What can an ISO 27001 partner take off your plate, and what must stay with management?
When a customer or contract requires ISO 27001, management keeps ownership of the information security management system (ISMS), its leadership and policy decisions, and the ownership of every control. An implementation partner can prepare systems, draft documentation and assemble evidence, but only an accredited certification body issues a certificate. Clause 5 of ISO/IEC 27001:2022 makes this explicit: 5.1 (leadership and commitment), 5.2 (policy) and 5.3 (organizational roles, responsibilities and authorities) are audited against top management, whatever help was used to build the system. Two Annex A controls show the same boundary in practice. A.5.19 asks the organization to define and run processes for supplier risk, and A.8.30 asks it to direct, monitor and review outsourced development. A partner can design those processes, but the organization must run them and show it does.
The split depends on company size, the tools already in place, and how much of the IT estate sits with cloud providers. A small SaaS team may hand over most documentation and evidence collection, while a bank-adjacent vendor with mature change management may only need a gap analysis and a second pair of hands on the Statement of Applicability. Cloud use also changes the boundary. Microsoft notes that a customer can use Azure's certifications in its own assessment but remains responsible for engaging an assessor to evaluate its implementation and its own controls, and AWS states that using its services does not make a customer certified. Confirm with each provider which controls their certificate covers and which remain yours.
Put the boundary in writing before work starts. Ask the partner to list each deliverable against an owner: who approves the policies, who signs the risk treatment decisions, who operates each control day to day, and who holds the evidence after handover. A useful test is whether a named manager at the organization could explain and defend each control to an auditor without the partner present. The same written scope should name the internal audit provider and confirm that the partner is not also the certification body, since independence rules are covered elsewhere on this page. Anything left undefined in the scope will usually fall to your own team after the partner leaves.
Who does which part of ISO 27001 work?
Top management owns the ISMS. Clause 5 of ISO/IEC 27001:2022 covers leadership and commitment, the information security policy, and organizational roles, responsibilities and authorities, and the certification auditor will test that senior leaders actually take these up, whoever drafted the documents. Control owners across IT, HR, facilities and engineering run the day-to-day controls and produce the records that show them working.
- Leadership commitment: senior managers approve the policy, set objectives and review the ISMS themselves, with minutes that show the review.
- Named roles: responsibilities for each Annex A control, including the person who signs off the Statement of Applicability.
- Control operation: staff run access reviews, change approvals, incident handling and training, and keep the records.
- Risk decisions: the organization accepts, treats or transfers its own risks, even when a partner runs the risk workshop.
- Retained documents: policies and records must exist and be maintained by your people, not only in a partner's templates.
Confirm that every control has a named owner who can explain it to an auditor without a consultant present.
An implementation partner can prepare the ISMS: gap analysis, risk assessment method, policy drafts, Statement of Applicability drafts, control configuration and evidence collection. This is commonly outsourced because the work is large and specialized. The partner does not certify the organization and cannot issue a certificate, and it should not be the party that later audits the same ISMS.
- Gap analysis: comparing current practice against the requirements and the Annex A controls.
- Technical implementation: configuring logging, identity, backup and vulnerability tooling that produces evidence.
- Documentation drafts: procedures and templates that your team reviews, edits and adopts.
- Training and handover: teaching control owners how to run and record their controls.
- Limits: the partner cannot accept risk, approve the Statement of Applicability or act as management.
Ask for a written split of deliverables so you can see which documents and decisions remain with your staff after the engagement ends.
Clause 9 requires internal audits of the ISMS at planned intervals, and many organizations buy this service from an outside firm. ISO/IEC 27006-1 clause 5.2.2 requires the certification body to be independent of whoever performs the client's internal ISMS audit, including individual freelance auditors. European Accreditation FAQ 49.4 (March 2025) notes that there is no two-year mitigation period for this conflict, unlike the rule for other consultancy under ISO/IEC 17021-1.
- Independence check: confirm the internal auditor is not the same person or firm that certifies you.
- Scope of work: planning, sampling, fieldwork and a written report that management reviews.
- Ownership of findings: your management decides and tracks corrective actions.
- Competence: ask how the auditor's competence is evidenced against ISO 19011 guidance.
- Records: keep the internal audit programme and reports as evidence for the certification audit.
Ask the certification body in writing whether your planned internal auditor creates a conflict before you sign.
Cloud providers hold their own ISO/IEC 27001 certificates for in-scope services, but those certificates cover the provider's infrastructure, not your configuration. Microsoft states that a customer seeking certification for an implementation on in-scope Azure services can use Azure's certifications in its assessment, but the customer remains responsible for engaging an assessor to evaluate its own implementation and controls and processes. AWS similarly states that customers are not automatically certified because they use AWS.
