ISO 27001 consultant cost and what drives it

What does an ISO 27001 consultant do, and what does it cost?

If a customer or contract deadline is forcing your hand, start by separating two roles. A consultant or implementation partner prepares the ISMS, the controls and the evidence that show they work. Only an accredited certification body issues the certificate, and no consultant can do that step for you. Before you sign anything, confirm in writing which parts of the ISMS work the partner will deliver, which parts your staff will own, and what the partner will hand over at the end so your team can run the system without them.

No supplied fact gives a consultant fee, and no fee should be assumed from this page. The cost depends on the scope you set, the number of people and locations in the ISMS, the systems that hold in-scope information, and how mature your current policies, asset inventory and risk records already are. Ask each bidder to price the gap analysis, risk assessment, control implementation, evidence collection and internal audit as separate line items, and to state which are one-time and which recur each year. Ask whether the price includes support during the certification audit itself.

Some of the work can be done in-house at a lower direct cost, provided someone has the time and competence. The standards are sold by ISO: ISO/IEC 27002:2022 gives control guidance across 152 pages, ISO/IEC 27005:2022 covers risk management at CHF 225, and ISO/IEC 27007:2020 covers ISMS auditing at CHF 196. The ISO/IEC 27001:2022 standard itself is priced at CHF 155, and the ISO/IEC 27001:2022 practical guide for SMEs (PUB100484) costs CHF 44. These prices come from ISO's sales listings and may change, so check the current figures on the ISO site before budgeting. Buying the guidance does not replace the consultant's judgment, but it lets your team test a proposal against the source material.

Who is paid for what in an ISO 27001 project

This table compares who is paid for each part of an ISO 27001 project, whether the cost is one-time or recurring, and what drives it up. Use it to match each line of a quote to a payee and to see which costs stay with your organization regardless of who helps you.

Cost component	Who is paid	One-time or recurring, and what drives it
Certification body	The accredited certification body that issues the certificate	Recurs across the three-year cycle. ISO/IEC 17021-1 requires at least one audit each calendar year, and audit time follows the persons in scope under ISO/IEC 27006. Ask each body to show its audit time calculation.
Implementation partner or consultant	The consultant or firm preparing systems, policies and evidence	Mostly one-time for the build, with optional retainers later. Drivers include the agreed scope, number of sites, system count and how much evidence work the partner performs. Scope is agreed in writing before work starts.
Internal staff time	Nobody paid directly, but salaries and time are a real cost	Largely one-time during build, then recurring for control operation, reviews and management review. Drivers include the number of people in scope, how many systems need owners and how many teams contribute evidence.
Standards and guidance purchases	ISO, for published standards and guides	One-time per document, with revisions occasionally requiring repurchase. Core titles include ISO/IEC 27001, ISO/IEC 27002, ISO/IEC 27005 and ISO/IEC 27007. Check the current edition before buying.
Tooling and cloud services	Software vendors, hosting providers and cloud platforms	Recurring for subscriptions, hosting and storage. Drivers include the number of users, log retention, backup needs and whether tools are self-hosted inside your own infrastructure. Confirm licensing terms for each platform.
Internal audit provider, if used	An outside firm or individual performing your internal ISMS audit	Recurs each audit cycle. Drivers include the number of audit days, the scope of processes covered and whether the provider is independent of the certification body and of your implementation partner.
Independent review of your own readiness	Often the certification body or a separate assessor, depending on contract	One-time for pre-assessment work, if purchased. Drivers include whether the body's own preliminary audit is included, how many stage 1 repeats are needed and how well your documentation is prepared.

What makes an ISO 27001 consultant engagement cost more or less

Consultant fees follow the amount of work the ISMS demands, and most of that work is set before the first workshop. The six drivers below decide how many sites, people, systems and suppliers must be assessed, and how much of the evidence has to be built from scratch. Ask every bidder to price each driver separately so you can see which decisions move the quote.

Scope of the ISMS and sites

The scope statement defines which locations, business units and services sit inside the ISMS, and every site adds controls to implement, evidence to collect and audit time to fund. Multi-site certification follows its own sampling and audit-time rules, so a consultant pricing many locations must show how each one is covered. Narrow the scope to the service that customers actually buy, and document why excluded sites are outside it. Ask the consultant to quote the core scope and each optional site as separate line items.

