ISO 27001 consulting in Germany 2026: hourly rates, daily rates and realistic project costs

ISO/IEC 27001:2022 has been in force since October 31, 2022 and replaces the previous version 27001:2013 with a three-year transition period. Anyone who is still on the move in 2026 without a certification plan is under real time pressure, because the transition period ends on October 31, 2026. The typical reaction is to look for external advice, and the first question is almost always: How much does it cost per hour? The answer depends on four levers: seniority of the consultant, industry focus, location and duration of the assignment. In the German market, the hourly rates for ISO 27001 consulting 2026 range between 140 and 320 euros net, daily rates between 1,200 and 2,400 euros net.

This article breaks down the price ranges by phase, shows typical project sizes for medium-sized companies and corporations and classifies in which constellations a platform-plus-officer model remains economically below the pure hourly rate. CIVAC is a compliance platform and officer-as-a-service with 93 controls and 490 audit templates that has measurably reduced hourly budgets in over 200 ISO 27001 projects. We do not calculate on an hourly basis, but rather provide flat rates that can be planned on a monthly basis with a clearly defined scope of services. The comparison is worthwhile before any contract is awarded because the range between a bad and a good contract can be 50,000 euros or more per project. In this article we only consider the German market and only accredited certifications according to ISO/IEC 27001:2022, not the free audit variants without accreditation.

The range of hourly rates for ISO 27001 consulting in Germany is divided into three segments. Junior consultants with less than three years of ISMS experience are billed at 140 to 180 euros net per hour. Senior consultants with five to ten years of experience in several industries cost 200 to 260 euros net. Lead auditors and partners with their own certification experience as TÜV auditors or accredited auditors from DEKRA, DQS or BSI Group achieve 280 to 320 euros net, in individual cases more. The location bonus for Munich, Hamburg and Frankfurt is 10 to 15 percent above the national average.

Daily rates are typically not the hourly rate times eight, but lower because consultants calculate seven instead of eight net hours for daily bookings and take travel expenses into account. A rule of thumb: daily rate = hourly rate times 7.2. Anyone who books a senior consultant for a GAP analysis day pays 1,600 to 2,000 euros net, lead auditors achieve 2,200 to 2,400 euros net. Travel costs are to be billed separately in 80 percent of the contracts; the usual rate is 0.42 euros per kilometer, overnight stays according to expenditure up to 180 euros per night and daily expenses according to the BRKG rate. Material and licence costs for tools such as Verinice, ISMS portal or audit templates are not included in most hourly rates and are shown separately. Anyone planning a complete implementation should therefore not only compare the hourly rate, but also the total cost of compliance, i.e. all consultant, tool, travel and internal personnel expenses over the full project period. A serious quotation request therefore clearly separates the items and requires at least a phase calculation with hourly quotas for each phase, a separate list of travel costs and a suggestion for dealing with scope changes during the project.

An ISO 27001 initial project is divided into five phases, each with its own hourly profile. First: initiation and scoping, 20 to 40 hours. Here, consultants and management define the scope according to Clause 4 of ISO/IEC 27001:2022, identify interested parties according to Clause 4.2 and determine the risk treatment strategy. Second: GAP analysis, 40 to 80 hours. Consultants check the existing organisation against the 93 controls of Annex A and the 7 clauses of the main part of the standard. The result is a catalogue of measures with an effort estimate per control.

Third: documentation development, 80 to 180 hours. ISMS policy, risk assessment, Statement of Applicability (SoA), instructions and records are created or adapted from templates. This phase is the biggest lever because 490 standardised audit templates, like those provided by CIVAC in the workspace, can reduce the effort to 40 to 80 hours. Fourth: implementation and training, 60 to 200 hours. Here, technical controls are anchored in Active Directory, MDM, SIEM and backup systems and employees are trained. Fifth: internal audits and management review, 30 to 80 hours. Consultants accompany the first internal audit cycle according to clause 9.2 and the management review according to clause 9.3. The Level 1 and Level 2 certification audits are not part of the consulting hours, but are billed separately by the accredited certification company. You can find an overview of the consultant role at Information Security Officer. The clean phase separation prevents cost jumps in the ongoing project because each phase ends with an explicit transition and an intermediate status that is approved before the start of the next phase. These transitions are the central control points for clients and should be anchored in the contract with delivery dates and acceptance criteria.

The total hours of an ISO 27001 initial project scale with organisation size, complexity and scope. A medium-sized company with 50 to 150 employees, one location and a clearly defined scope (e.g. only IT services) typically needs 250 to 350 consulting hours over 6 to 9 months. With an average hourly rate of 220 euros net, the consultant's budget is 55,000 to 77,000 euros net, plus certification fees of 8,000 to 15,000 euros net for level 1 and level 2 as well as internal personnel expenses, which are underestimated in most cases.

