Find the right ISO 27001 consultant.
Find out what ISO 27001 consultants charge and what they can actually prove before you get on a sales call. Then pick an accredited body to certify you.
Consultant or certification body? You'll need both.
| Who | What they do | Issues the certificate? |
|---|---|---|
| Consultant | Helps you build your ISMS, from scope and risk assessment to policies and the internal audit | No |
| Certification body | Runs the Stage 1 and Stage 2 audits, then a surveillance audit each year | Yes, if accredited |
| GRC platform | Software that tracks your evidence and controls | No |
Consultants
Certification bodies
See all 0 certification bodies →
How we check firms
Sourced and dated
Each fact links to where we found it, such as an accreditation register or company record, and shows when we last checked.
Honest price labels
We tell you whether a price comes from the firm or is our own estimate, and we never mix the two.
Paid placement is labelled
Firms can pay to be seen more. They can't pay to change what we write about them.
Frequently asked questions
What does an ISO 27001 consultant do?
A consultant helps you build and run an information security management system (ISMS) that meets ISO/IEC 27001. That usually covers the scope, a gap analysis, the risk assessment and Statement of Applicability, your policies, the internal audit, and getting you ready for the certification audit.
Is a consultant the same as a certification body?
No. The consultant gets you ready, and an independent certification body audits you and issues the certificate. A certification body can't certify a system it helped build.
Do I need a consultant to get ISO 27001 certified?
No, you don't have to use one. Companies with security and compliance people in-house often do it themselves, sometimes with a GRC platform. A consultant mostly saves your team time and lowers the risk of failing the audit.
How long does ISO 27001 certification take?
It depends on your size and where you're starting from. Most of the time goes into setting up and running the ISMS before the Stage 1 (documentation) and Stage 2 (implementation) audits. After that, a certificate lasts three years, with a surveillance audit each year.
How do you choose which firms to list?
Any firm with a real ISO 27001 service gets a free profile. We check the facts against primary sources and date each check. Firms can pay for a labelled placement, but they can't buy a better write-up or a spot in our editorial picks.