Headcount in scope

The total number of persons doing work under the organization's control, across all shifts, is the starting point for ISMS audit time under ISO/IEC 27006. Employees, contractors and temporary staff all count, which means headcount growth during the engagement can change the audit plan and the certification body's fee. Confirm the headcount figure in writing before accepting a quote, and ask how the consultant treats part-time or shift-based staff. Use the same figure in the scope document and in the audit time calculation.

Systems and cloud estate

Every system that stores, processes or transmits in-scope information needs asset records, access reviews, logging, backup and change evidence. A small estate built on a few managed cloud services usually produces less evidence work than a hybrid environment with legacy servers and many custom applications. Inventory the systems before the first consultant call and state which cloud accounts are in scope. Ask whether the quote assumes infrastructure as code and central logging, since those choices reduce manual evidence collection.

Third parties and suppliers

Suppliers that host data, run parts of the service or access your systems bring supplier risk assessments, contract clauses and periodic review records into the ISMS. The number of material suppliers and the quality of their existing security documentation drive much of this work. Build a supplier register and collect current assurance reports, such as independent audit reports or certificates, before the engagement starts. Ask the consultant to state how many supplier reviews the quote includes.

Existing evidence and policies

Consultants charge more when policies, procedures and records must be written from nothing, and less when the organization already runs its security practice and can show it. A current policy set, an asset inventory, access review records and incident logs shorten the gap analysis and the Statement of Applicability work. Before requesting quotes, collect what already exists and note which controls have no records at all. Ask the consultant to separate drafting work from work that documents practice you already follow.

Internal ownership of risk assessment

The risk assessment and risk treatment decisions belong to the organization, and an implementer who makes them on your behalf adds cost and weakens ownership. When your team runs the risk method, it needs training and time, but the consultant's role shrinks to review and facilitation. Decide which people own each risk decision and who signs the Statement of Applicability before you compare fees. Ask bidders whether the quote includes facilitated workshops, drafting by the consultant, or review only.

Which ISO 27001 work stays with the organization

The organization owns its ISMS, and no consultant can take that ownership on. Clause 5 of ISO/IEC 27001:2022 puts accountability for the information security management system with top management, which includes the scope, the information security policy, the objectives and the management review. The organization also decides its risk criteria, accepts residual risk and signs the Statement of Applicability, which records which Annex A controls apply, why, and how they are implemented. A partner can draft these documents and explain the options, but the decisions and the approvals must be recorded under the organization's own name. Before work starts, ask the partner to show, in writing, which documents it will draft and which approvals each one still needs from your management.

A partner can prepare systems, draft documentation and collect evidence, but your staff must run the controls. An implementation partner can configure a logging pipeline, write an access review procedure, set up a ticketing workflow for incidents or build a register of assets and suppliers. Those artifacts only count as evidence once your people perform the activity on a routine basis, such as completing access reviews, handling security events and reviewing supplier risk. Assessors look for records produced in normal operation, not a set of documents created for the audit. Agree in the statement of work who holds the operating procedure after handover and who approves each change to it.

Clause 5.3 and Annex A.5.2 require named internal people. Clause 5.3 requires top management to assign responsibilities and authorities for the ISMS and to communicate them, and control A.5.2 asks the organization to define and allocate information security roles. Your records must name the individuals who hold these roles, their authority and their competence, even when an external vCISO or consultant supports them. Confirm the name, role and reporting line of each person before the certification body's stage 1 audit, and keep the appointment records current, because an assessor will ask who owns each decision.

Consultant, certification body and your team: the split

Your organization owns the ISMS. Top management must set the scope, approve the policies, accept the risk treatment decisions and show that the management system is actually used. Your staff also operate the controls day to day: granting access, reviewing logs, running incident response, managing suppliers and holding management reviews. A consultant can draft material, but a control only counts as operating when your people run it and keep the records.

Decisions: scope, risk appetite, risk owners and the Statement of Applicability choices stay with management.
Operation: access reviews, change approvals, training records and supplier reviews are performed by your staff.
Ownership: a named internal owner for the ISMS should be able to explain every control and its evidence.
Internal audit: the audit of your own ISMS must be performed by someone independent of the work being audited.
Independence boundary: nobody outside your organization can take ownership of the controls or accept residual risk on your behalf.

Before engaging anyone, check that you can name the internal owner for each control and the person who will sign off each decision.

Why the consultant and the certification body must stay separate

A certification body that has consulted for you on the same management system can face a conflict it must manage before it certifies you. Under ISO/IEC 17021-1, consultancy provided by a body related to the certification body is treated as a significant threat to impartiality (clause 5.2.7). European Accreditation's FAQ 33.15 explains the recognized mitigation: the certification body does not certify that management system for at least two years after the consultancy ends. Before you sign a consultancy contract, ask the certification body you plan to use whether it, or any related entity, offers gap analysis, pre-audit or implementation work, and whether it will accept the two-year condition for your system.

