ISO/IEC 27001 Will not be only one invoice. It's a bundle of one-time and recurring costs, several of which you'll do by yourself and many of which You can not. Here is in which the money goes. The official third-social gathering certification process is split into two distinct stages, with https://calvant.com/blog/iso-27001-vs-soc-2-comparison-differences-benefits