How to Choose an ISO 27001 Consultant in the UK (2026 Buyer's Guide)

For a UK SaaS founder, the real purchase is not a folder of policies. It is help building an information security management system (ISMS) that reflects the service you sell, the risks you face and the evidence your team can maintain. Certification may help with enterprise procurement, but the consultant's job is to make the underlying controls useful and auditable, not to decide the audit outcome.

Before requesting proposals, identify your likely ISMS boundary and who can answer questions about engineering, people operations, suppliers and customer data. If you are still deciding whether certification is appropriate, start with the ISO 27001 guide for startups. This buyer's guide focuses on comparing proposals once you have a reason to explore implementation.

What should an ISO 27001 consultant actually do?

ISO 27001 sets requirements for establishing, operating and improving an ISMS. Consultancy can range from a short gap review to hands-on support with risk assessment, control design, documentation, evidence collection, management review and audit preparation. Those are very different purchases. Ask for a list of deliverables that says whether the adviser will explain a task, draft a document, facilitate a decision, help implement a workflow or test whether it has worked.

Your organisation remains accountable for its security decisions and the accuracy of its records. A consultant cannot approve a risk treatment on behalf of management or make an access review happen without system owners. A good engagement makes those owners visible and gives them work they can realistically sustain after the consultant leaves. Ask what happens when evidence contradicts a written policy: will the adviser help correct the practice, or simply hand over another document?

For a narrower starting point, the ISO 27001 readiness assessment guide explains how to turn gaps into a prioritised plan before committing to full implementation.

How do you set the scope before comparing quotes?

Write down the legal entity, products, locations, staff, infrastructure and suppliers you expect inside the ISMS. Include shared functions that actually support the service: development, support, incident response, HR and vendor management may matter even when the certificate is intended to describe one product. Scope is a management decision, not a trick for excluding inconvenient risks. Ask each bidder to state what they assumed and which dependencies they need to verify.

Describe your current position honestly: existing policies, access controls, cloud configuration, supplier records, incident history, customer commitments and any previous assessments. Different starting points lead to different workloads. If a proposal arrives before anyone asks about these facts, request a discovery conversation or a clearly conditional estimate. That is better than accepting a neat price for work no one has defined.

Ask which people will be needed for interviews, approvals, remediation and recurring reviews. Clarify whether the consultant will coordinate with your certification body, attend assessment discussions and help interpret findings, or whether those services are excluded. The ISO 27001 consultancy scope and cost comparison gives a useful checklist for checking the details behind competing bids.

Is a fixed fee or hourly or day rate better?

A fixed fee can be easier to budget when the boundary, deliverables, responsibilities and change process are clear. Check whether the proposed fee covers a discovery phase, implementation, internal-audit preparation, management review and support during an external audit. Read the assumptions: a fixed price based on one product or one office is not automatically a fixed price for an expanded business. Ask how additional work is agreed without leaving essential controls out.

An hourly or day rate can fit an advisory session, a discrete review or a changing project where the work cannot yet be specified. It can also leave the total uncertain if major remediation emerges. Ask for an estimated work plan, review points, approval before extra time is spent, and a clear description of the outputs from each block of work. A blended arrangement may separate an initial assessment from a scoped implementation fee.

Compare the total work, not merely the consultancy invoice. Internal engineering time, security tooling, remediation, staff training and independent certification-body charges may be separate. There is no defensible universal UK consultancy cost range for every startup. Seek itemised, indicative proposals against the same scope rather than treating any generic online number as a budget commitment.

Which questions should you ask before signing?

Use the same questions with every provider so the answers can be compared side by side. Ask for examples of how they would adapt a risk method to your service and how they decide whether a control is operating, not just documented. If they propose a template, ask who will tailor it, approve it and keep it current. Ask who will own the statement of applicability, evidence register and corrective actions after the engagement.

• What information do you need to confirm the ISMS scope and starting position?
• Which deliverables will you create with us, and which must our team complete?
• What evidence will you expect from cloud systems, suppliers and people processes?
• How do you handle control gaps that require engineering or management decisions?
• Who conducts the internal audit, and how is that person's objectivity protected?
• Which external fees and ongoing activities are excluded from this proposal?

Also ask who will actually do the work. A senior salesperson may not be the person supporting your team. Discuss how progress will be reviewed, where decisions will be recorded and what an orderly handover looks like. For EU customers, ask how the adviser distinguishes your contractual commitments from applicable legal obligations rather than asserting that ISO 27001 certification alone settles every privacy or AI governance question.

What are the red flags in a consultant's proposal?

Be cautious of wording that guarantees certification. Consultants can prepare an organisation for assessment, but only an independent certification body can certify it. An accredited certification body performs its own audit and reaches its own decision. Ask whether any quoted certification fees are direct third-party charges and whether the proposed body is appropriate to your sector and market.

A templates-only offer may be useful if you already have capable internal owners and need a starting structure, but it should not be sold as a complete operating ISMS. A policy saying that access is reviewed does not prove that reviews occurred. Look for an evidence plan that tests actual practice, identifies gaps and makes responsibilities explicit. Generic documents with your logo added are not a substitute for a risk assessment tied to your systems.

Unclear scope is another warning sign: if entities, products, locations, exclusions, deliverables and customer responsibilities are unspecified, quotes are not comparable. Be equally careful when the same individual proposes to implement controls and then audit their own work. Internal audit must be impartial and objective; discuss an independent reviewer or an arrangement that avoids reviewing one's own activities. The certification body's external audit remains separate from the consultancy engagement.

How do you judge a proposal without overbuying?

Make a simple comparison sheet with rows for ISMS boundary, risk work, implementation, evidence, internal audit, external-audit support, internal time and exclusions. Score clarity rather than the number of documents promised. A smaller scope with named responsibilities may be more useful than a long list of deliverables with no owner or acceptance criteria. Ask each provider to explain what successful handover would let your team maintain without them.

Consider your business stage. A small team may need practical help wiring controls into existing engineering and hiring processes; a more mature team might only need a review of its current ISMS and focused gap closure. If a customer is asking for assurance urgently, distinguish the immediate evidence request from the longer path to independent certification. Do not promise a customer a certificate before the external body has reached its decision.

Check whether a proposed tool is necessary. Software can organise tasks but cannot resolve unclear accountability or make unperformed activities real. A provider willing to work with your existing processes is easier to assess than one whose entire method depends on buying a particular platform.

Where does ProtectifyAI fit, and when are we not the right choice?

ProtectifyAI offers ISO 27001 implementation support for teams that want help translating requirements into owned controls and audit evidence. Discuss your scope, starting point and internal capacity before deciding whether a defined implementation engagement makes sense. Ask us the same questions you ask anyone else about deliverables, exclusions, objectivity and independent certification fees; this guide is not a substitute for comparing providers.

We may not be the right choice if you only want a document pack to file away, require someone to guarantee an audit result, or want a consultancy to act as the independent certification body. If your organisation already has a functioning ISMS and just needs an impartial internal audit, a suitably independent specialist may be a better fit than an implementation engagement. You can also choose to build internally if your team has the time and competence; a consultant should add value, not replace ownership.

What should you do next?

Put together a short brief covering your product, proposed ISMS boundary, existing controls, buyer requirements and the people available to own implementation. Send the same brief to prospective advisers. Request a written breakdown of work, dependencies, exclusions and certification-body costs; then challenge any assumptions that do not match your business. A good proposal should help you decide whether to proceed even if you choose someone else.

What do founders ask most often?