The rule is stricter for internal reviews. European Accreditation's FAQ 49.4 explains that under clause 5.2.2 of ISO/IEC 27006-1, a certification body may not perform internal ISMS reviews for a client it certifies, and it must stay independent of whoever carries out the client's internal ISMS audit. Unlike the consultancy case, this rule has no two-year mitigation period. If your internal audit is run by a partner, confirm that the firm is not the certification body's own team and that the certification body accepts the arrangement in writing before the internal audit starts.

Auditors may still point out opportunities for improvement during an audit, provided they do not recommend specific solutions, as clause 5.2.2 of ISO/IEC 27006-1 allows according to FAQ 49.4. In practice, this means your consultant owns the design of controls and the choice of tools, and the auditor only tells you where the evidence falls short. Write this split into your contracts, and keep a record of who recommended each change. The certification body's own rules on who may advise you are the final word, so confirm them directly rather than relying on a consultant's assurance.

How an engagement moves from gap analysis to certification

The sequence turns an agreed scope into an ISMS the organization runs itself, with each phase closing on a written output that the organization owns, the implementation partner prepares, and the certification body independently tests.

Agree scope and run the gap analysis
The organization and the implementation partner define the ISMS scope, the boundaries of the business units, locations, systems and suppliers it covers, and the interested parties and legal obligations that shape it. The partner then compares current practice against each clause of ISO/IEC 27001:2022 and each Annex A control, and records the results in a gap register. The step is done when management has signed the scope statement and the gap register lists every gap with an owner and a priority. Ask the partner to show how the register will feed the next phase and which gaps it expects management to decide on.
Assess risk and draft the Statement of Applicability
The organization sets its risk assessment and risk treatment methods, identifies risks within the agreed scope, and decides how each risk will be treated. Those decisions produce the Statement of Applicability, which lists all 93 Annex A controls, says which apply, and explains why any are excluded. ISO/IEC 27005:2022 is a useful reference for the risk method if the organization wants guidance it can buy. Management approves the risk treatment plan and the Statement of Applicability before the build starts, since every later control choice traces back to them.
Build the ISMS and implement controls
The organization writes the policies, procedures and role assignments the ISMS needs, and the partner helps configure the technical and operational controls that support them, such as access management, logging, backup and vulnerability handling. Work is done inside the client's own environment and accounts. Each control is finished when its owner can show a working process and at least one record of it operating. Management confirms the ISMS roles, including who holds responsibility for information security, so accountability stays with the organization rather than with the consultant.
Collect evidence and run an internal audit
Control owners gather evidence on a steady schedule, such as access reviews, change records, training completions, incident logs and supplier assessments, and file it in an evidence pack indexed to the Statement of Applicability. The organization then arranges an internal audit of the ISMS, performed by someone independent of the work being audited. The output is a set of internal audit findings, each with a corrective action owned by a named manager. The step closes when those actions are recorded as closed or planned with evidence. Confirm who performs the internal audit, since a certification body may not perform it for a client it certifies.
Hold a management review and prepare for the audit
Top management reviews the ISMS against its objectives, audit results, risk changes and performance data, and records decisions and actions. The partner runs a readiness check against the certification body's document requirements and the evidence pack, identifying gaps that could become nonconformities. Advice at this stage should focus on the organization's own readiness. The step is complete when management has signed the review minutes and the scope, policy set and Statement of Applicability are final and consistent with each other.
Complete the certification body stage 1 and stage 2 audits
The accredited certification body reviews the documented ISMS in stage 1 to judge whether it is designed to meet the standard and whether the organization is ready for a detailed test. Stage 2 is a fuller audit that tests whether the ISMS operates in practice, including sampling of evidence and interviews with staff. Auditors may point out opportunities for improvement but may not recommend specific solutions. The output is an audit report with any nonconformities, which the organization must address with corrective action before the certification body decides. Ask the certification body to confirm its accreditation and the audit time it calculated.
Issue the certificate and maintain surveillance
After the certification body reviews the corrective actions and makes its decision, it issues the certificate for the agreed scope. A management system certification cycle lasts three years, and the certification body must audit the ISMS at least once in every calendar year, through surveillance or recertification audits. The organization keeps the ISMS running between audits by repeating the evidence collection, internal audit and management review loop. The step is ongoing: the certificate stays valid only while surveillance audits pass, so check the certificate on the IAF CertSearch database and keep the evidence pack current.