- Shared responsibility: the provider covers facilities and platform controls, you cover identity, data, configuration and workloads.
- Inherited evidence: provider reports and certificates can support parts of your assessment.
- Your evidence: configuration baselines, access reviews and logs in your accounts must be kept by you.
- Scope boundary: list which cloud services are inside your ISMS scope and which are excluded.
- Contract terms: confirm what evidence the provider will share and how often it is updated.
Verify the provider's current certificate and scope in the public register before you rely on it.
Only an accredited certification body can issue an ISO/IEC 27001 certificate. ISO states that it does not certify organizations and that buyers should compare several certification bodies and check their accreditation. The certification body audits your ISMS against the standard and must stay independent of the consultancy and internal audit work. Consultants and implementation firms are not certifiers unless they are separately accredited certification bodies.
- Audit decisions: the certification body decides on nonconformities and grants or refuses certification.
- Accreditation check: confirm the body's accreditation in the IAF CertSearch database.
- Independence: the body must not design or write the controls it later audits.
- Cost and scope: ask for a written quote that lists audit days and the certificate scope.
- Ongoing audits: surveillance audits follow in the three-year cycle, so budget for them as recurring work.
Check that the certification body's accreditation covers ISO/IEC 27001 and that the certificate will be listed in its public register.
Which ISO 27001 decisions can never be outsourced?
A consultant can draft, configure and organize almost everything in an ISMS, but an assessor will still trace key decisions back to named people inside the organization. The cards below cover the decisions that carry accountability, and the evidence that shows management actually made them.
Top management commitment and policy
Clause 5 places leadership responsibility on top management, and the auditor will test whether senior leaders set the information security objectives, direct the ISMS and approve the information security policy. A consultant may draft the policy, but the assessor looks for a signed approval, a board or executive minute, and evidence that leaders attended management reviews. Check that the approver is the person accountable for the ISMS scope, not only the person who wrote the document.
Risk assessment and risk treatment decisions
The organization must decide which risks it accepts, reduces, transfers or avoids, and it must own the criteria used to rate them. Consultants often build the risk method and register, but an assessor will ask who approved the risk owners, the likelihood and impact scales, and the residual risk accepted. Evidence includes a dated risk register with named risk owners and signed treatment decisions.
Statement of Applicability choices
The Statement of Applicability records which Annex A controls the organization includes, which it excludes and why, and how each included control is implemented. A consultant can propose a draft, but the justification for every exclusion must match the organization's actual risks and processes. Assessors compare the SoA against the risk register and against what they observe on site, so ask who signed off each justification.
Control ownership and day-to-day operation
Each Annex A control needs a named owner inside the organization who runs it, reviews it and keeps its records. An implementation partner can configure access reviews, logging or backup jobs, but an assessor will ask the control owner to explain the process and show recent operating evidence, such as completed review tickets. Confirm that every control has an owner who can answer questions without the consultant present.
Supplier risk decisions under A.5.19
A.5.19 asks the organization to define and implement processes to manage information security risks from suppliers' products and services. Choosing which suppliers are critical, deciding what contractual security terms to require and accepting residual supplier risk are business decisions. Evidence includes a supplier register with risk ratings, approved due diligence records and signed acceptance of exceptions. Cloud providers' certificates can support this work but do not replace the organization's own judgment.
Management review and improvement decisions
Clause 9 requires management to review the ISMS at planned intervals, and clause 10 requires it to decide on corrective actions. A consultant can prepare the review pack, but the assessor will test whether leaders discussed real inputs, such as audit results, incidents and risk changes, and made recorded decisions with owners and due dates. Minutes that show challenge and follow-up are stronger evidence than a polished slide deck.
Why the implementation partner and the certification body must stay separate
The firm that helps you build the ISMS cannot also be the body that certifies it, and the rule is stricter for certification bodies than most buyers expect. ISO/IEC 27006-1 clause 5.2.2 requires the certification body to be independent of whoever performs the client's internal ISMS audit. That independence test covers individual freelance auditors as well as firms. European Accreditation FAQ 49.4 (March 2025) notes that the two-year mitigation period available under ISO/IEC 17021-1 does not apply here, so a certification body cannot use an auditor who also performed your internal audit and then expect time to fix the conflict. Before you sign with an implementation partner, ask the certification body in writing whether anyone on its proposed audit team has performed or will perform your internal ISMS audit.
