ISO/IEC 27001 Is just not only one Bill. It is a bundle of one-time and recurring costs, several of which you'll be able to do on your own and many of which you cannot. Here is in which The cash goes. Being an ISO 27001 Lead Auditor, my suggestions is https://calvant.com/blog/iso-27001-vs-soc-2-comparison-differences-benefits