What must be in place before a consultant starts work

A consultant can prepare systems and evidence, but cannot decide scope, own risk or supply the access the work depends on. The six items below are the decisions and inputs that a written scope should rest on, and each one can be checked before signing.

Named executive sponsor

Confirm one named executive owns the ISMS and can make binding decisions. Clause 5.1 places leadership responsibility with top management, and the organization must own its controls even when a partner drafts them. Check that the sponsor has a budget line, will approve the policy set and risk treatment decisions, and will attend management review. A sponsor who delegates everything usually means the scope stalls at the first approval.

Defined scope and site list

Write the scope boundary before any gap analysis starts. The scope sets which products, business units, sites, cloud accounts and staff the ISMS covers, and it drives both effort and the certification body's audit time. Ask for a list of every location and hosting environment, with a note on which are in scope and why. Ambiguous boundaries are a common reason quotes change after kickoff.

Current asset inventory

Provide an inventory of information assets, systems and suppliers. The risk assessment and Statement of Applicability depend on knowing what exists, who owns it and where data sits. Check whether the inventory covers cloud accounts, endpoints, SaaS tools and open-source services that the organization runs itself. If the list is missing, the first months of work will be spent building it, so ask whether that discovery is in the fixed scope.

Existing policy set or drafting mandate

Confirm which policies exist and who approves drafting new ones. Some organizations have security policies that are outdated but usable, while others have none. Review what is in place against the Annex A control areas, and agree in writing whether the partner drafts policies for internal approval or only reviews them. Policy text that the organization never adopts will not survive a certification audit.

Access to systems for evidence

Secure read access to the systems that will produce evidence. Evidence such as access reviews, configuration settings, logs and backup records must be pulled from live systems, and the partner cannot produce them without accounts and permissions. Agree in advance which roles, tools and cloud accounts the partner receives, how access is logged and how it is removed at the end of the engagement.

Budget authority for certification fees

Confirm who holds budget for the certification body, not only the consultant. Certification body fees, audit days and any surveillance audits in later years are paid to the certification body directly and are separate from the implementation quote. Ask the sponsor to confirm the budget owner for each cost line, so that an audit date is not booked before the money is approved.

Which ISO guidance standards can lower consultant effort

Can ISO/IEC 27002 be used to certify our organization?

No. ISO/IEC 27002:2022 gives implementation guidance on the Annex A controls of ISO/IEC 27001, and ISO states that it cannot itself be certified to. Your certification is to ISO/IEC 27001, and the certification body checks your controls against it. In-house teams use 27002 as a reference for what each control is meant to achieve, which helps them write procedures, pick technical measures and explain their design to an auditor. Because the guidance is detailed, it also shows where a consultant's description of a control goes beyond what the standard expects. Confirm the current edition and purchase details directly with ISO before budgeting.

How does ISO/IEC 27005 help with risk assessment work?

ISO/IEC 27005:2022 gives guidance on information security risk management, the process that ISO/IEC 27001 clause 6.1.2 requires you to design and run. An in-house team can use it to define risk criteria, choose a method, set likelihood and impact scales, and document treatment decisions that feed the Statement of Applicability. Consultants often run the first risk workshop, but the risk owners and the acceptance decisions must stay with your management. The standard is sold by ISO for a published price of CHF 225, so the cost of the document itself is low compared with a facilitated risk exercise.

What does ISO/IEC 27003 cover, and is it still current?

ISO/IEC 27003:2017 provides guidance on designing and implementing an information security management system, covering how the ISMS requirements in clauses 4 to 10 fit together in practice. It is useful to in-house teams building their first plan because it explains the sequence of activities, from defining context and scope to planning the rollout and managing resources. ISO lists the document as under revision, so check the ISO committee page for the status of the new edition before you rely on specific wording. Read it as a planning aid rather than a checklist, since it does not add requirements beyond ISO/IEC 27001.

Which ISO standard helps our team prepare for internal audits?

ISO/IEC 27007:2020 gives guidance for auditing an ISMS, including how auditors plan, conduct and report on audits against ISO/IEC 27001. Internal audit staff can use it to build an audit programme, write checklists, and test whether controls work as documented. It is also useful when you choose an internal audit provider, because you can ask the provider how its auditors apply the guidance. ISO sells the document at a published price of CHF 196. Remember that an internal audit must be performed by people independent of the work they audit, and that the certification body may not perform your internal ISMS review.