Other consultancy by freelance auditors falls under ISO/IEC 17021-1 clause 5.2.10, which is a different and less absolute test than the internal audit rule. The practical split is this: the implementation partner writes or tailors policies, builds the risk assessment and Statement of Applicability, configures tooling and collects evidence, while management keeps ownership of decisions and the internal audit is performed by someone the certification body can treat as independent. Map each deliverable in your statement of work to one of these roles so that no individual appears on both sides of the line. Confirm the names of the people, not only the firm names, because independence attaches to people.
The limits on what a certification body may sell you alongside certification are covered on a separate page, so this section does not set them out. What matters here is the contract discipline. Ask your implementation partner to confirm in writing that its staff will not act as your certification auditors, and ask the certification body to confirm which of its auditors have advised you. If a conflict surfaces late, the cost is usually a change of auditor or certification body and a delayed certificate, not a paperwork fix. Plan that risk into your timeline now, and treat this as an advisory check, not legal advice: your counsel and the certification body's written impartiality policy have the final say.
What cloud provider certificates cover and what they do not
Microsoft states that a customer seeking ISO/IEC 27001 certification for an implementation built on in-scope Azure services can use Azure's certifications as part of its own assessment. That reliance is limited. The customer remains responsible for engaging an assessor to evaluate its implementation and its own controls and processes, so the provider's certificate supports the customer's assessment without replacing it.
- Provider controls only: Azure's certification covers the controls Microsoft operates for the services in scope, not how you configure, access or monitor them.
- Your implementation: Tenant configuration, identity policies, network rules and data handling remain your evidence to produce.
- Your processes: Risk assessment, supplier management, incident response and access reviews are yours, whatever the cloud platform.
- Assessor engagement: An independent assessor must still evaluate your implementation and processes before a certification body can issue your certificate.
- Documentation: Keep the provider's audit documentation and your scope statement together so the assessor can see which services each control relies on.
Confirm with Microsoft's current compliance documentation which Azure services are in scope for your region and offering, and map each in-scope service to the controls in your Statement of Applicability.
AWS states plainly that customers are not automatically certified because they run workloads on AWS. Its own ISO/IEC 27001:2022 certification may make your certification easier to pursue, because the certified controls under AWS's side of the shared responsibility model do not need to be built again. Your organization still has to earn its own certificate for everything it runs, decides and operates on top of the platform.
- No automatic certification: Using AWS does not transfer your certificate, your scope or your audit obligations to Amazon.
- Shared responsibility: AWS covers the physical and infrastructure layers it operates, while you own configuration, identity, data classification and application security.
- Reduced duplication: Provider audit reports can reduce the number of infrastructure controls you need to test yourself, but only for the services and regions in scope.
- Your management system: Clauses 4 to 10 of the standard, including leadership and internal audit, apply to your organization regardless of the platform.
- Evidence trail: Infrastructure as code, configuration history and access logs are the evidence that ties your controls to the platform.
Confirm with AWS which services and regions are covered by its certificate, and agree the responsibility split for each service your scope includes.
Neither provider's certificate settles your scope on its own. The useful question is which controls the provider inherits, which it shares with you and which remain entirely yours. Put that answer in writing before the certification body reviews your Statement of Applicability, because an unexplained reliance on a provider is a common source of questions during audits.
- Inherited controls: Physical security and infrastructure availability are often inherited from the provider when the service is in scope.
- Shared controls: Patching, backup configuration and logging typically need both parties' evidence.
- Your controls: Policies, roles, training, supplier oversight and incident handling stay with your organization.
- Scope drift: Adding a new service or region can move controls out of the covered scope, so review the mapping whenever the architecture changes.
- Contract terms: Confirm that your provider agreement gives you access to current audit reports and notification of material changes.
Confirm the in-scope services, regions and shared responsibility split with your provider's current documentation and your own architecture before you describe reliance in your audit submission.
How to set the split before you sign anything
This sequence turns the question of who does what into a written split that management approves before any partner is engaged, so that ownership, partner preparation and independence boundaries are settled on paper first.
List every ISO 27001 work package
Start by listing the work packages the certification will require, from the clause 4 to 10 management system tasks (context, leadership, planning, support, operation, performance evaluation, improvement) to the Annex A control groups, the risk assessment and the Statement of Applicability. Include the internal audit, management review and the certification audit itself as separate lines so none is assumed to be covered by another. The output is a single inventory that the leadership team reviews, with each package described in one or two sentences of scope. Confirm the list against the current edition of ISO/IEC 27001:2022 rather than a template from another project.
Assign a named owner to each package
For every package, record one accountable person inside the organization, not a team or a vendor. Management responsibilities such as leadership and commitment, the policy and roles under clause 5 stay with named senior people, because the certification audit tests top management involvement even when an outside firm helps build the system. Operational controls, such as access reviews or change management, usually sit with the staff who run those systems. The output is a responsibility matrix with one owner per row, signed off by the executive sponsor.
