Most companies budget compliance like a procurement line item and discover it is actually a construction project. SOC 2 Type II, ISO 27001:2022, and NIS2 each carry a different cost structure — in money, in calendar time, and in the hidden drag on engineering and operations teams. The spread between what organisations budget and what they actually spend is routinely 2x to 4x.
I've run or advised on compliance programmes across regulated industries — reinsurance, energy, insurance, SaaS — and the pattern is consistent. The sticker shock isn't the audit fee. It's the six months of remediation work nobody scoped, the tooling that turns out to cost twice what the vendor quoted, and the engineering time that doesn't appear in anyone's compliance budget because it gets buried in sprint velocity metrics.
Here is what each regime actually costs.
Why These Numbers Are So Wide
Before the breakdown: the ranges above are real, not hedge-your-bets consulting vagueness. The floor is a digitally mature company with existing security controls, strong documentation culture, and an internal team that can own the programme. The ceiling is a company starting from a low security baseline, limited prior documentation, and a dependency on consultants for most of the work.
The single biggest cost driver — across all three regimes — is the gap between where your controls are and where the standard requires them to be. If you have mature, documented security operations already, SOC 2 is primarily an audit. If you don't, it is a 12-month engineering and process project followed by an audit.
SOC 2 Type II: The SaaS Standard
SOC 2 is an American Institute of CPAs (AICPA) framework used almost exclusively as a B2B trust signal — particularly for SaaS companies selling into US enterprise. It is auditor-assessed, not certification-based. You get a report, not a certificate. And it comes in two flavours: Type I (point-in-time design) and Type II (6–12 months of operating effectiveness).
Type I alone is rarely sufficient for enterprise procurement today. The market has moved to expecting Type II with an observation period of at least 6 months. Budget accordingly.
SOC 2 Cost Breakdown
| Cost Category | Range (€) | Notes |
|---|---|---|
| External auditor fees | 12,000–35,000 | Varies by auditor and scope (Trust Service Criteria covered) |
| Compliance platform (Vanta, Drata, Secureframe) | 10,000–25,000/yr | Per-seat + integrations; annual subscription |
| Penetration testing (required for Security TSC) | 8,000–25,000 | Scope-dependent; annual recurring |
| Internal project owner (FTE fraction) | 15,000–40,000 | Typically 30–60% of a senior engineer or PM for 9–12 months |
| Remediation work (gap closure) | 10,000–60,000 | Highest variance item; depends entirely on baseline |
| Legal and policy documentation | 3,000–10,000 | If starting from scratch |
| Total, first year | €58,000–195,000 | Median real-world: €80,000–110,000 |
Calendar time: 6–14 months from kickoff to Type II report, assuming a 6-month observation window. Companies that try to rush the observation window by starting controls in month 1 and auditing in month 7 often find that the first month's control operation doesn't survive auditor scrutiny.
The recurring cost: Year 2 and beyond typically runs 50–65% of year 1 cost. The auditor fee recurs; the remediation and setup costs do not.
The platform cost trap
Compliance automation platforms (Vanta, Drata, etc.) are marketed as cost-savers. They are, compared to manual evidence collection at scale. But they are not compliance programmes — they are evidence collection tools. I've seen companies reach their audit with 94% green checks on the dashboard and still fail because the controls themselves were not substantively implemented. The platform tells you if the integration is connected. It doesn't tell you if the control is real.
ISO 27001:2022: The Enterprise and European Standard
ISO 27001 is the international information security management standard, the version that European enterprises, regulated industries, and public sector supply chains recognise. It is auditor-assessed and results in formal certification from an accredited certification body, typically valid for 3 years with annual surveillance audits.
The 2022 revision (ISO/IEC 27001:2022) reorganised the Annex A controls from 114 to 93, added new controls around cloud security, threat intelligence, and data masking, and is now the version auditors require for new certifications.
ISO 27001 Cost Breakdown
| Cost Category | Range (€) | Notes |
|---|---|---|
| Certification body audit fees | 15,000–45,000 | Stage 1 + Stage 2; scope and certification body dependent |
| Annual surveillance audits | 8,000–18,000/yr | Year 2 and 3; recertification audit at year 3 |
| Internal ISMS programme lead | 20,000–60,000 | Often a 50–100% FTE for 12–18 months |
| Gap assessment (external) | 8,000–20,000 | Recommended before Stage 1 to avoid surprise findings |
| Remediation and control implementation | 20,000–80,000 | Gap-dependent; technical controls + process documentation |
| Penetration testing | 8,000–25,000 | Expected by most certification bodies for A.8.8 |
| Training and awareness | 3,000–10,000 | Mandatory under Clause 7.2; often underbudgeted |
| Total, first year | €74,000–240,000 | Median real-world: €100,000–150,000 |
Calendar time: 10–18 months to initial certification for an organisation without a prior ISMS. The Stage 1 audit (documentation review) typically happens at month 10–12; Stage 2 (operational effectiveness) 4–8 weeks later. Rushing this timeline rarely works — certification bodies want to see the management system operating, not just installed.
Scope is the critical lever. ISO 27001 scope is negotiable. Scoping to a specific business unit, product, or data type rather than the entire organisation can reduce cost by 40–60%. This is legitimate — but it must be documented honestly. Scope that is drawn to avoid including genuinely critical assets will create problems in customer due diligence.
ISO 27001 vs SOC 2: which should you do first?
