36 ISO 27001 consultants and consulting firms compared.

List or upgrade your firm on this page →

What does an ISO 27001 consultant actually deliver?

An ISO 27001 consultant builds and prepares your Information Security Management System (ISMS): the scope, the risk assessment and treatment plan, the Statement of Applicability, the Annex A controls, the policy set, and the mandatory internal audit. They get you audit-ready; an accredited certification body then runs the Stage 1 and Stage 2 audits and issues the certificate.

The distinction that matters is between documentation and operation. ISO 27001 certifies a management system that is genuinely running, not a binder of policies. A strong consultant implements controls alongside your engineers, structures evidence the way an auditor expects to see it, and stays through certification and the annual surveillance audits. The ISMS has to demonstrate continual improvement, so the work does not end the day the certificate prints. Be wary of any firm that hands over a template pack and disappears before Stage 2, because at Stage 2 the certification body looks for records that the controls have been operating, not just written down.

How do you choose an ISO 27001 consultant without hiring a body-shop?

Compare on deliverable and independence, not just headline price. The proposals worth shortlisting name the ISMS scope, the controls in and out, who writes the policies, who implements the technical controls, how internal audit is covered, and a clean hand-off to a separate accredited certification body. The firm that builds your ISMS should never also be the body that certifies it.

A few questions reliably expose a body-shop, the kind of firm that resells a generic toolkit and bills for hours without moving your controls forward. Ask who does the work: a named practitioner with ISO 27001 lead-implementer or lead-auditor experience, or junior staff working off a checklist. Ask to see a sample Statement of Applicability and a gap report, redacted, so you can judge whether the firm thinks in risks and controls or in copied-and-pasted policy text. Ask whether implementation is hands-on or advisory-only, because advisory-only firms leave the hardest work, building and evidencing the controls, with your team. Ask how they handle the internal audit and management review, both of which ISO 27001 mandates and both of which a weak consultant skips. Finally, ask whether they support the surveillance audits in years two and three, or whether they price only the first certificate and move on. UK and EU buyers should also confirm whether the firm holds independent credentials such as CREST accreditation or NCSC-assured Cyber Advisor status, which signal vetted competence rather than a self-declared specialism.

Why must the ISO 27001 consultant and the certification body be different firms?

ISO 27001 certification rests on the independence of the certification body. ISO/IEC 17021-1 requires that a certification body, and any part of the same legal entity, must not offer management system consultancy. A body that audits a system its own colleagues built cannot be impartial about it. When one firm offers to both implement and certify, treat it as a red flag rather than a convenience.

In practice this means your engagement has two contracts and two invoices. The consultant prepares the ISMS and coaches you through the internal audit. The accredited certification body, an organisation accredited by a national body such as UKAS in the United Kingdom or an ANAB-recognised body in the United States, then runs Stage 1 and Stage 2 and decides whether to issue the certificate. Compare those bodies on the ISO 27001 certification companies directory; a certificate from a non-accredited body carries far less weight with enterprise procurement. The upside of the split is real: an independent auditor finds the gaps your consultant missed, and the certificate you earn means something to the buyer reviewing your security questionnaire.

Why does hiring an ISO 27001 consultant mean two separate bills?

You pay the consultant to build and prepare the ISMS, then a separate accredited certification body for Stage 1, Stage 2, and surveillance. Those are two invoices on purpose: ISO/IEC 17021-1 forbids the same legal entity from consulting on and certifying the same system.

ISO 27001 has no defensible universal price. Scope, headcount, sites, current maturity, and how much implementation your team can do determine the consultant fee. The certification body prices its own Stage 1 and Stage 2 audit and the surveillance cycle. The few prices published by firms in this directory are engagement-specific signals, not a market average. Ask every finalist for line items and compare them against the ISO 27001 certification cost source ledger, which separates the six cost classes without inventing an average.

Can you run ISO 27001 and SOC 2 as one dual-framework program?

If you need both, build the control set once. ISO 27001 and SOC 2 share most of their underlying controls, so a combined program that maps a single set of controls to both frameworks is usually cheaper and faster than running them in sequence.

The overlap is substantial: access management, encryption, change management, vulnerability management, logging, and incident response all satisfy requirements on both sides. What differs is the wrapper. ISO 27001 asks for the management-system scaffolding, the risk assessment, the Statement of Applicability, the internal audit and management review, while SOC 2 asks for evidence mapped to the Trust Services Criteria and a CPA to attest to it. A consultant who runs dual-framework engagements builds the common controls once, then produces the ISO-specific artefacts and the SOC 2 evidence in parallel, and hands off to an accredited certification body for ISO and a licensed CPA for SOC 2. Several firms on this page run exactly this model; SOC 2 and ISO 27001 auditors are the attestation side of that split. The sequence question still matters: if your nearest deals are North American, many teams certify SOC 2 first and fold ISO 27001 in afterward, reusing the controls they already built.