Does the software price include certification?

No. The accredited certification body bills separately. See ISO 27001 cost.

Is my 2013 certificate still valid?

No. Under IAF MD 26, all 2013-edition certificates expired or were withdrawn at the end of the transition (Oct 31, 2025).

Can one platform run SOC 2 and ISO 27001 together?

Yes. Every platform here lists both. Some price per framework (Drata's unbundled AWS listing, Sprinto), so ask for a combined quote.

Who actually certifies me?

An accredited certification body. ISO itself doesn't certify companies.

ISO 27001 Compliance Software (2026): Pricing & Fit

The short answer

ISO 27001 certification comes from an accredited certification body, not from software. A platform gets you audit-ready: policies, the risk register, the Statement of Applicability, evidence. The certification body then runs the Stage 1 and Stage 2 audits.
Certificates now have to cite ISO/IEC 27001:2022. Under IAF MD 26, every 2013-edition certificate expired or was withdrawn when the transition ended on Oct 31, 2025.
Already doing SOC 2? Every platform below also supports SOC 2, so ask for a two-framework quote.
Lowest published entry prices: Secureframe (from $7,500/yr on its site) and Sprinto (AWS: $7,500/yr platform + first framework from $2,000).
Need room to grow to about 50 people at list price: Drata Foundation ($15,000/yr, 1–50 FTE, ISO 27001 is one of its five pre-mapped options).

Published pricing at a glance

Prices are list prices from each vendor's site or its own AWS Marketplace listing. Real quotes vary by headcount, scope and term. The certification body's fee is not included anywhere.

Platform	Published entry price	Headcount on that price	ISO 27001 on entry plan?	Source
Secureframe	From $7,500/yr (Fundamentals)	Not stated on site	1 framework of your choice	secureframe.com/pricing
Sprinto	$7,500/yr platform + first framework from $2,000	Up to 100 employees	Framework priced separately	AWS
Thoropass	Platform from $8,700/yr incl. first framework	Not stated	Listed framework; ask the vendor	AWS
Delve	Foundation from $12,000/yr	1–20 employees	Ask the vendor	AWS
Vanta	Essentials from $14,000/yr	1–20 employees	1 framework	AWS
Drata	Foundation $15,000/yr	1–50 FTE	Yes, one of five pre-mapped	AWS
Scrut	$15,000/yr	Up to 20 employees	Ask the vendor	AWS
Hyperproof	Contact for quote	—	160+ frameworks listed	hyperproof.io/pricing

Full tier detail: /pricing/vanta/ · /pricing/drata/ · /pricing/secureframe/ and the other /pricing/ pages.

Where each fits, and when another wins

Secureframe: fits cost-conscious teams that want a published starting price and the freedom to pick any first framework. Another wins if you need a published price for higher tiers (Complete and Defense are quote-only).

Sprinto: fits startups on a first certification who want the framework priced as its own line item, up to 100 employees. Another wins if you want one bundled price for platform plus framework.

Thoropass: fits teams that want software and auditing from one company (its AWS listing sells a SOC 2 audit subscription). Another wins if you want an independent certification body. Ask whether Thoropass offers ISO 27001 certification itself or through partners.

Delve: fits small teams (1–20) that also want AI frameworks (ISO 42001, NIST AI RMF) listed. Another wins if you want a longer public track record or published higher-tier pricing.

Vanta: fits teams that want the broadest catalog (35+ frameworks, including ISO 42001) and 400+ integrations. Another wins if you have more than 20 people and want a published list price at your size.

Drata: fits engineering-led teams of 21–50 that want Compliance as Code and Open API on the entry plan. Another wins if your first framework isn't one of Foundation's five, or you want the cheapest published entry price.

Scrut: fits teams that want a large out-of-the-box framework library (70+ listed). Another wins if you're above 20 employees and want a published price at that size.

Hyperproof: fits multi-framework GRC programs (160+ frameworks). Another wins if you want a published price or a startup-first product.

Strengths and limits that apply to all of them

Strength: templated policies, a risk register and an SoA, plus continuous evidence collection, which cuts the prep before Stage 1.
Limit: none of these platforms issues your certificate. You still choose, and pay, an accredited certification body.
Limit: published prices are entry bands. Adding frameworks, headcount or modules (e.g., questionnaire automation, access reviews) raises the quote.

Picking a certification body

Confirm accreditation by an IAF member body (e.g., ANAB in the US, UKAS in the UK) via IAF CertSearch.
Make sure the certificate will cite ISO/IEC 27001:2022 and that the scope statement covers what your customers care about.
Ask how they'll schedule Stage 1, Stage 2 and surveillance audits over the 3-year cycle.
Shortlist firms: ISO 27001 certification bodies and auditors (firms in our directory that list ISO 27001 include A-LIGN, Schellman, BARR Advisory, Insight Assurance and KirkpatrickPrice). Check each firm's accreditation yourself before you sign.

Compare head-to-head

Vanta vs Drata · Vanta vs Secureframe · Drata vs Secureframe · Drata vs Sprinto · Secureframe vs Sprinto · Vanta vs Thoropass · Drata vs Scrut

How we compared

Sources: each vendor's pricing page and its own AWS Marketplace listing, plus vendor framework pages (linked in the table). For ISO transition rules we use IAF MD 26.
Published list prices only, with no private quotes and no invented numbers. "Contact for quote" means the vendor publishes no price.
Same criteria for every vendor: entry price, the headcount band that price covers, whether ISO 27001 is on the entry plan, catalog breadth, integrations and audit model.
We did not run hands-on trials for this page. Full method: /methodology/

ISO 27001 compliance software