ISO/IEC 27001 Is not a single Bill. It is just a bundle of 1-time and recurring costs, a number of which you'll do oneself and a few of which you cannot. Here's where The cash goes. ISO/IEC 27006 specifies needs for bodies providing audit and certification of an ISMS. It's waiting for link from Web 2.0 Profiles (2)