ISO 27001 cost estimator: plans and published prices by platform
Only one vendor in this lineup publishes a price: Secureframe's Fundamentals plan starts at $7,500 a year for one framework. For the other five, this estimator shows which published plan fits your needs and what the plan limits say, and marks the price as quote required. It never estimates a price a vendor has not published.
Answer five questions about your ISO 27001 program, then adjust the weights if you care about some criteria more than we do. The table ranks vendors by your weights and shows, for each one, the plan that matches your answers and any published limits you would hit.
What does your ISO 27001 program need?
Which plan fits each platform?
| Vendor | Rank | Your score | Our ISO score | Matching plan | Published price | Notes |
|---|---|---|---|---|---|---|
| Scytale | 1 | 7.50 | 7.50 | Build Starter | Not published, quote required | None |
| Secureframe | 2 | 7.38 | 7.38 | Fundamentals | Starting at $7,500/year, as listed | None |
| Vanta | 3 | 7.24 | 7.24 | Essentials | Not published, quote required | None |
| Sprinto | 4 | 6.98 | 6.98 | Foundation | Not published, quote required | None |
| Drata | 5 | 6.15 | 6.15 | Compliance Automation Foundation | Not published, quote required | None |
| Scrut | 6 | 5.69 | 5.69 | No plans published | Not published, quote required |
|
There is no value per dollar column: only one vendor publishes a price, so a value figure would compare one number with five blanks.
Your score = (sum of criterion score × your weight) ÷ (sum of your weights). Scores are our editorial 0 to 10 scores from public vendor pages. Prices are only shown where the vendor publishes them, as read on 29 September 2026.
For reference: the ISO/IEC 27001:2022 standard itself is sold by ISO for CHF 155 (Edition 3, 19 pages). Certification audit fees are set by certification bodies and are not part of any price shown here unless a plan says it includes the audit.
Source: ISO/IEC 27001:2022 on iso.org · Read 29 Sep 2026
Scores are editorial; prices are as published on 29 September 2026.
Common questions
Why does the estimator not show a price for most vendors?
Because five of the six vendors do not publish prices. We show the plan that fits your answers and the published limits, and mark the price as quote required rather than guessing.
What does changing the weights do?
It re-ranks the vendors using the same criterion scores. Set a weight to 0 to ignore a criterion. The Essential Eight is not scored, so it has no weight; the results table shows whether each vendor publishes an Essential Eight page.
Which plan limits matter most for ISO 27001?
Framework count and headcount. Drata's Foundation plan covers up to 50 FTEs and one framework, and Vanta's Essentials and Secureframe's Fundamentals each list one framework. Questionnaire allowances also differ: Vanta lists 25 a year on Plus and 144 on Professional, and Sprinto lists 20 a year on Foundation.
Does any plan include a penetration test?
Scytale's Build DFY and Build Stronger bundles list a pen test. We did not find a pen test on the pricing pages of the other five vendors.