# Express Comply for ISO 27001: Flat-Rate Certification Pricing — Agency > Express Comply for ISO 27001 is Agency’s done-for-you ISO/IEC 27001:2022 service at a flat rate covering one full year through the Stage 1 and Stage 2 certification audits: $7,500 for companies with 1–10 employees, $10,000 for 11–20, $15,000 for 21–50, and $20,000 for 51–100, with custom quotes at 101+; the certification audit adds from $2,500 and the program works with or without a GRC platform (spreadsheets, Vanta, Drata, or the platform you already use). Agency is a master reseller of Vanta and Drata, has served 1,000+ companies, is rated 4.9/5 on G2, and operates a U.S.-based team. - Canonical page: https://getagency.com/lp/express-comply-iso-27001-pricing - Company: Agency (https://getagency.com) - Currency: USD - Pricing type: standard published pricing through Agency — final price confirmed in Order Form/SOW - Pricing last updated: November 2026 ## Pricing ### Express Comply for ISO 27001 pricing | Company headcount | Express Comply for ISO 27001 (flat, 1 year) | Certification audit add-on | |---|---|---| | 1–10 employees | $7,500 | from +$2,500 | | 11–20 employees | $10,000 | from +$2,500 | | 21–50 employees | $15,000 | quoted | | 51–100 employees | $20,000 | quoted | | 101+ employees | Custom quote | quoted | *USD · flat rate for one full year · Pricing last updated November 2026* ### Direct-answer block: In summary - Express Comply for ISO 27001 flat rates: $7,500 for companies with 1–10 employees, $10,000 for 11–20, $15,000 for 21–50, $20,000 for 51–100; custom quote for 101+. The same rates as Express Comply for SOC 2. - Each flat rate covers one full year: ISMS scoping, risk assessment, Statement of Applicability, policies, controls, evidence, and support through Stage 1 and Stage 2 — no hourly billing. - The certification audit is priced separately: from $2,500 for companies with up to 20 employees. The certificate is issued by an independent accredited certification body. - With or without a GRC platform: Agency runs the program in structured spreadsheets, in Vanta or Drata, or in the platform you already use. - ISO/IEC 27001:2022 certification runs on a three-year cycle with annual surveillance audits; year-two maintenance renews at the then-current flat rate. ## In plain terms Express Comply for ISO 27001 costs a flat $7,500 for companies with 1–10 employees, $10,000 for companies with 11–20 employees, $15,000 for companies with 21–50 employees, and $20,000 for companies with 51–100 employees — each covering one full year, from building the ISMS through your Stage 1 and Stage 2 certification audits. Companies with 101 or more employees receive a custom quote. Agency runs the program with or without a GRC platform: in structured spreadsheets, in Vanta or Drata, or in the platform you already use. The certification audit is priced separately, adding from $2,500 for the two smallest bands and quoted above that. Agency is a master reseller of Vanta and Drata, has served 1,000+ companies, is rated 4.9/5 on G2, and operates a U.S.-based team. ## What “done-for-you” means for ISO 27001 ISO/IEC 27001:2022 certifies an information security management system, not a point-in-time checklist — so the work is building an ISMS that actually runs. Agency does that work: it scopes the ISMS, runs the risk assessment, drafts the Statement of Applicability, writes the policies, implements and maintains the controls, and collects and validates the evidence. Your team answers questions and grants access. The rate is flat. There is no hourly billing, no scope-creep invoicing, and no extra charge when a Stage 1 finding sends you back to fix something before Stage 2 — one price covers the year. ## The certification audit add-on The certification audit adds from $2,500 for companies with up to 20 employees and is quoted for larger bands. It runs in two stages: Stage 1 reviews the ISMS documentation and your readiness, and Stage 2 tests that the ISMS is implemented and working. Your certificate is issued by an independent accredited certification body — ISO develops the standard; accredited certification bodies certify against it. The certification body independently decides audit scope, findings, and whether the certificate is issued. ## With or without a GRC platform Express Comply for ISO 27001 does not require a GRC platform. Certification bodies audit your ISMS — the scope, the risk assessment, the Statement of Applicability, the