An ISO 27001 consultant helps you build your information security management system and prepare it for audit. A consultant cannot certify you. Certification is carried out by a certification body, and a certificate from an accredited certification body carries independent confirmation of that body's competence. How to choose one is covered in how to choose and book an ISO 27001 certification body.
This guide covers how to scope the work before you approach firms, the questions that show how a firm operates, the warning signs in a proposal, and how to compare proposals that are priced differently.
Before you appoint: a procurement checklist
- Why you need the certificate, and which customer, contract or framework asked for it.
- The scope to be certified: legal entities, sites, people and systems.
- Your starting position: existing policies, a named security lead, any Cyber Essentials certificate.
- Any commercial deadline, stated up front.
- Who in your organisation will own the system, approve policies and chair the management review.
- Who at the consultancy will do the work day to day, by name, and what they hold.
- A fixed price for a defined scope, in writing, and how a change of scope is handled.
- Written confirmation that the firm building your system will not carry out its clause 9.2 internal audit.
- What support is available after certification, for surveillance audits and the next internal audit.
Scope the engagement before you go to market
The most expensive mistake in ISO 27001 procurement is going to market without scope clarity. Buyers who ask "please quote to implement ISO 27001" get back either inflated quotes from firms pricing risk, or artificially low quotes from firms pricing hope. Neither serves the buyer.
Before approaching firms, establish five things.
The certification scope you actually need. This is driven by your commercial purpose. If a prime contractor is asking for ISO 27001 covering your defence work, the scope is the defence work plus supporting infrastructure. If a regulator is asking for ISO 27001 covering your AI product line, the scope is the AI product line plus supporting infrastructure. Not the whole business unless the whole business is the commercial driver.
Your starting position. Do you hold Cyber Essentials Plus? Do you have existing information security policies? Is there a nominated security lead, or is this greenfield? Be honest about this in diagnostic calls. Firms will scope based on what you tell them, and under-stating maturity leads to under-priced engagements that slip, while over-stating maturity leads to sticker shock at Stage 2 when gaps surface.
Your target timeline. Is there a commercial deadline (a contract renewal, a bid submission, a JOSCAR reassessment) driving this? If so, state it. A firm that cannot deliver against your timeline should decline the work, not quote you for an optimistic one.
Your budget reality. You do not need to disclose a figure, but you need to know what the organisation can genuinely commit to.
Your governance structure. Who owns information security in the business? Who signs off on policies? Who will chair the management review? A firm asking these questions in discovery is signalling they understand ISO 27001 is a management system engagement. A firm not asking is signalling they will treat it as a technical project.
What to look for in delivery model
Consultancies differ in who does the work, how they price it and what happens after certification. Ask each firm to name the person who will do the work day to day, to state whether the price is fixed for a defined scope, and to say what support exists after the certificate is issued.
Commercial questions worth asking
Diagnostic calls are the buyer's main tool for evaluating the firm. The questions worth asking are the ones that reveal how the firm actually operates, not the ones that prompt rehearsed answers.
Ask who will deliver the work on a day-to-day basis. Not who will be at the opening call. Not who the relationship partner is. Who will be in your office, on your calls, writing your policies, attending your management reviews. If the answer is "it depends who is available," that tells you something. If the answer is a specific person with named relevant experience, that tells you something else.
Ask for fixed scope with a fixed price. Not a day rate with an estimated number of days, because those estimates exist to be exceeded. A firm that will not commit to fixed scope is a firm that is not confident it can scope the work, or a firm that benefits commercially from scope creep. Both are warning signs. A firm that says "we will scope it in Phase 1 and commit to fixed price for Phase 2" is appropriate; they are not asking you to commit to a price before the work is understood.
Ask what happens if new scope emerges during implementation. A credible answer is: "We tell you, we re-quote, you decide whether to proceed." An evasive answer ("We'll handle it within the envelope") means either the firm is absorbing cost (unsustainable) or the envelope was inflated to begin with (you overpaid).
