |
|---|---|---|---|---|---|
| BSI | Premium | UKAS | $12,000 - $22,000 | $25,000 - $50,000 | $45,000 - $85,000 |
| SGS | Mid-tier | SAS, UKAS, ANAB | $8,000 - $18,000 | $18,000 - $40,000 | $35,000 - $70,000 |
| Bureau Veritas | Mid-tier | COFRAC, UKAS, ANAB | $9,000 - $18,000 | $20,000 - $42,000 | $38,000 - $75,000 |
| LRQA | Premium | UKAS | $11,000 - $20,000 | $22,000 - $45,000 | $42,000 - $80,000 |
| Schellman | Premium | ANAB | $10,000 - $20,000 | $22,000 - $45,000 | $40,000 - $75,000 |
| A-LIGN | Mid-tier | ANAB | $10,000 - $18,000 | $20,000 - $40,000 | $38,000 - $70,000 |
| DNV | Mid-tier | Akkreditert (Norway), UKAS | $9,000 - $17,000 | $19,000 - $38,000 | $35,000 - $68,000 |
| TUV SUD | Premium | DAkkS | $10,000 - $19,000 | $22,000 - $42,000 | $40,000 - $78,000 |
| NQA | Budget | UKAS, ANAB | $6,000 - $12,000 | $14,000 - $28,000 | $25,000 - $50,000 |
| Alcumus ISOQAR | Budget | UKAS | $6,000 - $11,000 | $13,000 - $26,000 | $24,000 - $48,000 |
Pricing is indicative based on 2026 market data. Small: 11-50 employees. Medium: 51-250. Large: 251-1,000. Single location, standard complexity.
Certification Body Strengths
BSI
(UK)Most recognised globally. Strong in government, banking, and defence. The BSI kitemark carries weight with enterprise procurement.
SGS
(Switzerland)Global reach with local offices in 140+ countries. Strong in manufacturing, supply chain, and international organisations.
Bureau Veritas
(France)Strong in energy, maritime, and construction. Competitive pricing for medium organisations. Good multi-standard bundling.
LRQA
(UK)Premium brand. Excellent for risk-heavy industries. Strong in oil and gas, critical infrastructure, and financial services.
Schellman
(US)Leading US-based CB for technology companies. Combined ISO 27001 + SOC 2 audits. Fast turnaround for SaaS companies.
A-LIGN
(US)US-focused. Strong in compliance bundling (ISO + SOC 2 + PCI + HITRUST). Popular with mid-market SaaS and fintech.
DNV
(Norway)Strong in energy, maritime, and healthcare. Risk-based approach aligns well with mature organisations.
TUV SUD
(Germany)Premium German engineering reputation. Strong in automotive, manufacturing, and IoT. Recognised in European markets.
NQA
(UK)Cost-effective for SMBs. UKAS-accredited. Same certificate validity as premium CBs. Fast scheduling. Good online portal.
Alcumus ISOQAR
(UK)Budget-friendly UKAS-accredited option. Simple pricing. Popular with UK and EU SMBs. Responsive customer service.
How to Get and Compare Quotes
Request quotes from at least 3 certification bodies. When comparing, ask each CB to provide an itemised breakdown covering these line items:
Also verify the CB's accreditation status directly on the relevant accreditation body website (e.g. ukas.com for UKAS, anab.org for ANAB). Accreditation must be current and cover ISO/IEC 27001 specifically.
Premium vs Budget Certification Bodies
When to choose premium (BSI, LRQA, TUV)
- Selling to government or defence contractors
- Banking and financial services customers
- Customers who specifically ask "Who is your CB?"
- Enterprise procurement processes that weight CB brand
- Industries where regulatory scrutiny is high
When budget works fine (NQA, Alcumus)
- SaaS B2B where customers just need "ISO 27001 certified"
- Startups and scale-ups where cost efficiency matters
- Customers who never ask which CB you use
- Internal compliance requirement (not customer-facing)
- First certification with plans to upgrade CB later
Red Flags When Choosing a CB
Non-accredited certification body (check UKAS, ANAB, or your national AB register)
Quotes significantly below market rate (may indicate shortcuts on audit days)
Pressure to purchase consultancy services from the same company (independence conflict)
No named lead auditor provided before the engagement
Unable to provide references from similar-sized organisations in your sector
Unusually short audit duration that does not meet IAF MD 5 mandatory minimums
No clear process for handling nonconformities and appeals
Frequently Asked Questions
Does it matter which ISO 27001 certification body you choose?
It depends on your market. For enterprise sales to banks, government, and defence contractors, a premium CB like BSI or LRQA carries more weight. For SaaS B2B sales, most customers accept any UKAS/ANAB-accredited certificate regardless of CB brand. The certificate itself is identical; only the brand perception differs.
Can you switch certification body?
Yes. You can transfer to a different CB at any point in the 3-year cycle, though the most common time is at recertification. The new CB conducts a transfer audit (similar to a surveillance audit) to verify your ISMS. Transfer costs are typically comparable to a surveillance audit fee. Your certificate validity continues uninterrupted.
How long does the CB selection process take?
Allow 4-8 weeks for the selection process: 1-2 weeks to request quotes (aim for at least 3), 1-2 weeks for CBs to respond with proposals, 1-2 weeks to evaluate and negotiate, and 1-2 weeks for contract and scheduling. Popular CBs may have 6-12 week lead times for the actual audit date.