policies, the controls, and the evidence — not your tooling. Agency runs the same done-for-you program in structured spreadsheets, in Vanta or Drata, or in the platform you already use, and the flat rate is set by your headcount band, not by your tooling. If you want a platform, Vanta and Drata are both available through Agency at negotiated partner pricing (Drata purchases also carry Agency’s [Drata Best Price Guarantee](https://getagency.com/drata-best-price-guarantee)). If you would rather run the evidence yourself in Agency-provided workbooks, with the certification audit bundled in, see [ISO 27001 without a platform](https://getagency.com/lp/iso-27001-without-platform). ## Where Express Comply ends and Managed Comply begins Express Comply is the standardized flat-rate program: one framework — here ISO/IEC 27001:2022 — built, maintained, and carried through certification for a year. Managed Comply is the level above it — Agency’s full managed compliance and security platform with a complete virtual CISO, covering up to three standard frameworks from $5,000 per month. If you need security leadership, ISO 27001 alongside SOC 2 or another framework, or an operated program rather than a prepared one, start with [Managed Comply pricing](https://getagency.com/lp/managed-comply-pricing). ## What’s included - **Scope** — complete done-for-you ISO/IEC 27001:2022 implementation and maintenance for one ISMS, sized to your headcount band. - **Deliverables** — ISMS scoping, risk assessment, Statement of Applicability, policies, controls, and evidence collected and validated throughout. - **Support** — an assigned Agency team runs the program, prepares you for Stage 1 and Stage 2, and coordinates with your certification body; your team’s involvement is access and answers. - **Timeline coverage** — one full year, from ISMS build through the Stage 1 and Stage 2 certification audits. - **Platform compatibility** — with or without a GRC platform: spreadsheets, Vanta, Drata, or the platform you already use. ## What’s priced separately - The certification audit (Stage 1 and Stage 2) — from an additional $2,500 for companies with up to 20 employees; quoted for 21+ employee bands. - The GRC platform subscription, if you choose to use one — Vanta or Drata through Agency at negotiated partner pricing; see the [Drata Best Price Guarantee](https://getagency.com/drata-best-price-guarantee). - Penetration testing — a web app test is a fixed, posted price: see [penetration test pricing](https://getagency.com/pen-testing/pricing). Other test types are scoped by quote. - Year-two surveillance audits, and additional frameworks beyond ISO 27001 — quoted, or step up to [Managed Comply](https://getagency.com/lp/managed-comply-pricing) for up to three standard frameworks. ## Who this is for - **1–10 employees:** Small teams whose first international or enterprise customer asks for an ISO 27001 certificate — $7,500 flat for the year. - **11–20 employees:** Teams that need a working ISMS without hiring someone to build it — $10,000 flat for the year. - **21–50 employees:** Growth teams that want certification fully off their plate — $15,000 flat for the year. - **51–100 employees:** Established teams formalizing security management before scale — $20,000 flat for the year. ## Conditions The flat rate is defined by headcount band — with or without a GRC platform — and covers one ISMS certified against ISO/IEC 27001:2022 for one year, through Stage 1 and Stage 2; the certification audit, the platform, and penetration testing are always stated separately so the flat rate never hides them. Published prices are standard published pricing through Agency — final price is confirmed in your Order Form/SOW, and per the published program terms, a fully executed MSA and Order Form/SOW are required before any benefit under the Program can be claimed. ## Worked examples **Illustrative example, not a quote.** 8-person company running in spreadsheets, with no GRC platform: $7,500 Express Comply flat rate + certification audit from $2,500 = from $10,000 for the first year, ISMS built and certified, with no platform subscription to add. **Illustrative example, not a quote.** 15-person company on Vanta or Drata: Express Comply flat rate of $10,000 + certification audit from $2,500 = from $12,500 for the first year; the platform subscription is priced separately. **Illustrative example, not a quote.