Australian consultancy CyberNinja estimates an ISO 27001 gap analysis at A$3,000 to A$10,000 in its 2026 cost guide. These are estimates from a firm that sells the work, not survey data. The price moves with the number of systems in scope and your existing controls. Ask for a findings report and a draft Statement of Applicability.
Key takeaways
- CyberNinja estimates a gap analysis at A$3,000 to A$10,000.
- PM Docs suggests a two to three day gap analysis before committing.
- Scope, existing frameworks and consultant rates drive the price.
- The gap assessment is a small part of the certification budget.
What do published sources say a gap assessment costs?
According to CyberNinja's 2026 guide, a gap analysis costs A$3,000 to A$10,000. The same guide puts external consultants at A$150 to A$350 per hour. PM Docs quotes consultant day rates of A$1,200 to A$2,500 or more. It recommends paying for a two to three day gap analysis before committing to a full project.
Both are vendors writing about a market they sell into. PM Docs does not date its page. Treat the figures as estimates, and get written quotes for your own scope.
What drives the price?
CyberNinja names three drivers. The first is how many systems are in scope. The second is whether you use an outside consultant or internal staff. The third is existing alignment with frameworks such as the Essential Eight, NIST CSF or the ASD ISM. A narrow scope covering one product costs less than the whole company.
What should a gap assessment deliver?
CyberNinja describes the work as a review of policies and controls against ISO/IEC 27001:2022, mapped to the 93 Annex A controls, with a prioritised roadmap. Ask for three things in writing: a findings report against clauses 4 to 10 and Annex A, a draft Statement of Applicability, and an evidence plan.
How does it fit the certification budget?
The certification audit is a separate fee. CyberNinja estimates Stage 1 and Stage 2 audits at A$7,500 to A$25,000 or more, at auditor day rates of A$1,200 to A$1,600. The audit must be run by a certification body accredited by JAS-ANZ, the joint accreditation body for Australia and New Zealand. Our SOC 2 and ISO 27001 cost guide sets out the wider ranges.
Sorami’s view
This section is opinion. It is our advice to buyers, not a statement from the sources above.
Buy the gap assessment on its own, before you commit to readiness. A fixed-scope assessment tells you how far away you are and whether a tender deadline is realistic. If a firm will only quote readiness and certification together, you cannot compare its numbers.
Agree the ISMS scope before you ask for quotes, or two firms will price two different assessments. Our ISO 27001 readiness work starts with that scope conversation.
What to do now
- Decide which products, sites and teams the ISMS will cover.
- List frameworks you already meet, such as the Essential Eight.
- Ask each firm for a fixed fee for the gap assessment alone.
- Confirm the outputs: findings report, draft Statement of Applicability and evidence plan.
- Budget the certification audit separately with a JAS-ANZ accredited body.
For the scope of our own gap assessment and readiness work, see ISO 27001 readiness, or contact us to discuss scope.
Related guides
- SOC 2 and ISO 27001 cost in Australia
- SOC 2 vs ISO 27001 for Australian teams
- How to scope a penetration test
- Every Sorami article is in the guides index.
Sources
- CyberNinja, ISO 27001 Certification Cost in Australia, 2026 (8 April 2026)
- PM Docs, ISO 27001 certification cost in Australia: realistic pricing (undated)
- Australian Department of Industry, Science and Resources, Joint Accreditation System of Australia and New Zealand
Facts on this page were checked against these sources on 22 October 2026. We update the page when the source changes.