Should you hire an ISO 27001 consultant or build the ISMS in-house?
When a customer, contract or regulator asks for ISO 27001, the organization must decide who does the work, and the answer is less of a choice than it looks. The organization owns the information security management system (ISMS), its policies, risk decisions, management review and internal audit. An outside partner can help prepare systems, documents and evidence, but only an accredited certification body issues the certificate, and that body cannot also design the system it audits. Top management involvement is examined in its own right under clause 5, so no consultant can carry that part for you. The real decision turns on three things: how much in-house capacity you have, how wide the scope is, and how the remaining work splits between documentation and technical change. A team that can write and maintain policies and run risk assessments may need outside help mainly for technical hardening, logging or evidence collection. A team with few security staff, or a scope that spans many sites, suppliers and cloud accounts, may need a partner for project management and gap analysis. Ask any firm to show which deliverables it will hand over, and which decisions will still be made by your staff.
Before you sign anything, confirm three points. First, ask who will act as internal auditor and whether that person sits outside the team that built the controls, since the certification body will test that separation. Second, check that the consultant will not also serve as your internal auditor or as a freelance auditor for the same certification, because accreditation rules restrict that combination. Third, ask for a written list of what the firm will not do, such as signing risk acceptances or approving the Statement of Applicability on your behalf. For the standards an in-house team can buy to build its own capability, the ISO/IEC 27001:2022 standard page is the starting point to confirm the current edition and its clauses with your own copy.
In-house, consultant-led or hybrid: which fits your team
A team with a security lead who has run a management system before can usually build most of the ISMS internally and use outside help for targeted gaps. The organization writes the policies, runs the risk assessment, decides the Statement of Applicability and owns the management review. An outside partner is most useful for a second opinion on the risk method, a review of the documented information against clauses 4 to 10, or a gap analysis before the certification body is engaged.
- Kept in-house: the scope under clause 4.3, the risk assessment and treatment under clauses 6.1.2 and 6.1.3, the Statement of Applicability and the leadership commitments in clause 5.
- Typically prepared by a partner: a review of the risk method against ISO/IEC 27005 guidance, a readiness check of the documented information, and a challenge review of the control decisions.
- Main risk: the lead becomes the single point of knowledge, and the spare capacity assumed at the start disappears once operational work begins.
- Main risk of over-reliance on the partner: documents that read well but that staff cannot explain during an interview.
- Ask for: a written split of who drafts, who approves and who evidences each clause, so the outside work is limited to defined deliverables.
Confirm with your team how many hours the lead can give each week before committing to an internal-led plan.
A small team without prior management system work often underestimates the volume of documented information and the management routines the standard expects. Here a partner with implementation experience can set up the structure, templates and first cycle of activities, and then hand the running of the ISMS to staff who understand what they are operating. The organization must still make the decisions and carry the ownership, because the certification body will audit top management involvement under clause 5 regardless of who wrote the material.
- Kept in-house: top management commitment, the policy approval, role assignments under clause 5.3, and the decisions on risk acceptance.
- Typically prepared by a partner: the initial ISMS structure, draft policies, the risk register format, the internal audit approach and the training on the 2022 controls.
- Main risk: the partner writes everything and staff cannot operate it, so records stop after the consultant leaves.
- Main risk of doing it alone: gaps in competence (clause 7.2) and awareness (clause 7.3) surface only at stage 1 or stage 2.
- Ask for: a handover plan that names the internal owner for each procedure and the evidence each owner must produce.
Illustrative example: a 20-person company may keep the day-to-day ISMS tasks with its operations lead while the partner drafts the first set of documents.
Some organizations need the management system and the technical controls changed at the same time. The Annex A technological controls, covering endpoints, access, cryptography, logging, networks and secure development, often require configuration work and evidence collection that a documentation-only consultant does not perform. A hybrid arrangement works best when the partner handles the technical build and evidence capture while the organization keeps the governance decisions.
- Kept in-house: the control owners, the Statement of Applicability decisions and the management review.
- Typically prepared by a partner: configuration of access, logging and backup systems, collection of technical evidence, and documentation of how each technical control works.
- Main risk: the technical build is finished but no one records the decisions behind it, so the Statement of Applicability does not match what the systems do.
- Main risk of separating the two streams: the security team and the partner disagree on which control owns which evidence.
- Ask for: a control-to-evidence map that links each technical deliverable to the Annex A control and the internal owner.
Confirm with the partner which tools they will deploy in your environment and who will hold the administrative credentials after handover.
Which ISO guidance standards an in-house team can use
An in-house team that builds its own ISMS can lean on a small set of ISO guidance standards. Each covers a different part of the work, from control design to risk, ISMS structure and internal auditing, and none of them is itself a certification standard.
