This is one spoke in our ISO 27001 for startups roadmap. For a practical assessment deliverable before comparing quotes, see the ISO 27001 readiness assessment guide.
Two ISO 27001 implementation quotes can describe the same destination while leaving very different amounts of work with your team. Before comparing the price, compare the responsibilities.
This is particularly useful for a small business where the person coordinating certification also runs IT, operations or product delivery. An apparently economical proposal can require substantial internal time that has not been planned.
Ask for a clear distinction between consultancy, certification-body charges, software subscriptions, technical remediation and ongoing maintenance. Do not assume an implementation fee includes independent certification, penetration testing, additional licences or future surveillance support.
If pricing is fixed, establish the agreed scope and how material changes are handled. A new acquisition, extra location or major product change can affect the work.
An effective proposal describes who drafts, who implements and who approves. Consider access reviews: will the consultant provide a template, prepare the population, facilitate the review or also track the resulting removals? Which parts remain with managers and system administrators?
Apply the same questions to the risk assessment, supplier reviews, incident exercises and management reporting.
Ask what happens if a control has been documented but there is little operating evidence. The plan should describe how that gap is addressed, not assume that a policy proves performance.
Clarify what audit support means: preparation meetings, evidence coordination, attendance and help interpreting findings are different activities. Your organisation must still provide accurate information and retain management accountability.
| Item to compare | Question to ask |
|---|---|
| ISMS scope | Which entities, services, locations and systems are included? |
| Implementation | What will the consultant do directly with our team? |
| Internal workload | Which owners are needed, and for which activities? |
| Assurance | How will internal-audit objectivity be maintained? |
| Commercial boundaries | Which fees and third-party activities are excluded? |
| Ongoing support | What happens after the initial assessment or certificate? |
A timetable should account for the starting position, management availability, remediation dependencies and external assessment scheduling. Ask what assumptions make it achievable and what would change it.
An ISO 27001 consultancy quote is easier to judge when it tells you what you will receive and what your team must contribute. There is no need for a universal price figure to answer that question well.
Explore ProtectifyAI's ISO 27001 implementation service, read how to choose an ISO 27001 consultant in the UK, or use the evidence readiness exercise to identify questions for your prospective provider.
A useful scope covers the ISMS boundary, risk method, control implementation, evidence, internal audit and preparation for an independent certification audit.
Cost depends on scope, organisation size, starting maturity, delivery model and certification-body fees; a fixed scope should separate consultancy deliverables from auditor charges.
Yes. A proportionate ISMS can assign clear responsibilities to the existing team, provided owners have time, competence and reliable operating evidence.
Bring us a competing proposal and we'll help you work through what it does — and doesn't — cover.
Book a working session →