Want a price for your business?
Thirty minutes with Peter, no sales pitch. You will get a fixed monthly number and a realistic date for being audit ready.
End of 2026 deal, expires 31/12/26
The honest answer to "what does ISO 27001 or SOC 2 certification cost in Australia" is that it depends on how you buy it. Hourly consultants are hard to forecast and the total is usually discovered rather than agreed. We price it as a fixed monthly subscription over twelve months, so you know the number before you start.
Our compliance packages run from $2,450 to $3,750 per month excluding GST, for up to 50 employees, over a twelve month term. End of year offer: CERTIFY is $2,750 per month, down from $3,750, on contracts signed by 31 December 2026. What follows is what sits inside each package, what is deliberately not included, and what moves the price.
| Package | Price (ex GST) | Who it is for |
|---|---|---|
| CERTIFY Rapid certification |
12 month subscription |
You are not certified yet and need to be. SOC 2, ISO 27001, ISO 42001 or another framework. |
| MAINTAIN Ongoing maintenance |
$2,450 per month 12 month subscription |
You are already certified and need to stay that way without hiring for it. |
| DISP CERTIFY Defence membership |
$3,750 per month 12 month subscription |
You need DISP Entry Level, Level 1 or Level 2 to work with Defence. |
All prices exclude GST and cover one framework for up to 50 employees. Beyond that it is $1,000 per month per additional 50 employees, or per additional 40 employees on DISP.
Prices on this page are current as of 18 October 2026, quoted in Australian dollars and excluding GST. The CERTIFY rate of $2,750 per month applies to contracts signed by 31 December 2026, after which it returns to $3,750 per month.
Every package is delivered by an Australia-based compliance team, with a dedicated consultant rather than a rotating pool. Across CERTIFY and MAINTAIN you get the following.
| What you get | What that means in practice |
|---|---|
| Policies written for your business | Written around how you actually operate, not a template pack with your logo dropped on it |
| Risk assessment, internal audit and management committee | Scheduled and hosted by us, rather than left sitting on your to-do list |
| Employee ISMS training | Training for your staff on the information security management system they have to work inside |
| Incident response, disaster recovery and business continuity planning | All three plans written for your environment rather than downloaded |
| A tabletop exercise | The plans walked through with your team, so they are tested rather than theoretical |
| External penetration testing | Included in every package. Further testing is available at a discounted rate |
| Security questionnaire support | We handle the customer security questionnaires that otherwise quietly eat your week |
| Our compliance management platform | Deployed in your tenant, with your data, at no ongoing subscription cost |
DISP CERTIFY is structured differently because the scheme is.
| Element | What it covers |
|---|---|
| Four domain gap analysis | Governance, personnel, physical, and ICT and cyber |
| Security controls | Aligned to the Information Security Manual |
| Policy and procedure suite | DISP policies and procedures customised to your organisation rather than generic documents |
| CSO and SO advisory support | Support for your Chief Security Officer and Security Officer in their DISP roles |
| Incident response planning | Defence-aligned incident response planning |
| Annual Security Report | Preparation of the annual report that DISP membership requires |
| Not included | Why | What to budget |
|---|---|---|
| The external audit | The certification body or auditor is independent and bills you directly. This is true of every provider, and anyone folding it into a single number is either estimating it or marking it up | Typically $5,000 to $15,000 depending on your size, your scope and the auditor’s days. We can introduce you to certification bodies we work with regularly |
| GST | Every figure on this page is quoted excluding GST | Add 10 per cent |
| Additional frameworks | Each package covers one framework | A second framework is an add-on, and costs considerably less than the first because much of the evidence is shared |
Optional add-ons include discounted penetration testing, a secure cloud review across Microsoft 365 and Azure, and additional frameworks.
| Factor | Effect on your price |
|---|---|
| Headcount | The base covers up to 50 employees. Beyond that the price steps up by $1,000 per month for each additional 50 employees, or each additional 40 on DISP, because more people means more access reviews, more training and more evidence |
| Number of frameworks | One is included. SOC 2 and ISO 27001 together cost less than two separate programmes, because the control sets overlap heavily |
| Certifying or maintaining | MAINTAIN is cheaper than CERTIFY because the heavy lifting is already done. If you are already certified, that is the package you want |
Wherever you are starting from, we can help. You do not need existing policies or compliance knowledge. Our fixed-price packages are designed to take Australian small and mid-sized businesses from zero to certification in 3 to 9 months, with our consultants guiding you through the process and doing the heavy lifting.
Our packages are built to get you audit ready in three to nine months, without you needing a full-time internal hire. The typical market alternative runs nine to eighteen months or more, largely because the work is advisory rather than managed, so progress depends on your team finding the time.
Every client we have taken to a SOC 2 or ISO 27001 audit has passed it.
| Siege Cyber | Typical alternative | |
|---|---|---|
| Time to audit ready | 3 to 9 months | 9 to 18+ months |
| Team | Australia-based, dedicated consultant | Rotating or offshore |
| Effort required from you | Fully managed | Guidance provided, you do the work |
| Cost | Fixed monthly, scope agreed up front | Hourly, hard to forecast |
| After certification | Ongoing support, you stay compliant | Engagement ends at the certificate |
Most people want one number rather than two. These are the common cases, with our package added to the external audit fee so you can see the whole first year. All figures exclude GST.
| Your situation | CERTIFY, twelve months | External audit, billed by the auditor | First year, all in |
|---|---|---|---|
| Up to 50 employees, one framework | $33,000 | $5,000 to $15,000 | $38,000 to $48,000 |
| 51 to 100 employees, one framework | $45,000 | $5,000 to $15,000 | $50,000 to $60,000 |
The arithmetic is the monthly figure multiplied by twelve, plus the audit fee the certification body or CPA firm bills you directly. Nobody can quote that audit fee except the auditor, which is why we publish the range rather than fold a guess into our own number. If you are already certified, MAINTAIN is $2,450 per month, or $29,400 across twelve months, plus your surveillance audit.
With us, $3,750 $2,750 per month excluding GST over twelve months for up to 50 employees, on contracts signed by 31 December 2026, plus the external certification body's own audit fee, which they bill you directly. That covers the whole programme: policies, risk assessment, training, internal audit, penetration testing and the platform.
$2,750 per month excluding GST over twelve months for up to 50 employees, on contracts signed by 31 December 2026, which is $33,000 across the year plus the CPA firm’s own attestation fee. That is the same CERTIFY package and the same price as ISO 27001, because SOC 2, ISO 27001 and ISO 42001 all sit inside CERTIFY and you choose the framework. SOC 2 requires a licensed CPA firm for the attestation, which is the equivalent of the certification body fee and is billed to you directly.
Because certification is not a project that ends. The controls have to keep operating, the evidence has to keep being collected, and the audit happens on a cycle. Pricing it monthly matches how the work actually behaves, and it keeps the finance conversation short.
Yes, and it is usually the right call if you sell into both Australian enterprise and United States customers. The control sets overlap substantially, so the second framework is an add-on rather than a second full programme.
MAINTAIN at $2,450 per month covers single-framework ongoing compliance, including the internal audit, management committee, annual tabletop exercise, penetration testing and security questionnaire support.
External penetration testing is included in all three packages. Further testing is available at a discounted rate. Our standalone prices are on the penetration testing pricing page.
Tell us which framework you need and roughly how many people you employ, and we will come back with a fixed monthly price and a realistic date for being audit ready.
Next step: Book 30 minutes with Peter, or send us your details and we will put a number in front of you.