ISO 27001 consultancy is the single largest controllable line in most UK certification budgets, and it is also the line buyers understand least. The certification body’s fee is derived from a published table and barely moves. The software licences have a list price. The consultant’s invoice, by contrast, can vary by a factor of four for what looks like the same job — and almost nobody asks why before signing.
This guide prices that line properly. It sets out 2026 UK ISO 27001 consultancy day rates, fixed-price bands by headcount, how many consultant days each deliverable genuinely takes, a month-by-month timeline from first scoping call to certificate, and the preparation work that reliably removes days from the quote. Every figure below is either a published market rate, a UK government statistic, or arithmetic performed on numbers stated in this article.
Two companion guides sit either side of this one. Our ISO 27001 certification cost guide prices the whole first-year bill including audit fees and tooling, and the ISO 27001 readiness assessment checklist is the self-assessment you should run before you brief anybody. If you are still deciding whether you need the standard at all, Cyber Essentials Plus vs ISO 27001 answers that question first, because buying consultancy for a certification you did not need is the most expensive mistake in this market.
Table of contents
- The One-Minute Answer on ISO 27001 Consultancy Cost
- What ISO 27001 Consultancy Actually Buys
- ISO 27001 Consultancy Cost Benchmarks for UK Businesses in 2026
- How Many ISO 27001 Consultancy Days You Actually Need
- Five ISO 27001 Consultancy Engagement Models Compared
- The ISO 27001 Consultancy Timeline, Month by Month
- What Certification Body Fees Add to the ISO 27001 Consultancy Bill
- Preparation That Cuts Your ISO 27001 Consultancy Cost
- What a Good ISO 27001 Consultancy Proposal Contains
- Red Flags in an ISO 27001 Consultancy Quote
- Hidden Costs Sitting Next to the ISO 27001 Consultancy Fee
- The Three-Year Cost of ISO 27001 Consultancy Ownership
- Doing It Without ISO 27001 Consultancy
- Who Actually Asks You for ISO 27001, and When
- How to Run the Procurement Itself
- ISO 27001 Consultancy Questions UK Buyers Ask Most
- References and Further Reading
The One-Minute Answer on ISO 27001 Consultancy Cost
If you only read one section, read this one. The numbers below are the honest middle of the UK market in 2026, and the rest of the guide explains how each one is built.
The headline bands
A UK business of 11 to 50 people should expect an ISO 27001 consultancy engagement of roughly 18 to 32 consultant days, priced between £10,000 and £22,000 on a fixed-price basis. A micro business of under ten people can often be served in 10 to 18 days for £6,000 to £12,000. A 100 to 250 person organisation with multiple sites, in-house development or regulated data will need 45 to 70 days and £30,000 to £55,000.
The day rate that underpins it
Fair market for competent UK ISO 27001 consultancy in 2026 is £700 to £1,200 per day, with £950 a reasonable midpoint for a named senior consultant at a small specialist firm. Below about £500 a day you are buying document templates with a phone number attached. Above £1,400 you are usually paying for a brand, a fractional chief information security officer, or genuine sector specialism in finance, defence or health.
What it does not include
The ISO 27001 consultancy fee is not the certification fee. Your certification body is a separate supplier, charging separately, at £900 to £1,500 per auditor-day, and it is forbidden from doing both jobs for you. Budget the two lines independently or you will be short by several thousand pounds at exactly the wrong moment.
The single biggest variable
Scope. Not headcount, not sector, not the consultant’s brand — scope. Two 40-person companies can sit £15,000 apart on ISO 27001 consultancy purely because one scoped the certificate to a single product platform and the other scoped it to the whole company including a legacy acquisition. Everything in the preparation section of this guide is downstream of that one decision.
What ISO 27001 Consultancy Actually Buys
Before pricing anything, be clear about what you are buying, because the phrase “ISO 27001 consultancy” covers at least four different products in this market and they are not interchangeable.
The consultant is not the certification body
This is the most consequential fact in ISO 27001 consultancy, and most first-time buyers learn it late. Under ISO/IEC 17021-1, the international standard that governs bodies auditing management systems, a certification body and any entity under its organisational control shall not offer or provide management system consultancy. The organisation that builds your information security management system cannot be the organisation that certifies it. A recognised mitigation where consultancy has been provided is a two-year separation before certification, though the standard treats that as one accepted route rather than the only one.
The practical consequence is a hard budget split. You will run two procurements, sign two contracts and receive two sets of invoices. Any supplier offering to “handle the whole thing including the certificate” is either subcontracting the audit to an accredited body — fine, but you should see that contract — or is issuing a certificate nobody will accept.
The four deliverables you are really paying for
Strip away the proposals and every ISO 27001 consultancy engagement produces the same four things. First, a defensible scope statement and asset picture — what the certificate covers and what it deliberately does not. Second, a risk assessment and risk treatment plan built on a repeatable method, plus the Statement of Applicability that justifies each of the 93 Annex A controls you have applied or excluded. Third, a documented management system covering clauses 4 to 10: context, leadership, planning, support, operation, performance evaluation and improvement. Fourth, evidence that the system has actually run — internal audit records, management review minutes, corrective actions, monitoring results.
Everything else on an ISO 27001 consultancy proposal is either a route to one of those four or a comfort service. Price the four. Question the rest.