Mark packages a partner may prepare
Next, mark which packages an implementation partner may draft, configure or gather evidence for, and which must be performed or decided by your staff. Drafting a policy or building a risk register is typically preparation work; approving the risk treatment decisions, accepting residual risk and signing the Statement of Applicability are not. Supplier-related work under A.5.19 and outsourced development under A.8.30 still needs your own oversight, even when a partner or a cloud provider carries out much of the activity. The output is an annotated matrix with a column for partner preparation and a column for organization approval. Ask the partner to confirm the same split in writing.
Confirm the internal audit provider is independent
If an outside provider will run the internal ISMS audit, confirm in writing that it is not the same firm or the same individual that designed or implemented the ISMS. Independence is a question for the internal audit scope, not only for the certification body, so check the people named, their prior work for you and any freelance auditors they use. Ask the provider to state who audits what and where any conflict would arise. The output is a signed independence statement from the audit provider and an internal audit plan that names the auditor for each area.
Confirm the certification body stands apart
Finally, confirm that the accredited certification body is separate from both the implementation partner and the internal audit provider. Under the rules for accredited ISMS certification bodies, a certification body may not use an auditor who also performs your internal ISMS audit, and other consultancy by its auditors is limited by the separate rules in ISO/IEC 17021-1. Check the accreditation status in the IAF CertSearch database and ask the body for its own conflict of interest declaration. The output is a written scope statement that lists each party, its role and the boundaries agreed, signed before the engagement starts.
What causes an outsourcing split to fail at audit?
Most failed outsourcing splits share one root cause: the organization handed off work it had to own, or it bought independence it later lost. The five patterns below are the ones auditors and certification bodies tend to find, and each card names the check that prevents it.
Partner-written policies management never approves
A partner can draft the information security policy, but clause 5.2 expects top management to establish it, communicate it and make it appropriate to the organization. If the leadership team has never reviewed or signed the policy, the auditor will find a document with no owner. Before handover, ask for a record of the approval meeting, the approver's name and the review date, and confirm that the same leaders receive the policy each cycle.
One person builds and audits the ISMS
When the same individual designs the controls and then performs the internal audit, the internal audit no longer checks the system independently. Under ISO/IEC 27006-1, a certification body cannot use an auditor who also performs the client's internal ISMS audit, so the conflict surfaces at certification. Separate the roles: the implementer prepares controls and evidence, and a different person or provider runs the internal audit.
The certification body is also the consultant
Some organizations ask the firm that will certify them to write the ISMS, run the gap analysis or perform pre-audits. This can breach the independence rules that apply to the certification body. Before signing, ask the certification body in writing whether it or any of its auditors has provided consultancy to you, and keep the implementer and the certifier as separate contracts.
Cloud certificates assumed to cover the whole ISMS
A provider's ISO/IEC 27001 certificate covers its own services and infrastructure. Microsoft states that a customer can use Azure's certifications in its assessment but remains responsible for an assessor evaluating its own implementation and processes. Identify which controls the cloud provider operates, which ones your team configures and which ones are purely procedural, and document that split in the Statement of Applicability.
No owner for the Statement of Applicability after handover
The Statement of Applicability records which Annex A controls apply, why, and how each is implemented. Once the implementation partner leaves, the document often goes stale as systems, suppliers and staff change. Name an internal owner, set a review trigger for changes to scope, suppliers and controls, and confirm that the SoA still matches the evidence in the room during the audit.
Questions buyers ask about outsourcing ISO 27001
Can an implementation partner certify us to ISO 27001?
No. An implementation partner cannot certify you. Only an accredited certification body can issue an ISO 27001 certificate after an independent audit, and ISO itself does not certify organizations. A partner prepares your ISMS, policies, risk assessment, Statement of Applicability and evidence so that the certification body can test them. Before you sign anything, check that the certification body is accredited for ISO/IEC 27001 and that its certificates appear in the IAF CertSearch database. Ask the partner in writing which parts of the work it performs and which parts remain your organization's responsibility.
Can the same firm build our ISMS and also run our internal audit?
Usually not, if you intend to be certified by a body that must stay independent. ISO/IEC 27006-1 clause 5.2.2 bars a certification body from using an auditor who also performs your internal ISMS audit, and that rule has no two-year mitigation period under the standard. Consultancy by freelance auditors is governed by ISO/IEC 17021-1 clause 5.2.10. In practice, separate the roles: the firm that designs and implements the ISMS should not also be the one that judges its effectiveness. Ask any internal audit provider to confirm in writing whether it has advised on the same controls, and ask your certification body to confirm its own independence position before work starts.
