ISO 27001 Consultancy

ISO 27001 consultancy typically costs between £8,000 and £25,000 depending on organisational size, scope complexity, and current security maturity. A standard implementation for a UK SME (50-150 employees) averages £12,000-£15,000 for full consultancy from gap analysis through to successful certification. Smaller organisations (under 50 employees) with simple scope typically invest £8,000-£10,000. Larger or more complex organisations (150+ employees, multiple locations, complex IT infrastructure) typically require £18,000-£25,000. Certification body audit fees are separate and range from £3,000-£8,000 depending on scope. We provide fixed-price quotes after an initial scoping call to understand your specific requirements.

ISO 27001 certification costs in the UK have two separate components: consultancy fees and certification body audit fees. Consultancy fees cover the implementation work, gap analysis, ISMS design, risk assessment, documentation, internal audit, and support through the certification audit. For UK organisations, expect £8,000-£25,000 depending on scope. Certification body audit fees are charged separately by a UKAS-accredited body (BSI, NQA, Alcumus ISOQAR) and typically range from £3,000-£8,000 for initial certification, with annual surveillance audits at £1,500-£3,000. Total first-year cost for a standard UK SME is typically £14,000-£23,000.

ISO 27001:2022 requires organisations to establish, implement, maintain, and continually improve an Information Security Management System (ISMS). The mandatory clauses cover: organisational context (Clause 4), leadership commitment (Clause 5), planning and risk assessment (Clause 6), resource and competence (Clause 7), operational controls (Clause 8), performance evaluation and internal audit (Clause 9), and continual improvement (Clause 10). Additionally, organisations must select applicable controls from Annex A (93 controls across four categories) and document their choices in a Statement of Applicability.

ISO 27001 is the international standard for information security management systems (ISMS). It provides a systematic framework for managing sensitive company information, ensuring confidentiality, integrity, and availability. The current version is ISO 27001:2022, which includes 93 controls across four categories in Annex A.

For most UK SMEs, the process from gap analysis to certification takes 3-6 months depending on your starting maturity, organisational size, and scope. Month 1-2: Gap analysis and ISMS build. Month 2-4: Implementation, controls, and staff awareness training. Month 4-5: Internal audit and management review. Month 5-6: Stage 1 and Stage 2 certification audit. Organisations with existing security policies and processes often achieve certification faster. We provide a realistic timeline during the initial gap analysis and structure the project around your deadline.

Yes. The transition deadline for ISO 27001:2013 to ISO 27001:2022 was October 2025. Organisations still holding 2013 certifications are now technically non-compliant with the current standard. Any new certification must be against ISO 27001:2022. Organisations with 2013 certifications should plan their transition audit with their certification body and engage a consultant to update their ISMS documentation, including mapping to the new Annex A structure and implementing the 11 new controls introduced in the 2022 revision.

When selecting an ISO 27001 consultant, look for: (1) the consultancy holds ISO 27001 certification for its own operations, they should practise what they recommend; (2) named experience with your preferred certification body (BSI, NQA, Alcumus ISOQAR); (3) fixed-price proposals rather than open-ended day rates; (4) sector-specific experience if you are in a regulated industry (financial services, healthcare, government supply chain); (5) references or case studies from organisations of similar size and scope. Avoid consultancies that offer guaranteed certification, the certification body makes the decision, not the consultant.

Technically yes, but it is significantly harder and often more expensive in hidden costs. DIY implementation typically takes 12-18 months (versus 3-6 months with consultancy), requires significant internal resource allocation, and has higher failure rates at certification audit. Common pitfalls include over-engineering the ISMS with unnecessary documentation, misinterpreting clause requirements, incomplete risk assessments, and inadequate evidence collection. For organisations with dedicated internal compliance expertise, we offer light-touch consultancy packages for guidance and review rather than full implementation.

No. ISO 27001 requires you to assess which controls are applicable through a Statement of Applicability (SoA). You must justify any exclusions based on your risk assessment. Most organisations implement the majority of controls but can exclude those genuinely not applicable to their scope.

Yes. Precursor Security holds ISO 27001 certification for our own operations, as well as ISO 9001 and Cyber Essentials Plus. Our consultants have implemented and maintained the same systems they help clients build.

ISO 27001 certification is valid for three years, subject to annual surveillance audits by your certification body. We provide ongoing support including internal audit services, management review facilitation, and continual improvement guidance to maintain and strengthen your ISMS. Annex A controls 8.15 (logging) and 8.16 (monitoring) require active security operations after certification.

Cyber Essentials covers five baseline technical controls and is primarily a self-assessment or technical audit. ISO 27001 is a comprehensive management system standard covering governance, risk management, policies, people, processes, and technology. Enterprise clients and regulated industries increasingly require ISO 27001 as a supply chain prerequisite. Many organisations pursue both: Cyber Essentials for government contract eligibility, ISO 27001 for enterprise supply chain assurance and comprehensive security governance.