Cyber & ISO · Led by practising lead auditors
ISO 27001 Consulting
ISO 27001 consulting from gap to certificate to staying certified: readiness, risk, implementation, the mandatory internal audit and managed operation, all led by practising lead auditors with every fee published. The whole cost is stated up front, including the certification body fees that other firms leave for you to discover.
The practice at a glance
Definition
What is ISO 27001 consulting?
ISO 27001 consulting is expert support across the life of an information security management system: assessing the gap against the standard, building the scope, risk process, controls and operating rhythm, running the mandatory internal audit, preparing for the certification audits, and keeping the system alive afterwards. Certification itself is issued only by an independent, UKAS accredited certification body. A consultant who claims to sell the certificate is selling something weaker.
With Intelance, end to end programmes run from £25,000 + VAT depending on scope and complexity, over three to six months. Standalone services start lower: the gap assessment from £8,500, risk assessment from £7,500, internal audit from £4,500 and the Managed ISMS from £2,500 per month. Certification body fees are separate, usually £4,000 to £12,000 across the three year cycle, and we state the whole cost including theirs before you commit.
Every engagement is led by practising lead auditors, which is why the systems we build pass the audits we do not run. Our readiness checklist shows what Stage 1 expects, and the wider practice is described under cyber assurance.
One practice for the whole route
Gap, risk, build, internal audit and managed operation under one roof.
Lead auditors on every job
Built the way it will be examined, by people who examine for a living.
Every fee published
Fixed before work starts, with certification body costs stated alongside.
Honest about the route
Where Cyber Essentials answers the ask, we say so and save you months.
The situations
Six moments organisations call an ISO 27001 consultant
Each one maps to a specific service with a published fee, so the response matches the moment rather than a retainer.
A customer demands certification
A contract, tender or enterprise security review names ISO 27001, with a date attached and no room for interpretation.
The serviceThe gap assessment first, then the programme sequenced backwards from the date.Starting completely cold
No ISMS, no scope, no idea whether the job is three months or nine, and a board asking what it will cost.
The serviceThe gap assessment prices everything precisely, from £8,500 + VAT in one to two weeks.The risk assessment is overdue
The register is stale, or it was built for an auditor rather than the business, and nobody trusts what it says.
The serviceA risk assessment your team can repeat without us, from £7,500 + VAT.Stage 2 is coming and nobody has audited yet
The internal audit is mandatory, and certification bodies check for it. Skipping it is how surprises reach Stage 2.
The serviceA practising lead auditor against the full standard, from £4,500 + VAT.Certified but the workload is unsustainable
Reviews, audits, supplier checks and evidence swallowing diaries that were never resourced for it.
The serviceThe Managed ISMS runs it all from £2,500 + VAT per month, with the exit designed in.The certificate is at risk
Nonconformities on the table, a surveillance audit gone badly, or a certification body asking hard questions.
The serviceFindings triaged and fixed by lead auditors before the certification body returns.How it works
Gap to certificate in five clear steps
The plan is sequenced backwards from the day the certificate must exist, and every step has its fee published before it starts.
Gap assessment
Every requirement of ISO/IEC 27001:2022 checked against what exists, ending in a costed, sequenced plan.
ISMS Foundations
The system built and operating: scope, risks, SoA, controls and the management rhythm, running before Stage 1.
Internal audit
The mandatory internal audit by a practising lead auditor, with findings fixed while there is still time.
Certification
Stage 1 and Stage 2 with a UKAS accredited body, typically £4,000 to £12,000 across three years, stated up front.
Stay certified
Surveillance audits, annual internal audits and the rhythm carrying on: yours to run, or managed from £2,500 per month.
The hardest part of ISO 27001 is not getting certified. It is staying certified. Years two and three are designed in from the start, whether your team runs the rhythm or the Managed ISMS does.
Published fees
The ISO 27001 fees in full
Take one service or take the route. Each stands alone, and the evidence carries between them.
ISO 27001 Gap Assessment
Every requirement checked against what exists, with a costed, sequenced plan to close the gaps. The sensible first step for anyone starting cold.Best whenYou need the size of the job before committing to it. FeeFrom £8,500 + VAT1 to 2 weeks 02
ISMS Foundations & Implementation
The end to end build by practising lead auditors: scope, risk machinery, SoA, controls and an operating rhythm, running before Stage 1.Best whenCertification is the goal and a deadline exists. FeeFrom £25,000 + VAT3 to 6 months 03
ISO 27001 Internal Audit
The mandatory internal audit delivered by qualified lead auditors, so problems surface while there is still time to fix them.Best whenStage 2 or a surveillance audit is approaching. FeeFrom £4,500 + VAT1 to 2 weeks 04
Managed ISMS
Reviews, policy updates, internal audits, supplier checks and audit season handled month by month, because the hardest part of ISO 27001 is staying certified.Best whenThe certificate exists and the diary space does not. FeeFrom £2,500 + VAT / month 05ISO/IEC 42001 for AI
The AI management system standard, implemented alongside or on top of ISO 27001, sharing the same rhythm and evidence.Best whenCustomers or regulators are asking about AI governance too. FeeAIMS implementationPriced by scope 06
Cyber Essentials & CE Plus
The UK baseline, certified by our own IASME licensed assessors at official fees. Often the right answer when the customer just wants hygiene proven.Best whenThe ask is a UK supply chain requirement rather than a management system. FeeFrom £320 + VAT official feeDays
The alternatives
What is the contract demanding?
Cyber Essentials, SOC 2 and ISO 27001 answer different questions. Matching the certificate to the ask saves months and five figures.