What ISO 27001 consultancy cannot do for you
No amount of ISO 27001 consultancy can operate your management system for you and leave you certified in any durable sense. Clause 5 puts accountability on top management, clause 7 requires demonstrable competence inside the organisation, and clause 9 requires management review by your leadership. An auditor who finds that every policy is signed by a consultant who left in March will write that up. The most expensive failure mode in this market is a beautifully documented system nobody inside the business can explain.
Where the fee sits in the total bill
For a typical UK SME reaching certification for the first time, external ISO 27001 consultancy is between 45 and 65 per cent of the year-one cash cost. Certification body fees are usually 20 to 30 per cent, tooling 5 to 20 per cent, and remediation whatever your gap analysis says it is. Internal staff time, which nobody invoices, routinely exceeds all of it.
| Job | Your consultant | Your certification body | Only you |
|---|---|---|---|
| Define the scope | Advises and drafts | Reviews at Stage 1 | Owns the decision |
| Risk assessment | Supplies method, facilitates | Tests it | Accepts the risks |
| Write policies | Drafts them | Never | Approves and follows them |
| Implement controls | Designs and advises | Never | Operates them |
| Internal audit | Can perform it | Never | Commissions it |
| Management review | Can facilitate | Tests it | Must attend and decide |
| Stage 1 and Stage 2 audit | Supports you through it | Performs it | Answers the questions |
| Issue the certificate | Cannot, ever | Only they can | Receives it |
Why the standard itself is a separate purchase
The text of ISO/IEC 27001:2022 is copyrighted and sold. So is ISO/IEC 27002, the implementation guidance you will want beside it. ISO 27001 consultancy firms normally hold licensed copies, but your internal auditor and your ISMS manager need their own access, and that is a small line nobody puts in the quote. Ask whether copies are included before you assume they are.
ISO 27001 Consultancy Cost Benchmarks for UK Businesses in 2026
Here are the ISO 27001 consultancy numbers. Treat them as the middle of the distribution, not as quotes, and read the scope caveats that follow.
UK day rates by consultant type
The ISO 27001 consultancy spread in this market is wide, and the top and bottom of it are buying genuinely different things. The figures below reflect 2026 UK pricing for information security and cybersecurity advisory work.
| Who you are hiring | Typical UK day rate | What you get | Best used for |
|---|---|---|---|
| Template vendor with support | Under £500 | Documents plus email help | Confident in-house teams only |
| Independent consultant | £600–£900 | One experienced person, no bench | Micro and small businesses |
| Specialist consultancy, standard grade | £850–£1,100 | Named consultant plus QA review | Most SME certifications |
| Specialist consultancy, senior grade | £1,100–£1,400 | Lead implementer, audit experience | Complex or regulated scope |
| Fractional CISO retainer | £1,200–£1,800 | Ongoing accountable security lead | Businesses with no security function |
| Big-four or global brand | £1,500–£2,500 | Methodology, brand, junior delivery | Group-wide or investor-driven work |
The contractor benchmark nobody quotes you
There is a public reality check available. ITJobsWatch tracked 517 daily rates quoted for UK contract roles requiring ISO/IEC 27001 skills in the six months to 20 August 2026. The median was £550 per day, with the 25th percentile at £487 and the 75th at £650. The 90th percentile reached £750. That median was flat year on year and down from £584 in 2024.
That figure is the labour cost, not the ISO 27001 consultancy price. The gap between £550 and a £950 ISO 27001 consultancy day rate pays for pre-built method and templates, quality review, holiday and sickness cover, professional indemnity insurance, and the fact that the firm has done this eighty times. Whether that gap is worth £400 a day depends entirely on whether you can manage a contractor yourself. If you have no internal ISMS experience, it usually is. If you do, hiring the contractor directly is the cheapest competent route in the market.
Fixed-price bands by headcount
Most UK ISO 27001 consultancy for businesses under 250 people is sold as a fixed-price implementation package rather than an open day rate. The bands below assume a single certificate scope, one primary location, standard commercial data and no regulated sector overlay.
| Organisation size | Consultant days | Fixed-price band | Your internal hours | Elapsed time |
|---|---|---|---|---|
| 1–10 people | 10–18 | £6,000–£12,000 | 60–110 | 4–7 months |
| 11–50 people | 18–32 | £10,000–£22,000 | 110–200 | 6–9 months |
| 51–100 people | 30–45 | £18,000–£32,000 | 180–320 | 7–11 months |
| 101–250 people | 45–70 | £30,000–£55,000 | 300–500 | 9–14 months |
| Multi-site or regulated | Add 30–60% | Quote individually | Add 40% | Add 2–4 months |
What pushes you to the top of a band
Five things, in rough order of impact. In-house software development, because Annex A’s technological controls on secure development, change control and separation of environments all become live. Multiple physical sites, because physical controls must be evidenced at each. Regulated or special category personal data, because the risk assessment gets longer and the auditor gets more curious. Recent acquisitions running separate systems. And a deadline imposed by a customer contract, because compressing an ISO 27001 consultancy programme costs money exactly the way compressing any project does.
What pulls you to the bottom
A tight single-product scope. An existing Cyber Essentials certification, which already evidences several technical controls. A cloud-first estate with few servers of your own. Documented processes that already exist for another reason, such as a quality standard or a customer security questionnaire you answer regularly. And, more than anything, one internal owner with enough authority and time to make decisions the week they are asked for.