Control guidance for Annex A
ISO/IEC 27002:2022 explains the purpose and implementation of the 93 Annex A controls in ISO/IEC 27001:2022. It runs to 152 pages and is the natural reference when the team writes each control's implementation. It is guidance only, so ISO states it cannot itself be certified to. Confirm that your certification body expects the Annex A wording in your Statement of Applicability to be backed by your own documented implementation, not by the guidance text alone.
Risk management method
ISO/IEC 27005:2022 gives guidance on information security risk management that supports the risk assessment and treatment requirements of ISO/IEC 27001. It is the standard an in-house team most often buys first, because the risk register and the Statement of Applicability depend on a method the team can explain and repeat. Check that the method you adopt produces the risk criteria, owners and treatment decisions your auditor will ask to see.
ISMS implementation guidance
ISO/IEC 27003:2017 offers guidance on planning and building an ISMS against the requirements in clauses 4 to 10 of ISO/IEC 27001. It helps an in-house team sequence its work, from scope and leadership commitment through to the management system's operation. Because the standard is under revision, confirm its current status with ISO before you buy, and plan around the revised text if it has been published by the time you start.
Internal ISMS audit guidance
ISO/IEC 27007:2020 gives guidance for auditing an ISMS, which an in-house team needs when it runs the internal audit required by clause 9.2 of ISO/IEC 27001. It helps auditors plan the programme, sample evidence and report findings in a form a certification body will accept. Your internal auditors must be independent of the work they audit, so buy this for the people who will actually audit, not only for the implementation team.
Guidance versus certification requirements
The guidance standards explain how to do the work, but only ISO/IEC 27001 sets the requirements a certification body audits against. Organizations often buy several guidance documents and assume they replace the requirements. Before purchase, map each guidance document to the clause or control it supports, and keep the requirement text as the reference when a certification body asks what you did and why.
Why the certification body cannot be your consultant
A certification body cannot also be the firm that built your ISMS. Accredited certification bodies work under impartiality rules that separate implementation from certification, and those rules decide who you can hire for which job. European Accreditation FAQ 33.15 treats consultancy from a body related to the certification body as a significant threat to impartiality. The recognized mitigation is that the certification body does not certify that management system for at least two years after the consultancy ends. Ask any prospective certification body whether it, or a related company, has advised on your ISMS, and get the answer in writing before you sign.
The rules are tighter for individual auditors. European Accreditation FAQ 49.4 explains that under ISO/IEC 27006-1 clause 5.2.2, a certification body may not use an auditor who also performs your internal ISMS audit, and this bar carries no two-year mitigation period. Other consultancy by freelance auditors falls under ISO/IEC 17021-1 clause 5.2.10, so a freelancer who helped you write policies may be a poor fit for the same engagement. When you assemble a team, confirm who will advise, who will run your internal audit, and who the certification body will send, and keep those three roles apart.
Pre-audits need the same discipline. European Accreditation FAQ 49.2 says that repeated preliminary audits by a certification body, used to check whether earlier problems were fixed, amount to participating in developing the management system, which threatens impartiality. ISO/IEC 27006-1 clause 5.2.2 allows auditors to point out opportunities for improvement without recommending specific solutions. In practice, the certification body can tell you where a gap sits, but the fix, the design and the evidence set must come from your team or your implementation partner. Plan your readiness review with an independent party, and treat any certification body that offers to design the fix as a warning sign.
How to judge an ISO 27001 consultant before signing
A consultant can help build the ISMS, but the organization must still own the controls, decisions and internal audit. The cards below set out the checks that separate a sound implementation partner from one that creates independence problems or hands over work the organization must do itself.
Written scope and deliverables
Ask for a written statement of work that lists the clauses and Annex A controls covered, the documents and evidence the firm will prepare, the workshops it will run and what the client's staff must provide. Compare it with the Statement of Applicability and the scope of the ISMS. A vague promise to get the organization certified is a warning sign, because the firm cannot control the certification decision. Ask how changes to scope are priced and approved before work starts.
Ownership of controls and decisions
The organization owns its controls, risk decisions and sign-off. Clause 5 of ISO/IEC 27001:2022 places leadership and commitment, the policy and roles with top management, and that is audited even when a consultant does the drafting. Ask the firm to confirm in writing that it will not accept risk on the client's behalf, approve exclusions in the Statement of Applicability, or act as the named security owner.
No link to the certification body
Ask whether the firm, its owners or its affiliates are related to any certification body you might use. European Accreditation FAQ 33.15 treats consultancy from a body related to the certification body as a significant threat to impartiality, and the mitigation it cites is a two-year gap before that body may certify the system. Also ask whether any of its consultants will later audit your ISMS, since FAQ 49.4 bars a certification auditor from also performing the client's internal audit.