Is the ISO 27001 SME practical guide useful for a small company?

Yes, if your organization is small and its team must run the ISMS itself. ISO/IEC 27001:2022, A practical guide for SMEs (PUB100484), published in 2024, explains the standard in plainer terms and walks through the steps a small business typically takes. ISO sells it at a published price of CHF 44. It does not replace the standard, so your scope, risk assessment and Statement of Applicability still need to reflect your own business. Use it to decide which tasks your staff can handle and which tasks justify paying a consultant for a targeted review.

How do ISO guidance documents help decide how much to invest?

ISO/IEC 27002:2022 tells organizations to weigh the resources and investment needed to implement and operate a control against the business value it delivers. Its introduction points to ISO/IEC TR 27016 for guidance on ISMS investment decisions. Use this when you compare consultant proposals: ask each provider which controls drive most of the work, what they assume about existing tooling, and how the proposed spend reduces a specific risk you have documented. A proposal that cannot link effort to risk treatment is harder to justify to the board and harder to audit later.

Can guidance documents replace a consultant entirely?

They can cover much of the work for a team with time and security experience, but they do not replace judgment about your systems, contracts and risks. The guidance explains what the standards expect, and it does not tell you how your cloud accounts, identity provider or suppliers are configured. Plan on the internal team owning the ISMS, the policies, the risk decisions and the evidence, while a consultant may be useful for a gap review, a second opinion on the Statement of Applicability or help with a specific technical control. Ask any consultant to show which parts of the work they would hand back to you, and confirm the split in the written scope before work starts.

How to check an ISO 27001 consultant before signing

A consultant can prepare your ISMS, but the certification decision belongs to an accredited certification body. These checks separate the roles early, so the firm you hire does not later create a conflict that the certification body must refuse to resolve.

Confirm they are not your certifier

Ask in writing whether the firm, or any company related to it, is the certification body that will audit your ISMS. Under ISO/IEC 17021-1, a certification body that has provided consultancy to a client faces a significant threat to impartiality, and the recognized mitigation is a two-year gap before it certifies that system. Keep the consultant and the auditor as separate firms unless you accept that delay and its effect on your timeline.

Require a written scope and deliverables list

Ask for a document that names the ISMS scope, the clauses 4 to 10 work, the Annex A control assessment, the risk assessment method, and the policies and records the firm will draft. Each deliverable should have an owner on your side and an acceptance step. Fixed-scope agreements make the fee comparable across firms, and vague wording such as "full support" is where cost overruns usually start.

Check the certification body's conflict rules

Before you hire a consultant, ask the certification body you plan to use what it allows. Under ISO/IEC 27006-1, a certification body may not provide internal ISMS reviews to a client it certifies, and the auditor must be independent of whoever runs your internal ISMS audit. Get its position in writing so the consultant's scope does not block the certificate later.

Confirm the firm is not accredited to certify

Most consultants and implementation firms are not accredited certification bodies, and they cannot issue an ISO 27001 certificate. ISO states that it does not certify organizations and advises comparing several certification bodies and checking accreditation. Ask the firm to name the bodies it has worked alongside, then verify any certificate in the IAF CertSearch database before you rely on it.

Ask who owns the evidence

Establish that the evidence the firm produces, including the Statement of Applicability, risk register, procedures, configuration exports and internal audit records, belongs to your organization and is stored in your repositories or accounts. Ask how long the firm retains working files after handover. Clear ownership means you can keep operating the ISMS after the engagement ends and show the same evidence to the certification body.

Plan the handover to internal staff

Ask how the firm transfers knowledge: who gets trained, which tasks move to named staff, and what the last month of the engagement looks like. Management responsibility under clause 5 and ownership of the controls stay with your organization, so an engagement that ends with no one able to run the internal audit or the management review is a risk. Tie the final payment to a documented handover.

ISO 27001 consultant questions buyers ask

How much does an ISO 27001 consultant cost?

There is no published price list, and a consultant's fee follows from a written scope. The main drivers are the number of people and sites in scope, how many systems and suppliers the ISMS covers, how mature your existing controls and documentation already are, and whether the consultant writes policies, runs the risk assessment, or only reviews your work. Costs fall into two groups: a one-time fee for gap analysis and implementation, and smaller recurring costs for internal audit support, management reviews and surveillance preparation. The certification body is paid separately for the audit itself. Ask each bidder for a fixed-scope quote that lists deliverables, who performs each task, and what your team must supply. The standard itself has a purchase cost, such as the CHF 155 price ISO sets for ISO/IEC 27001:2022, but that is small compared with labor.