How Many ISO 27001 Consultancy Days You Actually Need
Day counts are more useful than ISO 27001 consultancy prices, because they survive negotiation. If you know the job takes 21 days, you can evaluate a £14,000 quote and a £26,000 quote on the same basis.
Days by deliverable
The table below is the shape of a typical 11-to-50-person implementation. Every ISO 27001 consultancy will label these differently; the work underneath is the same.
| Deliverable | Consultant days | Your hours | Can you do it yourself? |
|---|---|---|---|
| Scoping and kick-off | 1–2 | 8–12 | Partly — decide, then validate |
| Gap analysis against all 93 controls | 2–4 | 10–16 | Yes, with a checklist |
| Asset, data and supplier inventory | 1–3 | 20–40 | Yes — always do this yourself |
| Risk assessment and treatment plan | 3–5 | 16–30 | Rarely well, first time |
| Statement of Applicability | 1–2 | 6–10 | No, if you value your Stage 1 |
| Policy and procedure set | 4–6 | 20–40 | Templates yes, tailoring no |
| Control implementation support | 2–5 | 40–120 | The work is yours regardless |
| Awareness training delivery | 1–2 | Everyone, 1 hour | Yes, if you have material |
| Internal audit | 2–3 | 10–20 | Not by the person who built it |
| Management review facilitation | 0.5–1 | Board, half a day | Yes, with an agenda |
| Stage 1 and Stage 2 audit support | 2–3 | 30–50 | Possible but stressful |
The two lines worth arguing about
Look at the inventory row and the control implementation row. Both carry large internal hour counts and small consultant day counts, and both are where ISO 27001 consultancy quotes quietly inflate. If a proposal charges five days to build an asset inventory, it is charging you to interview your own staff about systems you already pay for. Produce that list before the engagement starts and you will remove two to four days from almost any quote.
A worked example: 45 people, one platform, two demanding customers
Take a concrete case. A UK software and data services company employs 45 people, one office with most staff remote, 62 laptops, one production environment with a cloud provider, 11 material SaaS platforms and three developers carrying an on-call rota. Two enterprise customers have made ISO 27001 a renewal condition with an eleven-month deadline. There is no security manager; the CTO is the de facto owner.
That business sits in the 11-to-50 band, but the in-house development pushes it to the upper half: 21 consultant days for a full-service ISO 27001 consultancy engagement. At the £950 standard-grade rate that is £19,950, which a firm would typically round to a fixed price near £19,500.
The same business bought four ways
The 21-day figure is one route, not the only one. The same certificate is reachable four ways, and the cash difference is large.
| Route | Consultant input | External cost | Internal hours | Elapsed |
|---|---|---|---|---|
| A — Toolkit plus coaching | 9 days at £950 | £8,550 | 300–400 | 10 months |
| B — Platform plus advisory days | 16 days at £950 plus £7,200 licence | £22,400 | 180–250 | 8 months |
| C — Full-service fixed price | 21 days, fixed | £19,500 | 110–160 | 6 months |
| D — Fractional CISO retainer | 3 days a month for 9 months at £1,100 | £29,700 | 120–180 | 9 months |
Reading that comparison honestly
Route A is £21,150 cheaper than route D in cash and roughly 250 internal hours more expensive in time. At a fully loaded internal cost of £45 an hour, those extra hours are worth about £11,250 — so the true gap narrows to under £10,000, and route A also delivers four months later, which in this scenario breaks a customer deadline. That is the real ISO 27001 consultancy trade-off: cash against calendar against internal capacity. Only one of those three is on the invoice.
Five ISO 27001 Consultancy Engagement Models Compared
The route names above map to five recognisable ISO 27001 consultancy models. Knowing which one a proposal belongs to tells you more than the number at the bottom.
Model one: fixed-price full implementation
The ISO 27001 consultancy commits to a scope, a deliverable list and a price, and carries the risk of overrun. This is the dominant SME model and it is usually the right default. The failure mode is a thin deliverable list that lets the supplier declare victory early. Insist that “certification-ready” is defined as a successful Stage 1 with no major nonconformities.
Model two: pure day-rate advisory
You buy a block of days and direct them. Cheapest per unit, and excellent if you have a capable owner internally. The failure mode is drift: without a deliverable schedule, ten days becomes eighteen with nobody quite able to say when that happened. Buy day-rate ISO 27001 consultancy against a written plan, or do not buy it at all.
Model three: toolkit plus coaching
You license a documentation set and buy a small number of review and coaching days. Cheapest total cash, heaviest internal load. It works when someone in the business genuinely has a day a week free for eight months. It fails, expensively and invisibly, when they do not — the templates sit at 60 per cent complete until a customer deadline forces a panic purchase of full-service ISO 27001 consultancy at a worse price than the original quote.
Model four: compliance platform plus advisory days
A software platform supplies the control framework, policy scaffolding, evidence collection and audit workspace; ISO 27001 consultancy is retained for the parts software cannot do — scoping, risk workshops, the Statement of Applicability, internal audit. For most 20 to 100 person UK businesses this is the best value model available. Two cautions: buy the platform after scoping rather than before, and remember the licence is an annual cost while the consultancy is not.
