ISO/IEC 27001 Just isn't only one invoice. It's really a bundle of one-time and recurring costs, some of which you'll be able to do by yourself plus some of which You can't. Here's the place the money goes. A Lead Implementer + Lead Auditor bundle is usually accessible for corporations https://calvant.com/blog/iso-27001-vs-soc-2-comparison-differences-benefits