If you sell primarily into European enterprise or regulated industries, ISO 27001 first. If you sell into US enterprise SaaS, SOC 2 first. If you need both, plan them in parallel where the remediation work overlaps — the control frameworks share roughly 60% of their substance. A good programme manager can run both with shared evidence and a roughly 30% efficiency gain versus sequential implementation.
NIS2: The Regulatory Floor, Not a Certification
NIS2 is different in kind from SOC 2 and ISO 27001. It is not a framework you choose — it is an EU Directive (transposed into national law) that applies to you if your sector and organisation size meet the thresholds. As of October 2024, operators in 18 sectors (energy, transport, banking, digital infrastructure, healthcare, and others) with 50+ employees or €10M+ revenue are almost certainly in scope.
NIS2 does not award a certificate. It sets mandatory minimum cybersecurity requirements that regulators can audit at any time, with fines up to €10M or 2% of global turnover for essential entities. The compliance posture is permanent and ongoing.
NIS2 Cost Breakdown
| Cost Category | Range (€) | Notes |
|---|---|---|
| NIS2 gap assessment | 15,000–40,000 | Mapping existing controls to NIS2 Articles 21 & 23 requirements |
| Technical control implementation | 30,000–100,000+ | Supply chain risk management, incident response, network segmentation |
| Incident reporting capability | 15,000–40,000 | 24-hour preliminary reporting, 72-hour full report; tooling + process |
| Supply chain security programme | 20,000–60,000 | Third-party risk assessments, contractual requirements |
| Board-level governance programme | 10,000–30,000 | Mandatory board training and accountability under NIS2 |
| Ongoing compliance operation | 30,000–80,000/yr | CISO function or equivalent, regular testing, reporting |
| Total, first year | €120,000–350,000+ | Highly dependent on existing controls and sector |
Calendar time: NIS2 transposition deadlines have passed. If you are in scope and not yet compliant, you are already running late. A realistic programme to reach a defensible compliance posture runs 9–15 months. The hardest requirements — supply chain security and incident reporting infrastructure — typically take the longest.
The enforcement gap: NIS2 enforcement varies significantly by member state. Germany (BSIG/NIS2UmsuCG), Netherlands, and the Nordics are moving faster than southern European states. But enforcement is accelerating across the board. Building a compliance programme around "enforcement is still weak" is a short-duration strategy with an expensive tail.
Side-by-Side Comparison
| Dimension | SOC 2 Type II | ISO 27001:2022 | NIS2 |
|---|---|---|---|
| Type | Auditor report | Formal certification | Regulatory obligation |
| Output | Audit report (shared with customers) | Certificate (3-year + surveillance) | No certificate; regulatory standing |
| First-year cost (median) | €80,000–110,000 | €100,000–150,000 | €150,000–250,000 |
| Realistic timeline | 9–14 months | 12–18 months | 12–18 months (if starting now) |
| Recurring annual cost | €40,000–70,000 | €30,000–50,000 | €50,000–100,000 |
| Optional or mandatory | Optional (B2B trust signal) | Optional (enterprise signal) | Mandatory if in-scope |
| Scope flexibility | High | High | Low — regulator-defined |
| Board accountability | Low | Moderate | High (personal liability in some states) |
| Main driver | US enterprise sales | European enterprise sales / regulated industries | Legal obligation |
The Hidden Cost Nobody Puts in the Budget
Every compliance programme I've run has a cost that doesn't appear in the formal budget: engineering opportunity cost. During a SOC 2 or ISO 27001 first-year programme, a mid-sized engineering team typically loses 15–25% of capacity to compliance-related work — policy reviews, control implementations, evidence collection, pen-test remediation, and supporting the auditor.
At a blended engineering cost of €150,000 per engineer per year, a 10-person team losing 20% of capacity for 12 months is €300,000 of product development foregone. That cost never appears in the compliance budget. It appears in the roadmap that slipped.
The mitigation is to front-load the remediation work — do the control gap closure before the observation window starts, not during it — and to assign a dedicated programme owner who absorbs the audit burden rather than distributing it across the engineering team.
The compliance-product divide is artificial
The companies that run the most cost-efficient compliance programmes are the ones that have stopped treating compliance as a parallel track separate from engineering. SOC 2 access logging requirements are production observability requirements. ISO 27001 change management procedures are release engineering practices. When compliance requirements are built into the standard engineering workflow — not bolted on — the cost per control drops dramatically and the controls actually work.
What to Do If You're Deciding Where to Start
Three questions determine which regime to pursue first:
- Who is asking for it? If US enterprise procurement is blocking deals, SOC 2. If European regulated-industry procurement is blocking deals, ISO 27001. If you are in a NIS2-covered sector, you don't have a choice.
- What is your current baseline? A company with mature cloud security, documented policies, and an existing SIEM will spend 40–50% less than one starting from scratch. Do a gap assessment before budgeting — not after.
- Can you run two in parallel? If you need both SOC 2 and ISO 27001 within 24 months, parallel implementation with shared controls and evidence is almost always cheaper than sequential. The overlap in substantive requirements is large enough that the marginal cost of the second certification is far lower than the first.
The decision logic maps like this:
One more thing: the total cost of compliance is always lower than the cost of a breach or a failed procurement because of a missing certification. That calculation is worth making explicitly before the CFO questions the budget.
If you are trying to scope and budget a compliance programme — whether SOC 2, ISO 27001, NIS2, or some combination — let's talk. I've run these programmes inside large regulated enterprises and advised scale-ups doing it for the first time. A 30-minute discovery call is usually enough to identify where the real cost is hiding and whether your current approach is on track.