Can a small team implement ISO 27001 without a consultant?

Yes, many small teams do, provided someone has the time, the competence and the authority to make decisions. The standard requirements in clauses 4 to 10 and the Annex A controls are published, and ISO's guidance documents explain the approach. ISO/IEC 27002:2022 covers control guidance, ISO/IEC 27005:2022 covers risk management, and ISO/IEC 27003:2017 covers ISMS implementation guidance, although it is under revision. The practical risk is not the reading but the sustained work: a risk assessment that management accepts, a Statement of Applicability that matches reality, and evidence collected consistently over time. A consultant can shorten the learning curve and provide a second opinion, but the organization still owns every control and every decision.

How long does ISO 27001 readiness take?

The duration depends on drivers rather than a fixed period, so ask bidders to explain their estimate against these factors. Readiness time grows with the number of locations, systems, suppliers and staff in scope, and with how much of the ISMS must be built from nothing. Existing controls, such as access management, logging and documented change procedures, shorten the work. So does having an executive sponsor who can approve policies quickly. Delays usually come from unclear scope, slow risk decisions, or evidence that is collected only once before an audit. Ask the consultant to show a plan with milestones, the dependencies on your staff, and what happens if a milestone slips. Confirm the certification body's timing separately, since its audit schedule runs on its own calendar.

Can the consultant also perform our internal ISMS audit?

A consultant may be able to run an internal audit, but it depends on who the certification body is and on the independence rules that apply. ISO/IEC 27006-1 clause 5.2.2, as explained in European Accreditation FAQ 49.4, requires that the certification body is independent of whoever performs the client's internal ISMS audit. If your certification body is related to your consultant, the rules on consultancy become a serious impartiality issue. Ask the consultant to confirm in writing whether it has a relationship with any certification body you are considering, and whether the internal audit will be done by a person who did not design the controls. Internal audit is a clause 9.2 duty owned by the organization, so the consultant's role should be a provider, not the decision-maker.

Can the consultant run the certification audit for us?

No. Only an accredited certification body can issue an ISO 27001 certificate, and ISO itself states that it does not certify organizations. A consultant or implementation firm is not accredited to certify unless it is separately accredited as a certification body, and even then the same firm should not both prepare and certify your system. The consultant can prepare your documents, evidence and staff for the audit and answer questions during preparation. Choose the certification body by checking its accreditation in the IAF CertSearch database, and compare more than one body. Keep the consultant and the certification body in separate contracts so each has a clear role.

What must our team provide to the consultant?

Your team owns the business context, the decisions and the evidence, and the consultant cannot supply those on your behalf. Expect to provide access to systems, documents and people; a named project owner with authority; time for workshops and reviews; and a list of sites, suppliers, cloud accounts and data flows in scope. Management must approve the scope, the risk criteria, the risk treatment decisions and the Statement of Applicability. Your staff should also run controls day to day, such as access reviews, backups and incident handling, because the evidence comes from normal operation. Before signing, agree in writing who produces each deliverable, what counts as done, and how quickly your team will respond to requests.

How DeployOpen works on this

DeployOpen is a Chainscore Labs company that plans, implements and documents self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. We prepare the systems, controls and evidence that an ISO 27001 assessment will examine, while your organization keeps ownership of its controls and the certification body issues the decision.

How we scope

Scope is agreed in writing before work starts, covering systems, sites, deliverables and responsibilities.
The written scope names which Annex A controls and evidence items DeployOpen prepares, and which stay with your team.
Your team confirms what is excluded, so the quote follows from a defined boundary rather than assumptions.

How we build

We configure and harden the self-hosted platforms that produce logs, access records, backups and configuration evidence.
Each control we implement is documented with its owner, operating procedure and the evidence it generates.
Security testing of applications, APIs and infrastructure can be scoped alongside the build to check the controls work as documented.

How we hand over

You receive documentation, runbooks and an evidence map that shows where each item is stored and who reviews it.
Your staff are trained to operate and review the controls, so ownership sits with your organization after handover.
We do not issue audit reports or certificates. Your chosen independent auditor or certification body makes that decision.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after the fixed-scope work ends.
A retainer can keep evidence current between surveillance audits and recertification cycles, as your scope changes.
Confirm the support terms, response expectations and handover responsibilities in writing before you sign.