Cyber & ISO · Run by practising lead auditors
ISO 27001 Managed ISMS
Your certified ISO 27001 system run month by month: risk reviews, policy upkeep, evidence, the internal audit cycle and audit season, all handled by practising lead auditors with a named senior owner. From £2,500 + VAT per month, fixed by scope, and documented so you can take it back in house whenever you choose.
The service at a glance
Definition
What is a managed ISMS?
A managed ISMS is your certified ISO 27001 information security management system run for you month by month: the risk register reviewed, policies and controls kept current, evidence filed as it is generated, the mandatory internal audit cycle delivered, and surveillance audits met without a scramble. It exists because the hardest part of ISO 27001 is not getting certified. It is still deserving the certificate two years later.
Intelance runs managed ISMSs from £2,500 + VAT per month, fixed by scope, with a named senior owner and internal audits kept independent of the team operating the controls. Everything lives in your tools and is documented for handover, so the service is also called an ISO 27001 managed service, an outsourced ISMS or ISMS as a service. The work is the same.
Not certified yet? The route starts with the gap assessment and ISMS Foundations. The wider practice is described under ISO 27001 consulting.
One senior person accountable
One accountable person runs your system, month after month.
Independence kept intact
Internal audits kept separate from the people operating the controls.
Evidence as a by-product
Filed as the rhythm runs, so audit season is a review rather than a rescue.
Yours to take back
The system, records and evidence stay in your tools, documented for handover.
The rhythm
The monthly rhythm
Six standing jobs keep a certificate deserved. Each card shows the output your next auditor will look for.
Risk reviews
The register reviewed on schedule, new risks captured, and treatments tracked to completion rather than to a spreadsheet nobody reopens.
The outputA living register the certification body recognises as genuinely used.Policy and control upkeep
Policies reviewed on their cycle, controls adjusted as the business changes, exceptions documented properly rather than remembered.
The outputDocuments that match reality, dated within their review cycle.Evidence keeping
Minutes, logs, approvals and records filed as they happen, against the controls they prove.
The outputAn audit trail that exists before anyone asks for it.The internal audit cycle
The mandatory internal audits planned and delivered across the certificate cycle, kept independent of the team operating the controls.
The outputFindings surfaced by us before the certification body surfaces them.Management reviews
Prepared, chaired if you wish, minuted and actioned, on the cadence the standard expects.
The outputA review record that shows leadership genuinely engaged.Audit season
Surveillance and recertification handled end to end: evidence packs, auditor liaison and findings closed.
The outputAudits that pass without a fortnight of panic.How it works
A three year certificate kept for all three years
The certificate cycle is take-on, rhythm, two surveillance audits and recertification. The service is built around that calendar.
Take-on
The system, records and audit calendar mapped, gaps triaged, and the rhythm agreed with a named senior owner.
The rhythm
Risk reviews, upkeep, evidence and the audit cycle running to schedule, reported to you every month.
Surveillance one
Met from the running rhythm: evidence ready, findings closed, nothing rebuilt the week before.
Surveillance two
The same again, with the system improving between visits rather than decaying.
Recertification
The full audit met by a system that has genuinely run for three years. Then the next cycle begins.
Take-on works from whatever state the system is in, including mid-cycle rescues after an ISMS owner resigns. Where evidence has already slipped, the internal audit establishes the position first.
Published fees
Routes if you are not certified yet
The managed service assumes a certificate exists. Every other position on the journey is priced here.
ISO 27001 Gap Assessment
Not certified yet? The assessment measures the distance and prices the whole journey, before anything is committed.Best whenYou are starting cold, or working from a guess. FeeFrom £8,500 + VAT1 to 2 weeks 02
ISMS Foundations & Implementation
The end to end build by practising lead auditors, running before Stage 1. The managed service can then take over the rhythm, or your team keeps it.Best whenCertification is the goal and the system does not exist yet. FeeFrom £25,000 + VAT3 to 6 months 03
ISO 27001 Internal Audit
The narrower engagement: the mandatory internal audit delivered by qualified lead auditors, without the monthly service around it.Best whenThe team runs the ISMS and only independence is missing. FeeFrom £4,500 + VAT1 to 2 weeks 04
ISO/IEC 42001 for AI
The AI management system standard, run on the same monthly rhythm and evidence base as your ISO 27001 system.Best whenCustomers or regulators are asking about AI governance too. FeeAIMS implementationPriced by scope
The alternatives
The routes compared
Three ways to keep a certificate alive. The difference shows up in year two, at the surveillance audit.
The ISMS added to the day job of whoever seemed most willing
Free on paper, paid for in decay and audit season panic
Reviews slip, evidence gaps grow, and the certificate decays quietly
Small scopes with genuine slack and discipline
A dedicated information security manager on payroll
A full salary plus employer costs, if you can hire one
Holidays, resignation, and one person auditing their own work
Organisations with a full time book of security work
Practising lead auditors running the rhythm, from £2,500 + VAT per month
Fixed by scope, agreed in writing, no lock-in
Designed out: a named owner, independent audits, documented handover
Certified organisations that want the certificate kept without the headcount
Scope
What the fee covers and what sits outside it
You get
One senior person accountable, accountable to you monthly, running the whole rhythm.