An upper medium-sized company with 200 to 800 employees, two to three locations and a combination Scope (IT plus production or IT plus finance) is 400 to 600 consulting hours over 9 to 12 months. The budget is between 100,000 and 150,000 euros net. Group subsidiary or group unit with its own ISMS, international scope and several subsidiaries achieves 600 to 1,200 hours, often spread over a team of consultants of three to five people over 12 to 18 months. Budgets here are between 150,000 and 400,000 euros net, depending on multilingualism, number of subsidiaries and complexity of the supplier connection according to Annex A 5.19 to 5.21. Anyone working in this size class should make a make-or-buy decision in advance: internal ISB plus platform or external ISB with full operational responsibility. Both paths lead to certification; the economic difference is significant. The appointment certificate, signed, filed, verifiable. In corporate practice, we recommend obtaining at least two offers from accredited consultants and calculating a platform flat rate at the same time in order to validate the profitability. This three-way calculation costs two to four weeks in advance and is the most reliable basis for a board decision.

Four factors are driving up the hourly rate. First: seniority. Lead auditors with accreditation charge the highest hourly rate because they can not only advise, but also introduce certification logic from day one. Second: industry. Consulting for critical infrastructures (KRITIS), banks, insurance companies, healthcare and defence costs 20 to 40 percent more than for standard medium-sized companies because sector-specific security requirements such as BSI-Grundschutz, BAIT, VAIT, KAIT or the BNetzA IT security catalogue have to be taken into account.

Third: specialization. Consultants with combined expertise in ISO 27001 plus NIS-2, ISO 27001 plus TISAX or ISO 27001 plus C5 achieve premiums of 15 to 25 percent because they avoid duplication of work and exploit synergies between the standards. Fourth: market situation. Since the NIS 2 directive came into force in October 2024 and the pressure on around 29,500 NIS 2 affected companies in Germany, senior consultants have been heavily utilised in 2026, and free capacities are often only available three to six months in advance. This further drives up prices. Anyone looking for a senior consultant with combined ISO 27001 and NIS 2 experience in 2026 should expect hourly rates at the upper end of the scale. Contracts with fixed price components reduce price volatility, combined with clearly defined hourly quotas per phase. The auditor calls, the evidence is ready., this applies to the certification as well as to the consulting contract. Anyone who concludes a consulting contract should necessarily include a record-keeping clause that obliges the consultant to store all work results in a defined format so that the knowledge remains in-house when the consultant leaves. This clause is becoming increasingly standard in the market and is a key differentiator between reputable and unreliable providers.

Four billing models dominate the German ISO 27001 consulting market. First: Time and Material (T&M). The consultant invoices hours based on effort, usually fortnightly or monthly. Advantage: high flexibility, disadvantage: the customer bears the budget risk. This model dominates for smaller orders and in the initial phase, where the scope and effort are still uncertain. Second: fixed price. The consultant guarantees a project result (e.g. readiness for certification) at a fixed price. Advantage: planning security, disadvantage: fixed prices usually include a risk premium of 15 to 25 percent.

Third: retainer. The customer books a monthly hourly quota (e.g. 20 or 40 hours per month) at a reduced hourly rate. This model is suitable for ongoing ISMS maintenance after certification. Minimum terms of 12 months are usual. Fourth: Platform flat rate with Officer-as-a-Service, as offered by CIVAC. Here the customer pays a monthly flat rate for the platform plus the appointment of an external information security officer. The price includes Workspace licence, 490 audit templates, ISO 27001:2022 certified ISMS, EU data residency and ISB as a person. Effective hourly rates fall below 130 euros net because consultant time is optimised through platform automation. Licence the workspace for your internal representatives, or have our representatives order it. Others run compliance like a filing cabinet. We run it like software. Which model is right depends on the level of maturity and internal capacity. If you are setting up your first ISMS and can bring in less than 0.5 FTE internally, the platform flat rate is best. If you already maintain a certified ISMS and only compensate for bottlenecks, choose T&M or Retainer.

Hourly rates have become more transparent, but hidden costs remain high. Four items deserve particular attention. First: internal personnel costs. For each consulting hour, 0.5 to 1.5 internal hours are spent on workshops, data provision, reviews and decisions. For a project with 400 consulting hours, there are 200 to 600 internal hours that are not included in the consulting offer but must be calculated. Second: tool and licence costs. Verinice licences, risk management tools, training platforms and audit software range from 5,000 to 25,000 euros per year, depending on the provider.

Third: certification fees. Accredited certification companies charge between 8,000 and 25,000 euros net for levels 1 and 2, depending on the number of employees, locations and scope. The annual surveillance audits are 30 to 50 percent of the initial certification fee, and the recertification audit in the third year is 70 to 80 percent. Fourth: follow-up costs of maintenance. Anyone who staffs the ISMS internally with less than 0.3 FTE after certification risks complaints in the surveillance audit. The ongoing personnel costs of a full-time internal information security officer in 2026 will be 85,000 to 130,000 euros per year gross plus social security contributions. An external information security officer in the officer-as-a-service model costs 1,800 to 4,500 euros per month as a flat rate and includes the platform, templates and reporting line. Calculated over three years, the external model often reaches 50 to 60 percent of the full internal costs. This calculation only shifts when there are around 800 employees, because then the internal utilization rate of a full-time ISB is sufficiently high to justify the full costs. Anyone in this size class who has two locations and a broader scope often still sticks with the hybrid model of internal ISB plus platform.

