How to Choose an ISO 27001 Consultant: What to Ask Before You Sign

Short answer: choose an ISO 27001 consultant by deciding first what you want them to own: ISMS design, control implementation, the internal audit, or ongoing operation. Then get a proposal that names every deliverable, including the scope statement, risk assessment, Statement of Applicability and internal audit report. Confirm the consultant is independent of your certification body, and make sure your team can run the ISMS after handover. The consultant prepares you. Only an accredited certification body can issue ISO/IEC 27001 certification.

This guide is for SaaS and technology companies comparing ISO 27001 consultants and implementation partners. It covers engagement models, proposal questions, red flags and handover. If you are still deciding whether ISO 27001 is the right framework, start with SOC 2 vs. ISO 27001 or our ISO 27001 guide for startups.

Who actually certifies you for ISO 27001?

An accredited certification body does. It runs the Stage 1 and Stage 2 audits, makes the certification decision and issues the certificate. ISO itself doesn't certify companies, and a consultant can't issue or "guarantee" a certificate.

Certification bodies operate under ISO/IEC 17021-1. Clause 5.2.5 says a certification body, and any part of the same legal entity, "shall not offer or provide management system consultancy," as European Accreditation quotes it. That separation is the reason your consultant and your certification body should be different organizations with no arrangement that ties one to the other.

Check the edition, too. Under IAF MD 26, the transition from ISO/IEC 27001:2013 to ISO/IEC 27001:2022 ended on October 31, 2025. Every certification based on the 2013 edition expired or was withdrawn at that point. Any consultant you hire should be working to the 2022 edition and its 93 Annex A controls.

Which ISO 27001 engagement model do you need?

• Full implementation partner. Designs the ISMS, runs the risk assessment, drafts policies and the Statement of Applicability, helps implement controls, and supports you through the certification audit. Fits teams without a security lead.
• Advisory or fractional lead. A senior practitioner who guides your team while your people do most of the work. Fits companies with capable engineers who need direction rather than labor.
• Gap assessment. A review of your current controls against ISO/IEC 27001:2022, with a prioritized plan. Fits companies that already run a SOC 2 audit program and want to see what carries over. Our SOC 2 to ISO 27001 mapping shows where the overlap usually is.
• Internal audit provider. An objective, impartial auditor for the internal audit that clause 9.2 requires. Fits companies that built the ISMS themselves or with a different partner.
• Ongoing operation. Keeps the ISMS running between audits with risk reviews, evidence upkeep, management review support and surveillance-audit prep.

These models can combine. The point is to decide which parts you want to buy before you read proposals, so you are comparing like with like.

What should an ISO 27001 consulting proposal include?

Send the same eight questions to each firm on your shortlist so their replies line up side by side:

1. Scope statement. How will you help us define the ISMS scope, including locations, products, teams and cloud services? What will the scope sentence on the certificate say?
2. Risk method. Which risk assessment and treatment method will you use, and will we be able to run it ourselves next year?
3. Named deliverables. Will you deliver the scope document, information security policy, risk assessment, risk treatment plan, Statement of Applicability, required procedures, internal audit report and management review record? In editable formats?
4. Division of work. Which parts of the work will your consultants do, and which fall to our engineers? Expect a task-by-task split that names an owner on each side.
5. Internal audit independence. If you also build the ISMS, who performs the internal audit, and how is that person kept objective about work your firm did?
6. Certification body relationship. Do you have any commercial tie to the certification bodies you recommend? How will you help us choose one that is accredited for ISO/IEC 27001?
7. Audit support. What support do you provide during Stage 1 and Stage 2, and what happens if the auditor raises nonconformities?
8. After certification. What does support look like for surveillance audits and recertification, and what do we receive if we end the engagement?

What are the red flags in an ISO 27001 consultant?

• Certification "guaranteed." Only the certification body decides.
• A bundled certificate. A firm that offers consulting and the certificate in one package, or steers you to an unaccredited "certifier."
• A policy pack instead of an ISMS. Templates with your logo on them, no risk assessment tied to your systems, and a Statement of Applicability that excludes controls without reasons.
• Out-of-date references. Documents that cite the 2013 edition's Annex A numbering.
• The builder auditing itself. The same person who wrote your controls performing your internal audit.
• No exit plan. Artifacts that only exist inside the consultant's tools.

Who should own the ISMS after the consultant leaves?

Your company should, and it should be someone with the authority to run management review. ISO/IEC 27001 is a management system standard, so the certification body is looking for evidence that leadership runs the ISMS, not that a vendor wrote good documents. The proposal should name an internal ISMS owner from the start and build that person's skills during the engagement.

One way to check this before you sign: describe a realistic change, such as a new product launch or a new cloud provider, and ask how your team would reflect it in the risk register and Statement of Applicability. An answer that routes every update back through the consultant points to ongoing reliance on that firm rather than an ISMS your team can run.

What should an ISO 27001 handover include?

• Editable artifacts. Every required document and record, with version history.
• Owner map. A named owner for each Annex A control you've marked applicable.
• Annual calendar. Risk review, internal audit, management review and the surveillance audit window, all with dates.
• Internal audit plan. Who performs it next year and how they stay independent. Our ISO 27001 internal audit guide covers what a sound plan includes.

How does Workstreet approach ISO 27001?

Workstreet supports ISO 27001 from ISMS design and planning through implementation and documentation, internal audit and management review, and support during the external certification audit. Our compliance automation runs alongside practitioners who do the hands-on ISMS work. For companies that also need ongoing security leadership, our virtual CISO service can own the ISMS alongside your team. We are not a certification body. See our ISO 27001 program for how the engagement runs.

Weighing ISO 27001 proposals or scoping your first certification? Talk to an ISO 27001 expert about your scope and timeline.

ISO 27001 consultant FAQs

Can my ISO 27001 consultant also certify me?

No. Certification comes from an accredited certification body, and ISO/IEC 17021-1 bars certification bodies from offering or providing management system consultancy.

Do I need a consultant if we already have a SOC 2 report?

Not always. A SOC 2 audit program gives you many controls, but ISO 27001 also requires a management system: a defined scope, a risk assessment and treatment process, a Statement of Applicability, internal audit and management review. A gap assessment will tell you whether to bring in outside help or whether your team can close the gaps itself.

Is an ISO 27001:2013 certificate still valid?

No. Under IAF MD 26, all 2013-edition certifications expired or were withdrawn when the transition period ended on October 31, 2025.

How do I check that a certification body is accredited?

Ask which accreditation body accredits it for ISO/IEC 27001, then confirm with that accreditation body. Look for an accreditation body that is a signatory to the IAF Multilateral Recognition Arrangement (MLA).