Baseline technical hygiene across five controls, renewed annually
Days, from £320 + VAT at the official fee
UK government contracts and supply chains
The ask is proven hygiene, quickly
Controls relevant to service organisations, reported under US style attestation
Months, with the auditor report typically from £20,000 a year all in
US customers and SaaS procurement
Your buyers are American and name it
A full information security management system, certified to the international standard
Three to six months, programmes from £25,000 + VAT plus certification body fees
Enterprise customers, regulators and tenders across the UK and EU
Customers want systemic, certified, independently audited assurance
Scope
What the fee covers and what sits outside it
You get
One practice across the whole route: gap, risk, build, internal audit and managed operation.
Practising lead auditors on every engagement, building systems the way they will be examined.
Published, fixed fees for every service, agreed before work starts.
The whole cost stated up front, including the certification body fees other firms leave out.
A system your team runs, with the Managed ISMS as an option rather than a dependency.
This is not
A template shop. Every document is written for your organisation and argued against your risks.
A certificate for sale. Only UKAS accredited bodies certify ISO 27001. We prepare you, audit you internally and state their fees. Anyone selling the certificate directly is selling something weaker.
Open ended day rates. Every service has a published fee, fixed by scope before it begins.
Certification theatre. Where Cyber Essentials or IASME Cyber Assurance answers the ask, we say so and save you months.
Where to start
The situations that bring people here
Four situations we are usually called into. If none of them fit, speak to a lead auditor and we will point you at the right first step.
Why Intelance
What you can expect from a licensed body
Practising lead auditors
Every engagement is led by people who audit against ISO 27001 for a living, which is why the systems we build pass the audits we do not run.
The whole cost up front
Our fees are fixed and published. The certification body’s, usually £4,000 to £12,000 across three years, are stated beside them before you commit.
The right rung first
Sometimes Cyber Essentials or IASME Cyber Assurance answers the customer at a fraction of the cost and time. We say so before your money moves.
Built to pass Stage 2
Systems run before the audit: reviews held, risks treated, evidence accumulating. Certification bodies audit what happens, and what happens is the evidence.
One practice with shared evidence
Cyber Essentials, ISO 27001, ISO 42001 for AI and supplier assurance share one team and one evidence base, so nothing is explained twice.
The people behind the work
Every engagement is led by a practising lead auditor, with senior consultants beside your team. Nothing is offshored and nothing is templated.
ISO 27001 guides
All insights
Cyber EssentialsISO 27001 vs SOC 2 vs Cyber Essentials: which your buyer wants
What buyers mean when they ask for security certification, how the three compare on what matters commercially, and which to buy for which market.
25 July 2026 · 8 min read Read the guide
ISO 27001ISO 27001 internal audit: what auditors check
11 July 2026 · 5 min read
ISO 27001How long does ISO 27001 take? Realistic timelines
11 July 2026 · 5 min read
ISO 27001ISO 27001 certification process: gap analysis to certificate
11 July 2026 · 6 min read
ISO 27001ISO 27001 cost UK: what certification really costs (2026)
10 July 2026 · 6 min readReady to talk?
Tell us where you are in the process
Thirty minutes with a lead auditor on who wants the certificate, what they asked for and the date it must exist by. If the right answer is a lighter route, you will hear it in that call.
FAQs
ISO 27001 questions answered
What is ISO 27001 consulting?
Expert support across the life of an information security management system: gap assessment against the standard, the risk process, implementation of controls and the operating rhythm, the mandatory internal audit, preparation for the certification audits, and keeping the system alive afterwards. Certification itself is issued only by a UKAS accredited certification body.
How much does ISO 27001 consulting cost?
With Intelance: the gap assessment from £8,500 + VAT, risk assessment from £7,500, end to end programmes from £25,000, internal audit from £4,500 and the Managed ISMS from £2,500 per month. All fixed before work starts. Certification body fees are separate, usually £4,000 to £12,000 across the three year cycle, and we state the whole cost up front.
How long does it take to get ISO 27001 certified?
Three to six months end to end for most single site scopes, sequenced backwards from your deadline, including months of the ISMS genuinely operating before Stage 1. Larger and multi site scopes take longer, and we say so at the gap assessment rather than at month five.
Do we need a consultant at all?
Not always. A strong internal team with time, a simple scope and someone who has done it before can self implement. A consultant earns the fee when there is a deadline, no in house audit experience, or a scope that touches customers who will scrutinise the certificate. The gap assessment answers the question either way.
Cyber Essentials or ISO 27001?
Different questions. Cyber Essentials proves baseline technical hygiene in days from £320 + VAT. ISO 27001 proves a full management system in months for five figures. If the customer only asked for hygiene, Cyber Essentials answers it, and we certify it ourselves. Our guide to Cyber Essentials vs ISO 27001 sets out the order that usually works.
SOC 2 or ISO 27001?
SOC 2 is a US style attestation that American buyers ask for, typically from £20,000 a year all in for the auditor’s report. ISO 27001 is the international certification that UK and EU enterprise customers name in contracts. Organisations selling into both markets often need both, and the underlying controls overlap heavily, so the evidence is built once.
Who certifies us?
An independent, UKAS accredited certification body, never the consultant. We prepare you, run the internal audit and support both stages, and their fees are stated up front. Non accredited certificates exist and cost less, and many contracts and insurers reject them.
What is a managed ISMS?
The running of your certified system, month by month: management reviews chaired, the risk register maintained, internal audits scheduled, supplier checks done and audit season handled, from £2,500 + VAT per month. It exists because the hardest part of ISO 27001 is not getting certified, it is staying certified.
What about AI: does ISO 27001 cover it?
Partly. ISO 27001 governs information security. ISO/IEC 42001 is the management system standard for AI itself, and regulators and customers increasingly ask about both. We implement ISO 42001 alongside or on top of ISO 27001, sharing the same rhythm and evidence, and our guide to the EU AI Act and ISO 42001 explains how they fit together.