Model five: fractional CISO or ongoing retainer
You hire a part-time senior security leader who happens to drive the certification as one objective among several. The most expensive route to a certificate and often the best value business decision, because you also get vendor security reviews, incident management readiness, board reporting and customer questionnaire responses. Judge this one on the whole security function, not on the ISO 27001 consultancy line alone.
| Model | Cash cost | Internal load | Speed | Knowledge left behind | Main risk |
|---|---|---|---|---|---|
| Fixed-price full implementation | High | Low | Fastest | Weakest | Thin deliverable list |
| Day-rate advisory | Medium | High | Variable | Good | Scope drift |
| Toolkit plus coaching | Lowest | Highest | Slowest | Strong | Stalls at 60 per cent |
| Platform plus advisory | Medium-high | Medium | Fast | Strongest | Annual licence lock-in |
| Fractional CISO retainer | Highest | Low | Steady | Good while retained | Dependency on one person |
The ISO 27001 Consultancy Timeline, Month by Month
Elapsed time is not ISO 27001 consultancy days. A 21-day engagement does not take 21 days; it takes six to nine months, because the management system has to be seen operating before anyone can audit it.
Why the calendar cannot be fully compressed
Clause 9 requires internal audit and management review, and Stage 2 tests whether controls have actually run. An auditor wants to see access reviews performed, incidents logged, suppliers assessed and training delivered — with dates. Three months of operating evidence is the practical floor, and many auditors prefer more. No amount of ISO 27001 consultancy removes that constraint; it only removes the delays either side of it.
Month 0: scoping and supplier selection
Two to four weeks. You write a draft scope statement, gather your asset and supplier lists, decide on a certification body shortlist and brief three ISO 27001 consultancy firms on identical information. This month costs nothing and saves more than any other.
Months 1 to 2: gap analysis and project setup
Your ISO 27001 consultancy reviews all 93 Annex A controls plus clauses 4 to 10 against what exists today, and produces a prioritised remediation list with owners. You get your first honest view of the remediation budget here — and it is the moment to renegotiate scope if the number is uncomfortable.
Months 2 to 4: risk assessment, treatment plan and Statement of Applicability
The intellectual core of the ISO 27001 consultancy engagement. Asset and threat identification, a repeatable scoring method, risk owners, treatment decisions, and the Statement of Applicability that records the justification for every applied and excluded control. Expect two or three workshops with real attendance from people who own systems.
Months 3 to 6: documentation and control implementation
Policies and procedures are drafted and tailored in parallel with technical remediation: multi-factor authentication, logging, backup verification, joiner-mover-leaver process, supplier assessments, secure development practice. This is where your internal hours peak and where projects slip, because the work belongs to busy people with other jobs.
Months 5 to 8: operating the system and collecting evidence
The system runs. Access reviews happen on schedule. Incidents get logged even when they are trivial. Training is delivered and recorded. Nothing exciting happens, and that is exactly the point — evidence of routine operation is what Stage 2 buys.
Months 7 to 9: internal audit, corrective action and management review
An internal audit against the full standard, performed by somebody independent of the build. Findings are raised, corrected and closed. Then a management review with genuine leadership attendance, minuted, covering performance, risks, resources and improvement. Auditors read these minutes closely.
Months 8 to 11: Stage 1, Stage 2 and the certificate
Stage 1 is the documentation and readiness review, usually remote and often a single day. Stage 2 follows four to eight weeks later and tests operation. Minor nonconformities are normal and are usually closed with evidence within 30 to 90 days; a major nonconformity means a return visit. The certificate is typically issued two to six weeks after the audit report is accepted.
The four things that actually cause delay
Not the ISO 27001 consultancy. In order: an undecided scope that keeps moving; a risk owner who will not attend workshops; remediation that turns out to need capital expenditure nobody budgeted; and certification body availability, which in a busy quarter can add six to ten weeks between booking and Stage 2. Book the audit slot early — provisionally, if necessary.
| Phase | Typical window | Consultant days | Who leads | Slips when |
|---|---|---|---|---|
| Scoping and selection | Month 0 | 0–1 | You | Scope keeps changing |
| Gap analysis | Months 1–2 | 2–4 | Consultant | Systems owners unavailable |
| Risk assessment and SoA | Months 2–4 | 4–7 | Joint | No named risk owners |
| Documentation and controls | Months 3–6 | 6–11 | Joint | Remediation needs budget |
| Operating evidence | Months 5–8 | 0–2 | You alone | Nobody runs the routines |
| Internal audit and review | Months 7–9 | 2–4 | Independent auditor | Leadership will not attend |
| Stage 1 and Stage 2 | Months 8–11 | 2–3 | Certification body | No audit slot booked |
What Certification Body Fees Add to the ISO 27001 Consultancy Bill
The audit half of the budget behaves completely differently from the ISO 27001 consultancy half. It is derived, not negotiated, and it repeats every year.
How audit days are calculated
Unlike ISO 27001 consultancy, certification bodies do not invent the duration. Audit time is derived from published requirements for bodies certifying information security management systems, based on the number of people doing work under the organisation’s control within scope, then adjusted for complexity, risk, sites and how much can be done remotely. An audit day normally means eight hours, and the published table explicitly must not be used in isolation — complexity adjustments are part of the method.
| Effective personnel | Stage 1 | Stage 2 | Initial total | Surveillance (each) | Recertification |
|---|---|---|---|---|---|
| 1–10 | 0.5–1 day | 1.5–2 days | 2–3 days | 1–1.5 days | 1.5–2 days |
| 11–25 | 1 day | 2.5–3 days | 3.5–4 days | 1.5 days | 2.5–3 days |
| 26–45 | 1–1.5 days | 3.5–4 days | 4.5–5.5 days | 2 days | 3–3.5 days |
| 46–125 | 1.5–2 days | 4.5–6 days | 6–8 days | 2–3 days | 4–5.5 days |
| 126–250 | 2 days | 6.5–8 days | 8.5–10 days | 3–3.5 days | 6–7 days |
Audit day rates in the UK
UK certification bodies commonly charge somewhere between £900 and £1,500 per auditor-day, with the larger international names sitting at the top of that band. Our worked 45-person example falls in the 26 to 45 row: five days for initial certification at £1,150 a day is £5,750, plus an annual certificate maintenance charge that typically runs £400 to £1,200.