The transition period from ISO/IEC 27001:2013 to ISO/IEC 27001:2022 ends on October 31, 2026. Anyone who has not switched to the new version by then will lose their certification. The accreditation bodies DAkkS and UKAS have confirmed the deadline several times, and no extension is expected. The effort required for transition certification is between 80 and 200 consulting hours, depending on the level of maturity. The focus is on the new Annex A with 93 controls in four subject groups (organisational, personal, physical, technological) instead of the 114 controls in 14 clauses of the previous version.

Eleven controls are completely new, including Threat Intelligence (A 5.7), Information Security for Cloud Services (A 5.23), ICT Readiness for Business Continuity (A 5.30), Physical Security Monitoring (A 7.4), Configuration Management (A 8.9), Information Deletion (A 8.10), Data Masking (A 8.11), Data Leakage Prevention (A 8.12), Monitoring Activities (A 8.16), Web Filtering (A 8.23) and Secure Coding (A 8.28). These eleven controls generate the bulk of the transition projects because they often require new technical measures and new records. Anyone who only operates the ISMS in a documented manner today must check whether the internal audit and monitoring capacities are sufficient. Audit-proof, documented, § ISO-proof. CIVAC delivers the 93 controls as a preconfigured control catalogue in the workspace, with those responsible, reminders and audit reports. You can find a more in-depth overview in the article ISO 27001:2022 Transition October 2026. Transition projects for 2026 are capacity-critical because the certification companies are very busy in the last few months before the deadline. Anyone who does not receive the deadline in late summer 2026 risks losing the certificate and thus the requirement for tenders that require ISO 27001:2022.

Hourly rates are negotiable in the B2B consulting market; the scope for negotiation is typically 8 to 15 percent. Three levers work particularly well. First: volume discount. Anyone who books an hourly quota of 200 hours or more per project and calls them up in advance will receive discounts of 8 to 12 percent. Second: multi-year contract. A retainer over 24 months with a fixed monthly volume justifies hourly rate reductions of 10 to 15 percent because the advisor gains the ability to plan. Third: reference clause. Anyone who allows the consultant to name the project as a reference or to write a case usually receives a 3 to 5 percent discount.

Two levers work poorly. First: last-minute negotiations shortly before the contract is signed. Consultants who are working at full capacity will not be under pressure in 2026 and would rather forego the project. Second: hardship negotiations based on pure hourly rates, without any consideration in the scope or in the contract term. A realistic path is the combination of fixed price portion for the first three phases and T&M for the last two, because scope and effort become clearer as the project progresses. Anyone who includes a platform-plus-officer solution like CIVAC shifts the negotiation away from the hourly rate to a flat rate and gains planning ability. The appointment certificate for the external representative is available in the CIVAC SLA in 2 working days, instead of the classic 2 to 6 weeks, which significantly shortens the project start phase and thus indirectly saves costs because the GAP analysis can begin with the responsible representative and not in a vacuum. Anyone who concludes the contract with a 90-day trial period and clearly defined exit conditions retains full control capability and additionally reduces the economic risk. This trial phase is also suitable for realistically checking the response times of the external representative.

The hourly rate is an important comparison figure, but the wrong optimization variable. If you want to successfully complete an ISO 27001 project, you should compare the total cost of compliance over 36 months: consulting hours plus tool licences plus certification fees plus internal effort plus follow-up maintenance costs. CIVAC is a compliance platform and officer-as-a-service that combines these five items into one monthly flat rate. 93 controls preconfigured, 490 audit templates, EU data residency, ISO 27001:2022 certified ISMS on the platform side, plus the appointment of an external information security officer as a person.

You have two options. First: You licence the Workspace for your internal representatives and reduce consultant hours by 30 to 50 percent because documentation, reminders and audit reports are automated. Secondly: You have our representatives appointed and fully delegate the operational ISB function, including reporting line, annual report to the management and monitoring of the certification audit. If you would like to know where your project stands in the hourly rate market and whether the flat rate model is cheaper for your size class, write to info@civac.de or use the contact form on civac.de. We create a comparative calculation over 36 months based on your number of employees, your scope and your level of maturity. This comparison calculation separates consultant, tool, certification, internal and follow-up costs and makes the comparison with competing offers transparent. It is formatted as a basis for decision-making by management and can be incorporated directly into an investment template. We typically send the invoice within five working days of the first 30-minute conversation and mark all assumptions transparently so that management can make adjustments at any time. If requested, we can also include two competing offers from accredited consultants in the list as a basis for comparison so that the decision is three-dimensionally sound. Turn reading into an assignment.