ISO 27001 CONSULTANCY, UK
ISO 27001 consultant for UK companies of up to 50 people
A customer, an investor or a tender has asked for ISO 27001. Goldline builds your information security management system with the person you name as its owner, and gets you ready for the certification body's audit. The ISO 27001 Sprint is £7,000 fixed, plus VAT, for a single legal entity with up to 50 people in scope.
Not ready to talk yet? Work out what ISO 27001 will cost you, including the certification body's audit days.
Who this is for, and who it isn't for
It's for you if:
you're one legal entity with up to 50 people in scope, on one site or cloud hosted;
someone outside the company has asked for the certificate: a customer, an investor or a tender;
you can name one person to own it, with about four hours a week to give it.
It isn't for you if you want the certificate from us. Goldline isn't a certification body and doesn't issue certificates. It also isn't for you if you want the people who built your system to audit it: Goldline doesn't audit what it implemented. And if you have several legal entities or more than 50 people in scope, there's no fixed price on this page for you. That scope is set on the free diagnostic.
Which route fits where you are
Knowing you need ISO 27001 doesn't tell you how far off you are. This is how the diagnostic places you.
| Where you are | The route | Fee |
|---|---|---|
| Nothing built yet, and someone has asked | ISO 27001 Sprint | £7,000 fixed, plus VAT |
| Some of it built, and you're not sure how far off you are | ISO 27001 Readiness Assessment | From £1,950, plus VAT |
| You built it yourselves and need the internal audit | ISO 27001 Internal Audit | From £2,950, plus VAT |
| The certification audit is booked and you want it checked first | Pre-Certification Readiness Audit | From £3,500, plus VAT |
| More than one entity, or more than 50 people in scope | Scoped on the free diagnostic | The diagnostic is free |
Prices are from our published pricing. The certification body's audit fee is billed separately and paid to the body directly.
What the ISO 27001 Sprint includes
Kickoff, scope and gap assessment.
Set-up on a GRC platform. If you already run one, the work happens inside it. Licences are bought directly from the vendor.
The policies, the risk assessment and the management system, written for you. Your owner reviews and approves them.
Your Statement of Applicability. Annex A of ISO/IEC 27001:2022 lists 93 controls in four themes: organisational, people, physical and technological. Your risk assessment decides which apply, and the Statement of Applicability records why.
A trust centre your customers can read.
The internal audit. Clause 9.2 requires an internal audit at planned intervals, and the audit has to be objective and impartial. The internal audit is included and carried out by an independent internal auditor appointed by Goldline, never by the team that built your system.
A readiness review, and support through the certification audit.
Not included: the certification body's audit fee, the platform licence, and the certificate itself, which only the certification body can issue.
How long it takes
Audit-ready in 8 to 12 weeks for a single entity with up to 50 people in scope and a named owner giving about four hours a week. Larger or multi-entity scopes typically take 12 to 24 weeks to audit-ready. The certification body then sets its own Stage 1 and Stage 2 dates.
How it works
- 01
The free diagnostic.
45 minutes on video with me. Bring whatever started this: the questionnaire, the contract clause, the customer email or an auditor's finding. You get a one-page roadmap the same day, and it's yours to keep, whether or not you work with us.
- 02
Scope and gaps.
We fix the scope first, because the scope sets everything else, including how many days the certification body will charge for.
- 03
The build.
Risk assessment, Statement of Applicability, policies and evidence, written by Goldline and approved by your owner.
- 04
The internal audit and management review.
Carried out by an independent internal auditor appointed by Goldline, never by the team that built your system.
- 05
Readiness review and certification.
You book a certification body. We support you through its Stage 1 and Stage 2 audits.
Can a consultant certify you?
No. A certificate comes from a certification body. In the UK, UKAS is the national accreditation body, and it accredits certification bodies. UKAS describes accreditation as "independent third-party recognition that an organisation has the competence and impartiality to perform specific technical activities".
You choose the certification body and pay it directly. You can check any certificate a supplier shows you on UKAS CertCheck, which UKAS describes as "a free-to-use and publicly accessible tool".
The number of audit days a body quotes depends on how many people are inside your scope, under ISO/IEC 27006-1:2024 Annex C. That's why the scope comes first.
Goldline never sells implementation and certification to the same organisation for the same scope.
Who does the work
I'm Alfred Obeng, and I lead every Sprint myself. The person you speak to on the diagnostic is the person who does the work.
- Certified Information Systems Security Professional (CISSP), ISC2 Verify on Credly
- Project Management Professional (PMP)®, Project Management Institute Verify on Credly
- ISO/IEC 27001 Senior Lead Implementer, PECB Verify on Credly
- ISO/IEC 27001 Lead Auditor, PECB Verify on Credly
- ISO/IEC 42001 Lead Implementer, PECB Verify on Credly
- ISO/IEC 42001 Lead Auditor, PECB Verify on Credly
Trusted by
Questions procurement and security teams ask
Ready when you are
Or work out what ISO 27001 will cost you first.
Reviewed by Alfred Obeng, 21 October 2026. Next review 21 January 2027.