Accredited or not, and why it matters to the quote
A certificate from a body accredited by a recognised national accreditation body carries an accreditation mark and is the version enterprise procurement teams expect. No amount of ISO 27001 consultancy changes that. An unaccredited certificate is cheaper and legally saleable, and it is exactly what “certification from £2,995” advertisements are offering. If a customer contract is driving your programme, the cheap route is not cheaper — it is a certificate you will replace within a year.
The three-year cycle
Certification runs in three-year cycles: initial audit, then a surveillance audit in each of years two and three, then recertification. Your ISO 27001 consultancy spend collapses after year one, but your certification body spend does not. That asymmetry is why comparing suppliers on year-one cash alone is misleading.
Preparation That Cuts Your ISO 27001 Consultancy Cost
This is the section that saves money. Every item below is work you can do before the ISO 27001 consultancy starts, and each one removes billable time or prevents a scope change later.
1. Write the scope statement yourself first
Decide, in writing, which legal entities, locations, teams, products and information systems the certificate covers. Then decide what it excludes and why. This single page is the difference between a 21-day ISO 27001 consultancy engagement and a 34-day one, and you are far better placed than any consultant to draft it.
2. Build the asset, data and supplier inventories
Three lists: information assets and where they live; personal and commercially sensitive data flows; and every supplier with access to your systems or data. This is 20 to 40 internal hours that would otherwise be billed to you at ISO 27001 consultancy rates, and you will need the lists forever afterwards anyway.
3. Run a free self-assessment before you brief anyone
Score yourself against the standard’s clauses and Annex A themes honestly. Our ISO 27001 readiness assessment checklist is built for this. Arriving at a scoping call with a completed self-assessment changes the conversation from discovery to planning, and discovery is billable.
4. Finish Cyber Essentials first if you have not
Cyber Essentials certification costs a few hundred pounds and evidences firewalls, secure configuration, access control, malware protection and update management. Those are real Annex A technical controls with real evidence attached. It also forces the asset discovery you need anyway, at a fraction of an ISO 27001 consultancy day rate.
5. Fix the obvious technical gaps before the gap analysis
Multi-factor authentication everywhere it is available. Backups that have been restored, not just taken. A joiner-mover-leaver checklist that is actually followed. Patching within a defined window. Every one of these found by your ISO 27001 consultancy becomes a remediation item on a plan you pay to be managed.
6. Name one internal owner with real authority
Not a committee. One person, with allocated time — half a day a week minimum for a small business — and enough authority to make a decision without escalating. ISO 27001 consultancy programmes without this owner are the ones that consume their contingency days by month four.
7. Get three quotes against one identical written brief
Send the same scope statement, headcount, site list, system list and deadline to three suppliers. Ask each for a day count by deliverable, not just a total. The variation you see in day counts is far more informative than the variation in prices, and it exposes who has actually read your brief.
8. Book the certification body before you finish the build
Availability is a real constraint. Getting a provisional Stage 1 date in the diary at month three costs nothing and protects your deadline. It also focuses the programme, because a real date does what no project plan can.
9. Decide about tooling after scoping, never before
Compliance platforms genuinely reduce ISO 27001 consultancy days and internal hours, but only when bought against a known scope and control set. Bought first, they become an expensive filing cabinet you configure twice.
10. Keep evidence from day one
Every access review, every incident, every training session, every supplier assessment — recorded with a date, from the beginning. Retrofitting three months of evidence in week 30 is the single most common reason a certification programme buys emergency ISO 27001 consultancy days at short notice.
| Preparation step | Your effort | Consultant days saved | Value at £950/day |
|---|---|---|---|
| Draft the scope statement | 4–8 hours | 1–2 | £950–£1,900 |
| Asset, data and supplier inventories | 20–40 hours | 2–4 | £1,900–£3,800 |
| Self-assessment before briefing | 6–10 hours | 1 | £950 |
| Cyber Essentials already held | Separate project | 2–3 | £1,900–£2,850 |
| Obvious technical gaps closed | Varies | 1–3 | £950–£2,850 |
| Named owner with allocated time | Half a day a week | 2–5 | £1,900–£4,750 |
| Evidence kept from day one | 1–2 hours a week | 1–3 | £950–£2,850 |
What that adds up to
Taken together, thorough preparation removes 10 to 21 ISO 27001 consultancy days from a mid-sized engagement — between £9,500 and £19,950 at the standard grade rate. On the 21-day worked example, preparation is not a marginal saving. It is potentially the difference between the full-service price and the coaching price, for the same certificate.
What a Good ISO 27001 Consultancy Proposal Contains
ISO 27001 consultancy proposals look alike and differ enormously. Here is what to check, in the order it matters.