The six standing jobs run to schedule: risk, upkeep, evidence, internal audit, review, audit season.
Internal audits kept independent of the people operating the controls.
Audit season handled end to end: evidence packs, auditor liaison, findings closed.
A documented handover from month one, so taking it back in house is a decision, never a rescue.
This is not
A lock-in. The system, records and evidence stay in your tools, and there is no minimum beyond take-on.
A certificate rental. The ISMS is yours. We run it. We never own it.
An MSP or helpdesk. We run the management system. Your IT estate stays with your team.
A substitute for leadership. Management review needs your managers in the room. We make that easy, never optional.
Where to start
The situations that bring people here
Four situations we are usually called into. If none of them fit, speak to a lead auditor and we will point you at the right first step.
Why Intelance
What you can expect from a licensed body
Run by practising lead auditors
The people keeping your rhythm audit against ISO 27001 for a living, so the system is maintained the way it will be examined.
Independence built in
Internal audits are delivered separately from the team operating the controls, which is precisely what a single in-house hire cannot offer.
One senior person accountable
One accountable person, month after month, so context never resets and nothing falls between visits.
A fee set by scope and published
From £2,500 + VAT per month, fixed and agreed in writing, with the drivers of the fee stated plainly.
The exit is a feature
Everything lives in your tools with the handover documented from month one. Organisations that build an in-house team leave cleanly, and some do.
The people behind the work
Every managed system has a named owner, with qualified auditors delivering the audit cycle separately. Nothing is offshored and nothing sits in a queue.
ISO 27001 guides
All insights
ISO 27001ISO 27001 cost UK: what certification really costs (2026)
The real components of ISO 27001 cost in the UK: consultancy fees, certification body charges over the three year cycle, internal time, ongoing running costs, and where budgets quietly drift.
10 July 2026 · 6 min read Read the guide
CybersecurityISO 27001 readiness assessment checklist (UK)
8 December 2025 · 11 min read
Cyber EssentialsCyber Essentials vs ISO 27001 vs IASME Cyber Assurance: which do you need?
9 July 2026 · 6 min read
Cyber EssentialsCyber Essentials vs ISO 27001: when you need one, both, and in what order
23 March 2026 · 10 min readReady to talk?
Tell us who runs it today
Thirty minutes with the person who would own your system: who runs it now, when the next audit lands and what has already slipped. If your ISMS owner has just resigned, say so: take-on is designed for exactly that month.
FAQs
Questions about the managed service
What is a managed ISMS?
Your certified ISO 27001 system run for you month by month: risk reviews, policy and control upkeep, evidence keeping, the mandatory internal audit cycle, management reviews and audit season, all delivered by practising lead auditors with a named senior owner. The system, records and evidence remain yours throughout.
How much does a managed ISMS cost?
From £2,500 + VAT per month with Intelance, fixed by scope and agreed in writing. The fee is driven by the size of the estate, the number of controls in play and how much of the rhythm you keep in house. There is no lock-in beyond take-on.
What gets done each month?
Six standing jobs: the risk register reviewed and treatments tracked, policies and controls kept current, evidence filed as it is generated, the internal audit cycle delivered, management reviews prepared and minuted, and audit season handled when it arrives. You receive a monthly report against all six.
Is this the same as an outsourced ISMS or ISMS as a service?
Yes. Managed ISMS, ISO 27001 managed service, outsourced ISMS and ISMS as a service all describe the same arrangement. The tests that matter are a named owner, independent internal audits, evidence kept in your tools and a documented route to take it back in house.
How does take-on work?
Inside a month: the system, records and audit calendar are mapped, gaps triaged, and the rhythm agreed with your named owner. Take-on works from whatever state the system is in, including mid-cycle rescues after an ISMS owner resigns.
Can internal audits be independent if you also run the ISMS?
Yes, and it is designed in: the auditors who deliver your internal audit cycle are kept separate from the person running your monthly rhythm. That separation is exactly what a single in-house ISMS manager cannot provide, and certification bodies notice.
What happens at surveillance audits?
They are met from the running rhythm: the evidence already filed, findings already closed, the auditor liaison handled by us. Surveillance in years two and three, and recertification at the end of the cycle, are calendar events rather than emergencies.
Can we take it back in house later?
Yes, cleanly. Everything lives in your tools, the handover is documented from month one, and organisations that build an in-house team leave with a running system rather than a dependency. The exit is a feature of the service, and some clients use it.
Do we need to be certified already?
The managed service assumes a certificate exists. Starting from zero, the route is the gap assessment from £8,500 + VAT, then ISMS Foundations from £25,000, and the managed service can take over the rhythm after certification if you want it run for you.