You can implement ISO/IEC 27001 without a consultant. The certification body audits your management system against the standard; using a consultant is not a requirement. What changes is who sets the order of the work and who checks it before the auditor does.
Last checked 26 October 2026.
The work is the same either way
- A scope boundary and a Statement of Applicability.
- A risk methodology and the first risk assessment.
- A policy and procedure set written to how you actually operate.
- The clause 9.2 internal audit and the management review, before Stage 2.
- Stage 1 and Stage 2 audits by an accredited certification body.
What does not change
- The certification body's fee. Audit days are set by the number of people in scope under ISO/IEC 27006-1:2024 Annex C, and the fee is paid to the body directly.
- Your own team's time. It is the cost most organisations underestimate.
- The need for a named owner. Audit-ready in 8 to 12 weeks for a single entity with up to 50 people in scope and a named owner giving about four hours a week. Larger or multi-entity scopes typically take 12 to 24 weeks to audit-ready. The certification body then sets its own Stage 1 and Stage 2 dates.
Questions to answer before you decide
- Has anyone on the team implemented or audited an information security management system before?
- Can one named owner give about four hours a week until the audit?
- Is a customer, tender or contract waiting on the certificate, and by when?
- Who will carry out the internal audit? Clause 9.2 asks for it to be objective and impartial, so the person who built the system should not audit it.
If you build it yourself
Goldline publishes three options that work alongside a system your own team builds. All prices plus VAT.
| Service | Price | What it does |
|---|---|---|
| ISO 27001 Readiness Assessment | From £1,950, plus VAT | Sets the boundary before you commit. Credited in full against a Sprint started within six months. |
| ISO 27001 Internal Audit, up to 10 people | £1,950, plus VAT | Clause 9.2 for a single entity with up to 10 people in scope, on an ISMS someone else built. Up to 2 days and a written report. |
| Pre-Certification Readiness Audit | From £3,500, plus VAT | For when you think you are ready and want it tested. |
If you want it built with you
The ISO 27001 Sprint is £7,000 fixed, plus VAT, for a single legal entity, up to 50 people in scope, one site or cloud hosted. Your team builds the single management system. Goldline sets the order and reviews every artefact. The internal audit is carried out by an independent internal auditor appointed by Goldline, never by the team that built your system. Goldline is not a certification body.
See the ISO 27001 Sprint · What ISO 27001 costs · Choosing an ISO 27001 consultant · Can an ISO 27001 consultant certify you?
Common questions
Weighing it up?
The free 45 minute diagnostic tells you what your gate requires and what you already have. The one-page roadmap is yours either way.
Book the Free Diagnostic