A deliverable list, not a phase list
“Phase 2: Documentation” is not a deliverable. “Information security policy, 11 supporting procedures, Statement of Applicability covering all 93 Annex A controls, risk register with named owners, internal audit programme” is. If you cannot tick items off a list, you cannot tell whether you have been delivered to.
Named people and their day allocation
Who is doing the work, at what grade, for how many days each? A proposal quoting a senior lead implementer and delivering a junior with a template pack is the most common quality complaint in ISO 27001 consultancy, and it is trivially prevented by naming people in the contract.
Explicit acceptance criteria tied to the audit
The ISO 27001 consultancy should end at a defined point: Stage 1 passed with no majors, or Stage 2 passed, or certificate issued. Whichever you choose, write it down. “Certification-ready” without a definition means whatever the supplier needs it to mean in month seven.
What happens if a nonconformity is raised
Minor nonconformities at Stage 2 are normal. Who writes the corrective action, who evidences closure, and is that inside the fee? A good ISO 27001 consultancy proposal answers this without being asked. A weak one bills it as additional days at the worst possible moment.
Handover, training and the exit test
Ask for a named handover session and documented training for your internal owner. Then apply the exit test: if this ISO 27001 consultancy vanished the day after certification, could we run the surveillance audit ourselves? If the honest answer is no, you have bought a certificate rather than a management system, and year two will be expensive.
Contract terms worth insisting on
A fixed price with a defined change mechanism. Travel and expenses capped or included. Intellectual property in the delivered documentation assigned to you — not licensed. A day rate for additional work agreed in advance. Professional indemnity insurance evidenced. And a clear statement that the supplier provides no certification services, which protects the impartiality position of your certification body.
Red Flags in an ISO 27001 Consultancy Quote
Some ISO 27001 consultancy warning signs are worth walking away over. These are the ones that show up repeatedly in the UK market.
“Certification guaranteed”
No ISO 27001 consultancy can guarantee an outcome controlled by an independent auditor. What they can guarantee is remedial work at no charge if their deliverables cause a nonconformity — which is a meaningful commitment. Treat the word “guaranteed” as an invitation to read the clause behind it.
A single price with no day count
If a supplier will not tell you how many days they have priced, they are protecting a margin, an assumption, or both. Every credible ISO 27001 consultancy proposal can be broken into days by deliverable, because that is how it was costed internally.
The supplier who also sells the audit
Revisit the impartiality rule. A firm offering implementation and certification from the same group either misunderstands ISO/IEC 17021-1 or is relying on you not to check. Either way, your enterprise customer’s procurement team will check.
Certification in six weeks
Physically impossible if the certificate is accredited, because Stage 2 must see the system operating. Anyone promising it is selling either an unaccredited certificate or a Stage 2 you will fail.
A price far below the band
An £3,500 quote for a 60-person implementation is not a bargain; it is a template pack, five hours of calls and an invoice for “additional days” beginning in month three. The cheapest genuinely competent route in this market is not cheap ISO 27001 consultancy — it is a good toolkit plus a capable internal owner.
No named consultant, no CV
Ask who will do the work and for their background: lead implementer or lead auditor qualifications, sectors, number of certifications delivered. Reluctance here tells you the delivery model is a bench of juniors and a template library.
Pressure to buy the platform first
Compliance software sold before scoping is sold on commission, not need. Any adviser recommending a platform before they know your scope is telling you something about their business model.
The ISO 27001 consultancy fee is one line among several, and the others surprise people.
Remediation you cannot price until you look
The gap analysis produces a remediation list, and that list can contain anything from a £30 password manager to a £25,000 network segmentation project. Nobody can price it in advance, which is why the gap analysis should come before you commit to a total programme budget.
Security testing
Annex A expects technical vulnerabilities to be managed, and enterprise customers frequently expect an annual test regardless of the standard. UK penetration testing for a small web application and external estate typically runs £3,000 to £8,000. Our guide to what a cyber security audit costs breaks down the five different products sold under that phrase, several of which get bundled into an ISO 27001 consultancy quote without being named.
Tooling and licences
A compliance platform for a 50-person business commonly runs £5,000 to £12,000 a year. Add a password manager, an MDM tool for company mobiles, log retention, and a vulnerability scanning subscription — individually small, collectively material, and all recurring.
Internal staff time
The largest cost and the only one with no invoice. On the 21-day worked example, 110 to 160 internal hours at a loaded £45 an hour is £4,950 to £7,200 of real cost, and the coaching route triples it.
Training and competence evidence
Clause 7 requires competence. Expect an internal auditor course at £600 to £1,500 per person, plus awareness training for everyone, plus records proving both happened.
Surveillance and the years after
Year two and year three are not free. Budget the surveillance audit, the certificate maintenance fee, the platform licence, and two to four support days if you want help with the audit.
| Cost line | Typical UK range | Recurring? | In most consultancy quotes? |
|---|---|---|---|
| Consultancy implementation | £6,000–£55,000 | No | Yes |
| Certification body audit | £3,000–£12,000 | Yes | No — separate supplier |
| Certificate maintenance fee | £400–£1,200 | Yes | No |
| Compliance platform licence | £5,000–£12,000 | Yes | Sometimes, as a bundle |
| Security testing | £3,000–£8,000 | Usually annual | Rarely |
| Remediation projects | £0–£25,000+ | No | Never |
| Internal auditor training | £600–£1,500 per person | Occasionally | Sometimes |
| Internal staff time | £5,000–£20,000 equivalent | Yes | Never |
The Three-Year Cost of ISO 27001 Consultancy Ownership
ISO 27001 consultancy is a year-one cost, but certification is a three-year commitment with a very uneven cash profile. Here is the worked example carried through the full cycle.
