How do we…
How do we decide whether our own people, a consultant or both do the ISO 27001 implementation work?
Add to board memoOpen the memo
The short answer
- Recommendation
- Keep ownership in-house: name an ISMS manager with time, then buy only what closes a specific gap in skills, hours or independence, for named tasks. Never let the builder audit the system.
- Reasoning
- The pack treats internal effort as the largest cost and says neither consultancy nor software is required by the standard or by the certification body. The records an auditor samples must come from your own people running controls, so a consultant can speed up the writing but cannot produce the history. The pack also says a consultant who helped build the ISMS may not audit what they built.
- Considerations
- Consultancy fees vary widely and public figures come from vendors. This answer sets criteria, not prices. Get written quotes for named tasks.
- The standard and the accreditation rules are paywalled. The impartiality limits here come from the pack and public summaries, so confirm them with your certification body.
- Top management still approves the scope, policy and resources whoever drafts them.
The decision, step by step
Select any step for the reasoning behind it and where the pack covers it.
- Start
- Step
- Decision
- Outcome
- Loop back
Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.
Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.
Read as text
The same flow written out: each step, its reasoning and where the pack covers it. 21 steps.
Start
We are deciding who does the ISO 27001 work
The standard does not require a consultant, and neither does the certification body. The real choice is which parts of the work stay with your people and which you buy in. Settle it before you ask for quotes, because the answer depends on the scope and on who will own the system.
In the pack
- P08-A02 ISO 27001 Implementation Methodology & Project PlanWhat it costs
- P08-A02 ISO 27001 Implementation Methodology & Project PlanRoles and effort
Step
Draft the scope and the reason for certifying first
A consultant's price, and your own view of the gap, both depend on how big the scope is and who will read the certificate. Write the reason in a paragraph and draft the scope statement before you ask anyone for a quote.
In the pack
- P08-A02 ISO 27001 Implementation Methodology & Project PlanPhase 1 — Decide and scope (3 weeks)
- P08-A02 ISO 27001 Implementation Methodology & Project PlanInputs
Decision
Can you name an ISMS manager who has time to run it?
The pack expects the ISMS manager at half to full time for the length of the project, as its default. They run the plan, the Statement of Applicability, the readiness reports and the relationship with the certification body. If nobody can be named, answer no.
- Yes: Name the ISMS manager and the control owners, with their time
- No, or not known: Will top management release someone's time for it?
In the pack
- P08-A02 ISO 27001 Implementation Methodology & Project PlanRoles and effort
Decision
Will top management release someone's time for it?
Internal effort is usually larger than every external cost together. A consultant can write documents, but the control owners must still run the controls and keep the records. If nobody has time, the project will stall in the operating phase whoever drafts the documents.
- Yes: Name the ISMS manager and the control owners, with their time
- No, or not known: Hold the project: a consultant cannot own it for you
In the pack
- P08-A02 ISO 27001 Implementation Methodology & Project PlanWhat it costs
- P08-A02 ISO 27001 Implementation Methodology & Project PlanCommon failure modes
Outcome
Hold the project: a consultant cannot own it for you
Without a named owner with time, a purchased service produces documents and no records, which is the pattern the pack warns about. Take the cost of the time to top management as a decision, then come back to this question.
In the pack
- P08-A02 ISO 27001 Implementation Methodology & Project PlanCommon failure modes
Step
Name the ISMS manager and the control owners, with their time
Name people, not roles, in the approved plan. The control owners put controls in place, run them and answer the auditor about them. In a small organisation one person may hold two roles, but the internal auditor never audits their own work.
- Then: What is the main gap?
In the pack
- P08-A02 ISO 27001 Implementation Methodology & Project PlanRoles and effort
Decision
What is the main gap?
Choose the gap that is largest today. You can come back for a second one. Skills means nobody has run an ISMS before. Hours means you know what to do but cannot find the time. Independence means nobody can audit the system without checking their own work.
- Skills: Buy training or coaching for the ISMS manager and an auditor
- Hours: Buy help with named tasks, with a deliverable for each
- Independence: Contract an internal auditor for the audits only
- None: we do it ourselves: Do the work in-house, and still plan an independent auditor
In the pack
- P08-A02 ISO 27001 Implementation Methodology & Project PlanWhat it costs
- P08-A08 ISMS Internal Audit Programme & ProcedureAuditor independence and competence
Step
Buy training or coaching for the ISMS manager and an auditor
The pack lists a lead implementer or internal auditor course as optional, and useful for the ISMS manager and at least one internal auditor. Coaching on your own documents keeps the knowledge inside the organisation after the project ends.
