Cyber & ISO · Built by practising lead auditors
ISO 27001 ISMS Foundations & Implementation
ISO 27001 implementation that certifies because it already runs: scope, risk machinery, the Statement of Applicability, controls and an operating rhythm, built by practising lead auditors and running before the certification body ever arrives. From £25,000 + VAT fixed by scope, three to six months, sequenced backwards from the day you need the certificate.
The build at a glance
Definition
What does ISO 27001 implementation involve?
ISO 27001 implementation is the building of a working information security management system: the scope and context defined, a repeatable risk process, the Statement of Applicability and Annex A controls in place, and a management rhythm that generates its own evidence. Certification then audits what already runs. An ISMS built as documents fails at Stage 2. An ISMS built as a routine passes, because the evidence accumulated while it ran.
Intelance delivers ISMS Foundations end to end from £25,000 + VAT, fixed by scope and agreed before work starts, over three to six months sequenced backwards from your deadline. The gap assessment from £8,500 + VAT prices the build precisely. Certification body fees are separate, typically £4,000 to £12,000 across three years with a UKAS accredited body, and we state them up front.
Every document is written for your organisation by practising lead auditors, and your team runs the system before we leave. Our readiness checklist shows what Stage 1 expects, and the wider practice is described under cyber assurance.
Built the way it will be audited
Practising lead auditors build it, so nothing surprises the certification body.
Running before Stage 1
Reviews held, risks treated and incidents handled before the first audit.
Evidence that builds itself
The operating rhythm generates the Stage 2 trail as a by-product.
Yours from month three
Your team runs the system before we leave. The exit is designed in.
The anatomy
Six things a real ISMS is made of
Template kits copy the documents and miss the system. These six parts are what a certification body audits, and each card shows the output the build leaves behind.
Scope and context
What the ISMS covers and why: the business, its dependencies, its interested parties and boundaries a certification body will accept.
OutputA scope statement that survives Stage 1 scrutiny.The risk process
A risk assessment and treatment method your team can repeat without us, run at least once for real before any audit.
OutputA living risk register your team maintains.Policies and controls
The Statement of Applicability and the Annex A controls that apply, implemented and mapped to evidence, with every exclusion argued.
OutputAn SoA an auditor can walk through without translation.The running routine
Management review, internal audit schedule, incident handling and improvement, living in diaries rather than in documents.
OutputAn ISMS that runs monthly rather than existing on paper.The proving layer
Evidence generated by the routine itself: minutes, logs, decisions and audit trails that accumulate as the system runs.
OutputA Stage 2 evidence trail that built itself.Certification support
A UKAS accredited certification body selected, the audits booked, and your team prepared for both stages.
OutputStage 1 and Stage 2 with no surprises in the room.How it works
Three to six months sequenced backwards from your deadline
The plan starts from the day the certificate must exist and works back, which is why the first call is about dates.
Foundations
Scope, context, the risk method and the SoA skeleton, agreed with the people who will live with them.
The build
Policies and controls implemented and mapped to evidence, written for your organisation rather than copied from a kit.
Operate in
The ISMS runs for real: management review held, risks treated, incidents handled, evidence accumulating by itself.
Prove it
An internal audit against the full standard by a practising lead auditor, with findings fixed while there is still time.
Certify
Stage 1 and Stage 2 with a UKAS accredited certification body, typically £4,000 to £12,000 across three years, stated up front.
The operate in phase is the difference between passing and failing Stage 2: certification bodies audit what happens, and what happens is the evidence. A recent gap assessment shortens the whole sequence.
Published fees
What runs alongside the build
Every route in and out of the build is priced here, before you ask.
ISO 27001 Gap Assessment
One to two weeks against the full standard: what exists, what is missing, and exactly where in the from £25,000 band your build lands, so the fixed fee is precise rather than padded.Best whenYou want the build priced exactly before committing to it. FeeFrom £8,500 + VAT1 to 2 weeks 02
ISO 27001 Internal Audit
A practising lead auditor against the full standard: the mandatory internal audit done properly, with findings you can fix before the certification body sees them.Best whenThe ISMS exists and Stage 2 is coming, or the annual audit is due. FeeFrom £4,500 + VAT1 to 2 weeks 03
Managed ISMS
The ISMS run for you month by month: reviews chaired, risks maintained, audits scheduled, evidence kept, with the exit designed in.Best whenCertification matters but nobody has the diary space to run the system. FeeFrom £2,500 + VAT / month 04ISO 27001 Consulting
The whole practice: gap assessment, risk work, implementation, audit and managed operation, with every fee published.Best whenYou want the full picture before choosing an entry point. FeeGap from £8,500 + VATThe alternatives
The routes compared
Three ways organisations attempt ISO 27001. The difference is what survives Stage 2.
A folder of policies with your logo, bought online for three figures
Documents nobody follows, found out in the first interview
Cheap until the failed audit and the rebuild
Tiny scopes with real internal expertise and time
A consultant on day rates, writing documents until the budget runs out
Depends entirely on who you got and when they rolled off
Open ended by design
Augmenting a strong in house ISMS team
A working ISMS built by practising lead auditors, from £25,000 + VAT fixed
A system that has already run: reviews held, risks treated, evidence accumulated
Fixed by scope before work starts, certification body fees stated up front
Organisations that need certification to hold, on a deadline
Scope
What the fee covers and what sits outside it
You get
Scope, context and a risk method agreed with the people who will live with them, and run once for real.