Year one
Full-service ISO 27001 consultancy at £19,500, plus five certification body days at £1,150 (£5,750), plus a £700 certificate maintenance fee. Year one external cash: £25,950.
Year two
The system runs itself, mostly. Two surveillance audit days at £1,150 (£2,300), the maintenance fee (£700), and two ISO 27001 consultancy support days for audit preparation at £950 (£1,900). Year two external cash: £4,900.
Year three
Recertification is heavier than surveillance: three audit days at £1,150 (£3,450), the maintenance fee (£700), and two support days (£1,900). Year three external cash: £6,050.
The honest three-year total
£25,950 plus £4,900 plus £6,050 is £36,900 over three years, or £12,300 a year averaged. Year one carries 70 per cent of it. That profile is why the “cheapest quote” instinct misleads: a £4,000 saving in year one that leaves you unable to run your own surveillance audit costs more than it saved by year three.
What changes the profile most
Whether knowledge stayed in the business. A business that can run its own internal audit, chair its own management review and answer the auditor directly needs zero support days in years two and three, taking the three-year total to £33,100. A business wholly dependent on its supplier will buy four to six days a year forever, adding roughly £4,000 to £5,700 annually.
Doing It Without ISO 27001 Consultancy
Not every business needs to buy ISO 27001 consultancy, and it is worth being honest about when the do-it-yourself route works.
When in-house genuinely works
You have someone who has implemented a management system before — ISO 27001, ISO 9001 or a comparable regime — and they have a day a week for eight months. You have a simple, cloud-first estate. Your scope is narrow. Nobody is holding a contract deadline over you. Under those conditions a good toolkit and a couple of ISO 27001 consultancy review days will get you there.
What it really costs
Toolkit licences run £500 to £2,500 with no ISO 27001 consultancy attached. Two to four review days at £950 is £1,900 to £3,800. Internal auditor training for one person is £600 to £1,500. Add a certification body at £5,000 or so, and the external cash sits near £9,000 — against 300 to 400 internal hours, worth £13,500 to £18,000 at a loaded rate.
The failure mode to watch for
Stalling. The in-house route almost never fails at the audit; it fails at month five, at about 60 per cent complete, when the owner’s day job reasserts itself. The rescue purchase — full-service ISO 27001 consultancy against a now-urgent deadline — costs more than the original quote and buys a worse outcome. If you are going in-house, set a checkpoint at month three and be honest at it.
The middle path most businesses should take
Do the inventories, the scope statement and the self-assessment yourself. Buy the risk assessment, the Statement of Applicability, the internal audit and the audit support. That is roughly 9 to 12 days of ISO 27001 consultancy instead of 21, it keeps the knowledge in the building, and it puts external help exactly where judgement matters most.
Who Actually Asks You for ISO 27001, and When
Understanding the demand side tells you how much urgency, and therefore how much ISO 27001 consultancy budget, is justified.
Enterprise and public sector procurement
The dominant driver. Large customers ask for it in supplier due diligence and renewal cycles, and increasingly write it into contracts. Certificates are verifiable through accreditation body directories, so claiming to be “aligned with” the standard rarely survives a procurement review.
The regulatory direction of travel
The UK’s Cyber Security and Resilience (Network and Information Systems) Bill completed its Commons stages on 25 June 2026 and moved to the Lords, with Royal Assent expected late in 2026. It is the most significant reform of UK cyber law since the 2018 NIS Regulations, and it pulls managed service providers, data centres and designated critical suppliers into a statutory regime. Alongside it, the government’s Cyber Governance Code of Practice, published on 8 April 2025, sets out what boards are expected to do about cyber risk. Neither mandates ISO 27001 — but both raise the questions that a certified management system answers on paper.
What the national picture looks like
The 2025/2026 Cyber Security Breaches Survey found 43 per cent of UK businesses experienced a breach or attack in the previous 12 months, 31 per cent had a board member with explicit responsibility for cyber security, and 27 per cent named external cyber security or IT consultants as their most common source of advice. Cyber Essentials certification was held by 5 per cent of businesses, rising to 35 per cent of large businesses.
How many organisations hold the certificate
The ISO Survey 2024 counted 96,709 valid ISO/IEC 27001 certificates worldwide across 179,877 sites, with 4,455 in the United Kingdom — fourth globally behind China, India and Japan. Global volume grew from 36,362 certificates in 2019 to 71,549 in 2022 to 96,709 in 2024.
The transition that already happened
Every ISO 27001:2013 certificate expired on 31 October 2025 under the accreditation transition deadline. If a supplier’s material still refers to 114 controls in 14 domains, it is describing the withdrawn version. The current standard has 93 Annex A controls in four themes: 37 organisational, 8 people, 14 physical and 34 technological. Ask any prospective ISO 27001 consultancy to describe your Statement of Applicability in those terms and you will learn quickly how current they are.
How to Run the Procurement Itself
Buying ISO 27001 consultancy well is a process, and it takes about a fortnight of your time.
Step one: the written brief
One page. Scope statement, headcount in scope, sites, systems, whether you develop software, what certifications you already hold, your deadline and its origin, and who your internal owner is. Send the identical document to every supplier.