Internal audit separation plan
Clause 9.2 requires the organization to run its own internal audits, and an auditor who designed the controls should not be the one who tests them. Ask for a written plan that names who will perform the internal audit, how that person stays independent of the implementation work, and how findings flow into management review. Confirm that the firm will not perform the internal audit if it also implemented the ISMS, unless your certification body has accepted that arrangement in writing.
Work in your environment
The evidence an assessor reads must come from your own systems, so the firm should work inside your cloud accounts, tenants, data centers or networks with access you control. Ask how it will record configuration changes, where documents are stored, who holds the credentials and what happens to access and data when the engagement ends. A partner that wants to keep evidence in its own tools creates a dependency you cannot audit.
Accreditation and certification body comparison
A consultant is not accredited to certify your organization unless it is separately accredited as a certification body, and the same firm should not be both. ISO says it does not perform certification and advises organizations to compare several certification bodies and check their accreditation. Ask the consultant which certification bodies it has worked with, and verify any certificate you are shown through the IAF CertSearch database rather than accepting a logo or claim.
How an outside engagement fits the certification path
The sequence separates work the organization must own from work an implementation partner can prepare, so that the certification body can audit the system without having helped build it. Each phase ends with a named output that the next phase depends on.
Agree scope and responsibilities in writing
The organization and any outside firm agree in writing what the engagement covers, which deliverables the firm prepares, and which decisions stay with named internal owners. Top management confirms its commitment to the ISMS, since clause 5 covers leadership, policy and organizational roles and the auditor will test that involvement regardless of who does the drafting. The output is a signed statement of work and a responsibility matrix that names an internal owner for each clause and each Annex A control area. The step is done when both parties can point to who decides what.
Complete the gap analysis and risk assessment internally
The organization compares current practice with clauses 4 to 10 and the 93 Annex A controls, then runs the risk assessment and risk treatment itself. A consultant may facilitate workshops and challenge assumptions, but the risk criteria, risk owners and accepted residual risk must come from the organization. The outputs are a gap register, a risk register and a risk treatment plan. The step is complete when each risk has an owner and a treatment decision that management has approved.
Build the policies, controls and evidence
The implementation partner or internal team drafts the ISMS documentation, configures the technical controls and sets up the processes that generate evidence, such as access reviews, change records, logging and training completion. Staff who operate these controls must be trained and must be able to explain their role. The outputs are the documented information required by clause 7.5, the Statement of Applicability drafted from the risk treatment plan, and a folder of operating evidence for each control. The step is done when the controls have run long enough to produce records, not just when the documents exist.
Run the internal audit and management review
Someone independent of the work being checked performs the internal audit under the audit programme, using guidance such as ISO/IEC 27007 and ISO 19011. Nonconformities are logged, corrected and verified. Top management then holds a management review that considers audit results, risk changes and performance, and records decisions. The outputs are an internal audit report, closed corrective actions and minutes of the management review. The step is complete when management can show it reviewed the system and acted on what it found.
Select and contract the certification body
The organization requests proposals from several accredited ISMS certification bodies and checks each body's accreditation before signing. The organization confirms that the body will not be the same firm that consulted on the system, and that the auditors it assigns have not performed the internal audit. The outputs are a signed certification agreement, a defined audit scope that matches the ISMS scope, and an agreed audit plan. The step is done when the accreditation and independence questions have been answered in writing.
Pass the stage 1 documentation review
The certification body's auditors review the ISMS documentation and the Statement of Applicability to judge whether the system is designed to meet the standard and whether the organization is ready for a detailed audit. Auditors may identify areas of concern and opportunities for improvement, but they do not recommend specific solutions, because that would make them consultants. The output is a stage 1 report listing any gaps the organization must address before stage 2. The step is complete when the organization has resolved those points to the body's satisfaction.
Pass the stage 2 audit and receive the decision
Auditors test whether the ISMS operates in practice by sampling records, interviewing staff and observing controls across the defined scope. Any nonconformities are reported and must be corrected within the period the certification body sets. The certification body then makes an independent certification decision, separate from the audit team. The outputs are a stage 2 report, a record of nonconformity closure and, if the decision is positive, a certificate that states the scope. The organization owns the controls throughout; the certification body issues the certificate.
Questions buyers ask before hiring ISO 27001 help
Can we implement ISO 27001 ourselves without a consultant?
Yes, an organization can build its own ISMS in-house, and the standard does not require outside help. The organization owns its controls, its policies and its risk decisions in every case. Clause 5 requires top management to show leadership and commitment, set the policy and assign roles, and clause 7 covers resources, competence, awareness, communication and documented information. Those duties stay with your people whoever does the work. The main cost of going in-house is staff time, plus purchased guidance such as ISO/IEC 27002:2022 for control detail and ISO/IEC 27005:2022 for risk management. Ask yourself whether your team can run risk assessments, internal audits and management review on a steady schedule for the full three-year cycle.