What does an outsourced ISO 27001 project still need from our team?
Clause 5 of ISO/IEC 27001:2022 makes top management responsible for leadership and commitment, the policy, and organizational roles and authorities, so leadership involvement is audited even when a consultant does the writing. Your team must still own the decisions and the operating work:
- Top management approves the scope, the risk acceptance decisions and the policy.
- Named control owners run access reviews, change approvals, vendor reviews and incident handling.
- Staff produce the records that show controls working day to day.
- Someone internal holds the Statement of Applicability and answers auditor questions.
A partner can prepare templates and evidence, but the controls only pass an audit if your people operate them over time. Ask a partner to map each deliverable to a named owner in your organization.
Does our cloud provider's ISO 27001 certificate cover our ISMS?
No. A cloud provider's certificate covers the provider's own information security management system for the services in its scope. Microsoft states that a customer pursuing certification for an implementation on in-scope Azure services can use Azure's certifications as part of its assessment, but the customer remains responsible for engaging an assessor to evaluate its own implementation, controls and processes. AWS similarly states that customers are not automatically certified because they use AWS, though AWS's certification may make your own certification easier. Your organization still needs to define the scope, configure identity, logging, backups and access, and produce evidence for those settings. Read the provider's shared responsibility documentation and confirm which services are in its certificate scope.
What changes if we have no dedicated security staff?
The governance and evidence work does not disappear, so it has to be assigned. Without security staff, the usual approach is to name an accountable executive, assign each Annex A control to an existing role, and bring in outside help for the parts that need specialist capacity, such as the risk assessment method, the supplier review process or the technical configuration. Clause 5.3 requires that roles, responsibilities and authorities be assigned and communicated, and A.5.2 expects information security roles to be defined. A fractional security leader can hold some of these responsibilities, but accountability stays with top management. Ask any provider how the work will be handed over, what internal time it assumes, and what the organization must run after the project ends.
How do I confirm a consultant's independence before signing?
Ask for the answers in writing before the engagement starts. Confirm four points: which certification body you will use and whether that body has also provided consultancy, gap analysis or pre-audit work to you; whether the consultant or any of its auditors will perform your internal audit; whether the consultant plans to audit its own implementation; and whether any individual freelance auditor on the team has a conflict with the certification body. ISO/IEC 27006-1 and ISO/IEC 17021-1 set the rules, and European Accreditation's published FAQs explain how they apply. Make the answers part of the statement of work so the boundaries are contractual, not informal.
What should a quote for outsourced ISO 27001 work include?
A useful quote separates one-time work from recurring work and names the deliverables. One-time work usually covers the gap analysis, risk assessment method, ISMS documentation, control implementation, evidence design, internal audit preparation and support during the certification audit. Recurring work covers surveillance support, internal audits in later years, management review preparation and control operation. Costs rise with the number of sites, the size of the scope, the number of systems and suppliers, and how much technical configuration is included. Ask for the scope in writing, the named deliverables, who performs each task, what your team must provide, and what is excluded. Fixed-scope agreements make these boundaries easier to compare between providers.
How DeployOpen splits ISO 27001 work with your team
DeployOpen works on the infrastructure and tooling side of ISO 27001 for What to outsource for ISO 27001 and what to keep in-house, inside your own cloud accounts, data centers or air-gapped networks. Your management keeps ownership of the ISMS and its decisions, while we prepare systems, controls and evidence for the assessment your independent certification body carries out.
How we scope
- We agree in writing which systems, controls and evidence sources fall within the work before any build starts.
- We record which responsibilities stay with your management and which are delegated to DeployOpen or other providers.
- Engagements are fixed-scope, so deliverables and timelines are confirmed in the written scope before work begins.
How we build
- We implement and configure self-hosted open-source platforms that run the technical controls agreed in the scope.
- We set up logging, access and configuration records so that evidence is generated as systems operate, not assembled later.
- We run security testing against the in-scope systems and document the findings for your own risk decisions.
How we hand over
- We document the configurations, procedures and evidence locations so your staff can operate and explain them to an auditor.
- We walk your owners through each control and its evidence, so accountability for the ISMS remains with your organization.
- We do not issue audit reports, attestations or certificates; your independent auditor or certification body makes that determination.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after the initial handover.
- Retainer scope is set in writing, covering which systems and evidence streams it includes and how often they are reviewed.
- Ask any provider, including us, to confirm in writing which tasks are theirs and which remain with your team before signing.