The SoA and Annex A controls implemented and mapped to evidence, with every exclusion argued.
An operating rhythm in diaries: management review, internal audit schedule, incidents and improvement.
An internal audit by a practising lead auditor before Stage 1, with findings fixed in time.
Certification body selection and both stages supported, with the three year cost stated up front.
This is not
A template kit. Every document is written for your organisation and argued against your risks.
A paper ISMS. The system runs before Stage 1, because certification bodies audit what happens.
Open ended. From £25,000 + VAT fixed by scope, and the gap assessment prices it precisely.
A dependency. Your team runs the ISMS from month three. The Managed ISMS exists only if you want it run for you.
Where to start
The situations that bring people here
Four situations we are usually called into. If none of them fit, speak to a lead auditor and we will point you at the right first step.
Why Intelance
What you can expect from a licensed body
Built by practising lead auditors
The people building your ISMS audit against ISO 27001 for a living, so everything is built the way it will be examined.
Running before Stage 1
Certification bodies audit what happens. The ISMS operates for months before the first audit, so the evidence trail builds itself.
A precise fixed fee
From £25,000 + VAT by scope, agreed before work starts. The gap assessment from £8,500 tells you exactly where in the band your build lands.
Certification costs stated up front
The certification body is separate and UKAS accredited, typically £4,000 to £12,000 across three years. You see the whole cost before you commit.
Yours from month three
Your team chairs the reviews, treats the risks and runs the audits before we leave. The Managed ISMS exists for those who want it run, and it is entirely optional.
The people behind the work
Every build is led by a practising lead auditor, with senior consultants beside your team. Nothing is offshored and nothing is templated.
ISO 27001 guides
All insights
ISO 27001ISO 27001 cost UK: what certification really costs (2026)
The real components of ISO 27001 cost in the UK: consultancy fees, certification body charges over the three year cycle, internal time, ongoing running costs, and where budgets quietly drift.
10 July 2026 · 6 min read Read the guide
CybersecurityISO 27001 readiness assessment checklist (UK)
8 December 2025 · 11 min read
Cyber EssentialsCyber Essentials vs ISO 27001 vs IASME Cyber Assurance: which do you need?
9 July 2026 · 6 min read
Cyber EssentialsCyber Essentials vs ISO 27001: when you need one, both, and in what order
23 March 2026 · 10 min readReady to talk?
Tell us the deadline first
Thirty minutes with a lead auditor on who requires the certificate and the date it must exist by. The plan is sequenced backwards from that date, and three to six months usually holds if we start now.
FAQs
Questions about the implementation
What does ISO 27001 implementation involve?
Building a working information security management system: scope and context defined, a repeatable risk process, the Statement of Applicability and Annex A controls implemented, and a management rhythm of reviews, audits and improvement that generates its own evidence. Certification then audits what already runs.
How much does ISO 27001 implementation cost?
With Intelance, ISMS Foundations runs from £25,000 + VAT, fixed by scope and agreed before work starts. The gap assessment from £8,500 + VAT prices the build precisely. Certification body fees are separate, typically £4,000 to £12,000 across the three year cycle with a UKAS accredited body, and we state them before you commit.
How long does ISO 27001 implementation take?
Three to six months for most single site scopes, sequenced backwards from your deadline. Larger and multi site scopes take longer. The sequence includes months of the ISMS genuinely operating before Stage 1, because that operating period is what generates the Stage 2 evidence.
What is an ISMS?
An information security management system: the scope, risk process, controls, policies and management routine through which an organisation runs its security. The documents describe the system. They are not the system. A certification body audits the running, which is why a folder of policies fails Stage 2.
Do you use templates?
No kit is involved. Structures follow the standard, so some skeletons repeat, but every scope statement, risk assessment, SoA and policy is written for your organisation by a practising lead auditor and argued against your actual risks. Auditors recognise template kits instantly, and they test them hardest.
What are Stage 1 and Stage 2?
Stage 1 is the certification body’s documentation and readiness review: scope, SoA, risk process and the management rhythm. Stage 2 is the full audit of the system in operation: evidence, interviews and records. Passing Stage 2 earns the certificate, followed by surveillance audits in years two and three.
Can we get certified faster than three months?
Rarely, and we say so rather than sell it. The system has to run long enough to generate real evidence: reviews held, risks treated, an internal audit completed. Racing that clock is how organisations arrive at Stage 2 with a paper ISMS. If the deadline is brutal, the honest conversation is scope.
Who performs the certification audit?
An independent, UKAS accredited certification body, chosen with you and booked as part of the build. Their fees, typically £4,000 to £12,000 across three years, are separate from ours and stated up front. UKAS accreditation matters: many contracts and insurers reject non accredited certificates.
What happens after certification?
Surveillance audits in years two and three, an internal audit at least annually, and the management rhythm carrying on. Your team runs it by design. Where diary space does not exist, the Managed ISMS runs the system for you from £2,500 + VAT per month, with the exit designed in.