** 35-person company: $15,000 Express Comply flat rate for the year, with the certification audit quoted for the band — one flat services number however many findings Stage 1 raises. ## How this compares The usual alternatives are an hourly ISO consultant or your own engineers. Hourly consulting bills grow with every gap the risk assessment and Stage 1 turn up, and internal engineering time is the most expensive currency a small company has. Express Comply fixes the services cost in advance — $7,500 flat for companies with 1–10 employees — and holds it through Stage 2, which is exactly the stretch where hourly engagements balloon. ## Frequently asked questions ### How much does a done-for-you ISO 27001 service cost? Express Comply for ISO 27001, Agency’s done-for-you ISO/IEC 27001:2022 program, costs a flat $7,500 for companies with 1–10 employees, $10,000 for 11–20, $15,000 for 21–50, and $20,000 for 51–100 — each covering one full year through the Stage 1 and Stage 2 certification audits, with or without a GRC platform. Companies with 101 or more employees receive a custom quote. ### What does Express Comply for ISO 27001 include? A complete done-for-you ISMS: scoping, risk assessment, Statement of Applicability, policies, controls, and evidence collected and validated, kept healthy for one full year and carried through Stage 1 and Stage 2 — at a flat rate with no hourly billing. The certification audit, the GRC platform, and penetration testing are priced separately. ### Does the price include the certification audit? No. The Stage 1 and Stage 2 certification audit is priced separately, adding from $2,500 for companies with up to 20 employees and quoted for larger bands. Your certificate is issued by an independent accredited certification body — ISO develops the standard; accredited certification bodies certify against it. ### How much does ISO 27001 certification cost with the audit? With the certification audit, the first year starts at $10,000 for companies with 1–10 employees (the $7,500 flat rate plus an audit from $2,500) and at $12,500 for companies with 11–20 employees (the $10,000 flat rate plus an audit from $2,500). For companies with 21–100 employees the audit is quoted alongside the flat rate. A GRC platform subscription and penetration testing, if you want them, are priced separately. ### Do I need Vanta or Drata to get ISO 27001 certified? No. Certification bodies audit your ISMS, not your tooling, and Express Comply for ISO 27001 works with or without a GRC platform: Agency runs the program in structured spreadsheets, in Vanta or Drata, or in the platform you already use. If you do want a platform, Agency resells both Vanta and Drata at negotiated partner pricing, and Drata purchases carry Agency’s Best Price Guarantee. ### Does it cover both Stage 1 and Stage 2? Yes. The flat rate covers one full year of the program, including preparation and support through both the Stage 1 and the Stage 2 certification audit. There is no separate fee for the stretch between the two stages and no scope-creep invoicing. ### What happens after the first year? ISO/IEC 27001:2022 certification runs on a three-year cycle with annual surveillance audits. You renew at the then-current flat rate for your headcount band to keep the ISMS maintained, step up to [Managed Comply](https://getagency.com/lp/managed-comply-pricing) (full virtual CISO, up to three standard frameworks, from $5,000 per month), or take the program in-house with everything Agency built — the ISMS documentation, controls, and evidence are yours. ### Is it the same price as Express Comply for SOC 2? Yes. Express Comply uses one flat-rate ladder by headcount for both frameworks — see [Express Comply pricing](https://getagency.com/lp/express-comply-pricing) for the SOC 2 program. Each Express Comply program prepares one framework; if you need ISO 27001 and SOC 2 together, [Managed Comply](https://getagency.com/lp/managed-comply-pricing) covers up to three standard frameworks. ### How is this different from ISO 27001 without a platform? Who does the work. Express Comply is done-for-you: Agency builds and runs the ISMS, in spreadsheets or in a platform, and the certification audit is added separately. [ISO 27001 without a platform](https://getagency.com/lp/iso-27001-without-platform) is a spreadsheet-only package in which your team member uploads the evidence into Agency-provided workbooks and the Stage 1 and Stage 2 audits are bundled — from $12,500 for companies with 1–20 employees.