Ask about post-certification support. ISO 27001 is a three-year certificate with annual surveillance audits. If the firm's engagement ends at Stage 2 audit pass, you will be building ongoing ISMS operation yourself from cold. If the firm offers an Ongoing Support phase (retainer, advisory, quarterly management review support) that continuity is a meaningful positive for most buyers. Goldline's services and prices are published on the pricing page.
Ask for references from completed engagements in your sector. A defence supplier reference is meaningful if you are a defence supplier. A financial services reference is meaningful if you are financial services. A generic enterprise reference is less meaningful. Any credible firm can provide two or three relevant references.
Ask about failure cases. How many of their engagements have failed Stage 2 audit? How many have had major non-conformities? Ask how the firm's past clients fared at Stage 2 and how findings were closed. A specific answer is more useful than a general claim.
Warning signs that predict trouble
Certain patterns emerge repeatedly in engagements that go wrong.
A proposal that leads with day rates without fixed scope. This is the default commercial structure of firms that benefit from billable hours without accountability to outcome. For a defined engagement with a defined endpoint (certification) there is no good reason not to commit to fixed scope and fixed price after an initial gap assessment.
A proposal that promises a certificate by a fixed date. Certification is decided by the certification body, which sets its own Stage 1 and Stage 2 dates.
A proposal that does not engage senior leadership from the organisation. ISO 27001 is a management system standard. If a consultancy proposes an engagement that keeps senior leadership out of the process (no management reviews, no policy sign-off by the board, no executive-level engagement) the ISMS being built is not the ISMS the standard requires.
A proposal that does not mention the Statement of Applicability in any detail. The SoA is the central document of an ISO 27001 ISMS. A consultancy that does not foreground its SoA approach is a consultancy that may treat the SoA as a template exercise, which it is not.
A delivery team where you cannot identify who is accountable for the work. Large teams with unclear accountability structures produce diffused ownership, which produces thin ISMS outputs. A named senior practitioner accountable end-to-end is materially better than a matrixed delivery pod.
Evaluating bids from firms with different pricing structures
Comparing a Big 4 proposal against a boutique practitioner proposal against a volume cyber proposal on price alone is meaningless; the three firms are selling different products.
The comparison that works is total cost of ownership over three years, factoring in implementation cost, ongoing support or retainer, surveillance audit preparation, and time cost on internal leadership.
When evaluating bids, ask each firm to quote the three-year profile explicitly: implementation, ongoing support, and expected internal effort. The firms that cannot answer that are the firms selling you only the implementation. The firms that can are the firms thinking about the full engagement.
Closing
ISO 27001 procurement benefits from the same discipline as any other professional services procurement: scope before market, match firm archetype to engagement need, commit to fixed scope and fixed price after gap assessment, insist on practitioner-led delivery continuity, and evaluate on three-year total cost rather than headline implementation price.
Buyers who do this can compare proposals on the same basis and know who is accountable for the work.
Questions
Can an ISO 27001 consultant certify my organisation?
No. A consultant can help you implement the management system and prepare for audit. Certification is carried out by a certification body, which you choose and pay directly. Goldline is not a certification body and does not issue certificates. See how to choose and book an ISO 27001 certification body.
What should I ask before appointing a consultant?
Ask:
- who will do the work day to day, and what they hold;
- whether the price is fixed for a defined scope;
- what happens if new scope appears;
- how the clause 9.2 internal audit will be kept independent of the people who built the system;
- what support exists after certification.
Ask for references, and check any credential with the body that issued it.
How do I compare consultancy proposals?
Check that each proposal covers the same scope, names the people doing the work, states a fixed price or how the price is worked out, and says what happens after certification. Then add two costs that proposals rarely show: your own team's time, and the certification body's audit fee, which the certification body quotes separately. Goldline's prices are published on the pricing page.
Already built your system?
If your system is built and you want to know whether it will stand up at audit, a Pre-Certification Readiness Audit tests it before your certification body does. If you are still scoping, book a free 45 minute diagnostic.
If you are scoping an ISO 27001 procurement and want a practitioner-led gap assessment to establish scope and sizing before you go to market, see the pricing page or book a free 45 minute diagnostic.
Related reading: Can an ISO 27001 consultant certify you? · ISO 27001 on your own or with a consultant?