Can the consultant who helped us build the ISMS also be our internal auditor?
Usually not, and you should check this before you sign. Under ISO/IEC 27006-1 clause 5.2.2, as explained in European Accreditation FAQ 49.4, a certification body may not use an auditor who also performs the client's internal ISMS audit, and that rule carries no two-year mitigation period. Consultancy from a body related to the certification body is a more serious threat to impartiality, and the recognized mitigation is a two-year gap before that body certifies the system (European Accreditation FAQ 33.15, citing ISO/IEC 17021-1 clause 5.2.7). Ask each firm whether it, or any person on the team, would later audit your ISMS or work for the certification body.
Can the certification body help us prepare before the audit?
A certification body can explain its process and requirements, but it cannot design your ISMS. Auditors may point out opportunities for improvement without recommending specific solutions (ISO/IEC 27006-1 clause 5.2.2, as cited in European Accreditation FAQ 49.4), so the body cannot act as your implementation consultant. Repeated preliminary audits meant to check whether earlier problems were fixed count as helping develop the system and threaten impartiality (European Accreditation FAQ 49.2). Gap analysis and readiness work should come from a separate party, and the certification body's own stage 1 audit remains the formal check.
What must our team provide if we hire an implementation partner?
Your team provides the decisions, the knowledge of your business and the operating evidence. Leadership must approve the policy, the scope and the risk treatment choices, and accept residual risk. Process owners must run controls day to day, such as access reviews, change records, supplier checks and incident handling, so that records exist before the audit. Your staff also supply system inventories, network and cloud details, and interview time. A fixed-scope engagement works best when these responsibilities are written into the statement of work, with named owners and dates. Anything your team cannot staff becomes a gap that no partner can close on your behalf.
How do we check a consultant's credentials before hiring?
Ask for concrete evidence of ISMS work, not certificates alone. Request examples of deliverables you can review, such as a scope statement, a Statement of Applicability template and a risk method, with names removed. Confirm whether the firm is itself an accredited certification body, which is the only situation in which it may certify, and whether any individual is an accredited auditor. Ask how the firm handles conflicts of interest and what it will not do. Check that reference contacts can be provided and that the scope, deliverables and timelines will be written down before work starts. Verify any certification body you use through the IAF CertSearch database, which ISO points to for checking accredited certificates.
Does hiring a consultant guarantee that we pass certification?
No. Certification is decided by an independent accredited certification body after its audits, and no consultant, platform vendor or implementation partner can issue or promise a certificate. A partner can prepare systems, documentation and evidence for the audit, and a good partner will say plainly where your own controls are weak. The result still depends on whether your organization operates the ISMS as described, closes any nonconformities within the required time, and keeps the scope accurate. Be cautious of any offer that promises a certificate or a pass date.
What does hiring outside help cost compared with doing it in-house?
Outside help adds fees for the consultant's time, and in-house work adds staff time and purchased guidance. The certification body is paid separately for audits across the three-year cycle, and that cost does not disappear whichever route you choose. The fee for implementation depends on the number of people and systems in scope, the number of sites, how mature your current controls are and how much work your staff can absorb. Ask any provider for a written quote that separates one-time implementation work from recurring support, and ask what the quote excludes, such as certification body fees, tooling licenses and internal time.
How DeployOpen scopes, implements and prepares evidence
DeployOpen works as an implementation partner. We prepare systems, controls and evidence inside your own infrastructure so your team keeps ownership of the ISMS, while an independent certification body performs the audit and issues any certificate.
How we scope
- We agree the written scope with you before work starts, covering systems, sites and the controls each team owns.
- Scope documents name which ISMS roles stay with your top management and which tasks DeployOpen performs.
- Engagements are fixed-scope, so deliverables and timelines are confirmed in writing before any implementation begins.
- Quotes follow from the written scope, so ask for a breakdown of each deliverable and the people involved.
How we build
- We configure self-hosted open-source platforms in your cloud accounts, data centers or air-gapped networks to run controls.
- We draft policies, procedures and records for your review, and your leadership approves what goes into the ISMS.
- We set up logging, access reviews and change records so that operating evidence is produced as the systems run.
- We test the technical controls we implement and document the results for your internal review.
How we hand over
- We deliver documentation that explains each control, its owner, its evidence source and how to keep it current.
- We walk your internal team through the platforms, runbooks and evidence collection so they can operate without us.
- We prepare the evidence pack for the certification body, but the organization presents it and answers auditor questions.
- Ownership of the Statement of Applicability and risk treatment decisions stays with your organization.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after the initial scope is delivered.
- Retainers can cover evidence maintenance between the annual audits in the three-year certification cycle.
- We can help prepare for surveillance and recertification audits when the scope of your ISMS changes.
- Ask any implementation partner, including us, to confirm in writing which tasks it performs and which stay with your team.