Step two: ask for days by deliverable
Request the same table this guide uses: deliverable, ISO 27001 consultancy days, your hours. Suppliers who decline are telling you something. Suppliers whose day counts differ by a factor of two are making different assumptions about your scope, and finding out which is the whole point of the exercise.
Step three: interview the actual consultant
Not the salesperson. Fifteen minutes with the ISO 27001 consultancy staff who will do the work. Ask how they would scope your business, what they would exclude, and what usually goes wrong at Stage 2. You will know within ten minutes whether they have done this before.
Step four: check references in your sector and size band
Two references, both certified within the last 18 months, both roughly your size. Ask them one question above all others: could you run the surveillance audit without them? The answer tells you what the engagement actually left behind.
Step five: negotiate terms, not the headline number
The ISO 27001 consultancy day rate has limited give. The deliverable list, the payment schedule, the IP assignment, the corrective-action commitment and the handover session all have plenty. Those terms are worth more than a five per cent discount, and this is true of any technology consulting purchase, not just this one.
Where an IT partner fits
If you already work with an IT consulting firm or managed provider, they are frequently the right people to do the technical remediation even when a specialist runs the certification programme. Splitting the work that way — specialist for the management system, incumbent for the estate — usually costs less than either party doing both, because neither is learning your environment from scratch.
ISO 27001 Consultancy Questions UK Buyers Ask Most
Is ISO 27001 consultancy tax deductible?
ISO 27001 consultancy fees incurred wholly and exclusively for the trade are normally an allowable business expense, and certification costs are generally treated as revenue rather than capital. Confirm the treatment with your accountant, particularly where remediation involves capital equipment.
Can we certify just one product or team?
Yes, and it is usually the smartest move. Scope must be defensible and clearly stated on the certificate, and customers do read it. A narrow first certificate followed by a scope extension at recertification is a well-trodden ISO 27001 consultancy path and it materially reduces year-one cost.
How much does a gap analysis cost on its own?
Two to four days at your ISO 27001 consultancy day rate — roughly £1,500 to £4,800 for most SMEs. Some larger firms sell a formal gap assessment as a packaged product from around £8,500, which typically includes deeper technical review and a costed remediation plan.
Do we need a full-time information security manager?
Not for certification. You need a named owner with allocated time and demonstrable competence, supported by ISO 27001 consultancy where judgement is needed. Many certified UK SMEs run the system with a part-time internal owner plus a few external days a year, which is far cheaper than a permanent hire.
Will a compliance platform replace the consultant?
No, but it changes the mix. Platforms are strong at evidence collection, control mapping and audit workspace, and weak at judgement — scope, risk appetite, exclusions, and the awkward conversations about what you are genuinely not going to do. Expect a platform to cut ISO 27001 consultancy days by 20 to 40 per cent, not to zero.
What happens if we fail Stage 2?
You almost certainly will not fail outright. Minor nonconformities are routine and are closed with evidence, usually within 30 to 90 days. A major nonconformity suspends the process until it is fixed and re-audited, which costs additional auditor days and delays the certificate by months.
Can the same firm do the internal audit and the implementation?
It is permitted but not ideal, and auditors notice. Clause 9.2 requires internal audits to be objective and impartial, and someone auditing their own documentation is neither. Using a second ISO 27001 consultancy for one to two days is a small cost that removes an easy finding.
How far ahead should we start before a customer deadline?
Nine months for comfort, six months minimum with full-service ISO 27001 consultancy and a cooperative business, and less than that only with an already-mature security posture. If your deadline is closer than six months, tell prospective suppliers immediately — it changes the model they should propose, and an honest one will say so.
Is it worth it for a business under ten people?
Sometimes. If enterprise contracts are genuinely gated on it, a micro business can certify a narrow scope for £6,000 to £12,000 of ISO 27001 consultancy plus two to three audit days. If nobody has asked, Cyber Essentials plus a well-run set of basic controls answers 90 per cent of the questions at a fraction of the cost.
What should we do first, today?
Write the scope statement. Then run the readiness self-assessment. Then, and only then, brief three suppliers on identical information. Those three steps take a fortnight, cost nothing, and reliably remove five figures from the ISO 27001 consultancy quotes you receive.
References and Further Reading
NCSC — Risk Management Guidance
NCSC — Cyber Security Toolkit for Boards
NCSC — 10 Steps to Cyber Security
NCSC — Small Organisations Guide to Cyber Security
NCSC — Supply Chain Security Guidance
NCSC — Cyber Assessment Framework
NCSC — Incident Management Collection
NCSC — Vulnerability Management Collection
NCSC — Cyber Essentials Overview
IASME — Cyber Essentials Scheme
GOV.UK — Cyber Governance Code of Practice
GOV.UK — Cyber Security Breaches Survey Collection
GOV.UK — Cyber Security Breaches Survey 2025/2026
UK Parliament — Cyber Security and Resilience (Network and Information Systems) Bill
House of Commons Library — Cyber Security and Resilience Bill Briefing
ICO — A Guide to Data Security
ICO — Accountability and Governance
Legislation.gov.uk — Data Protection Act 2018
Global Accreditation Cooperation — Mandatory Documents
International Accreditation Forum — Archive
ISO27k Toolkit and Standards Commentary
ITJobsWatch — UK ISO/IEC 27001 Contract Rates
CIS — Critical Security Controls
NIST — SP 800-53 Rev. 5 Security and Privacy Controls
NIST — Cybersecurity Framework