In the pack
- P08-A02 ISO 27001 Implementation Methodology & Project PlanWhat it costs
Step
Buy help with named tasks, with a deliverable for each
Name each task and what you will get: a draft policy, a tracker set-up, a first read of the evidence. Your people approve the output and put it under document control. Do not buy a policy set whole: the pack warns that dozens of documents describing processes nobody runs are sampled and found not followed.
In the pack
- P08-A02 ISO 27001 Implementation Methodology & Project PlanCommon failure modes
- P08-A05 Mandatory ISMS Documentation ChecklistRequired Documents
Decision
Will the person who helps build it also audit it?
No. An auditor does not audit a process they run, manage or wrote the procedure for. The pack says a consultant who helped build the ISMS may not audit what they built. If the answer is yes, or you are not sure, take the audit from someone else.
- Yes, or not known: Give the audit to someone who did not help build it
- No: Is there another gap to cover?
In the pack
- P08-A08 ISMS Internal Audit Programme & ProcedureAuditor independence and competence
Step
Give the audit to someone who did not help build it
A contracted internal auditor is often the simplest way to meet the independence rule in a small team. Keep a copy of their qualification, their engagement letter and a statement that they have not advised on, designed or run the parts they audit.
In the pack
- P08-A08 ISMS Internal Audit Programme & ProcedureAuditor independence and competence
- P08-A02 ISO 27001 Implementation Methodology & Project PlanWhat it costs
Step
Contract an internal auditor for the audits only
Contract an auditor for the audit programme and nothing else. The pack suggests a few days for the first full internal audit as its default. The auditor reports to you, and your ISMS manager still owns the programme.
In the pack
- P08-A08 ISMS Internal Audit Programme & ProcedureAuditor independence and competence
- P08-A02 ISO 27001 Implementation Methodology & Project PlanWhat it costs
Step
Do the work in-house, and still plan an independent auditor
If you have the skills, the hours and the time, the work stays with your people. The independence rule still applies, so decide now who will audit areas the ISMS manager runs.
In the pack
- P08-A08 ISMS Internal Audit Programme & ProcedureAuditor independence and competence
Decision
Is there another gap to cover?
Most small teams have more than one: for example hours and independence. Go round again for the next gap. If nothing is left to buy, answer no.
- Yes: What is the main gap? (back to an earlier step)
- No: Write down who owns what and what the helper leaves behind
In the pack
- P08-A02 ISO 27001 Implementation Methodology & Project PlanWhat it costs
Step
Write down who owns what and what the helper leaves behind
List who approves, who runs each control and who keeps each record. Ask the helper to hand over every document in a form you can edit, and agree that the helper will not hold the only copy. Documents the helper drafts count only when your people approve them and keep them under document control.
In the pack
- P08-A02 ISO 27001 Implementation Methodology & Project PlanThe rules (rule IS-04)
- P08-A05 Mandatory ISMS Documentation ChecklistInstructions
Decision
Is the quote within what top management approved?
Compare the quote with the resources top management approved. If it is above them, narrow what you buy to named tasks, or take the new figure back to top management as a decision. Do not let the helper's fee displace the internal time the project needs.
- Yes: Is the helper linked to the certification body you may choose?
- No, or not known: Narrow the work bought, or take the new figure to top management
In the pack
- P08-A02 ISO 27001 Implementation Methodology & Project PlanWhat it costs
Step
Narrow the work bought, or take the new figure to top management
Cut the engagement to the tasks that close a real gap, or ask top management to approve the higher figure. Keep the internal time protected, because it is the cost the project cannot do without.
In the pack
- P08-A02 ISO 27001 Implementation Methodology & Project PlanWhat it costs
Decision
Is the helper linked to the certification body you may choose?
Accreditation rules treat consultancy by a certification body, or a firm linked to it, as a threat to the body's impartiality. A common mitigation is a waiting period of about two years before it may certify the same system. If you are not sure of any link, answer yes and ask. Using a consultant with no link to the body does not by itself limit your choice of body.
- Yes, or not known: Choose another body, or ask yours in writing how it treats the link
- No: Split agreed: your people own it, the help is bounded
In the pack
- P08-A08 ISMS Internal Audit Programme & ProcedureAuditor independence and competence
Step
Choose another body, or ask yours in writing how it treats the link
Ask the body what it requires. Practice varies between bodies and schemes, and the standard that sets the rules is paywalled, so take the body's answer in writing before you sign with either party.
In the pack
- P08-A02 ISO 27001 Implementation Methodology & Project PlanWhat it costs
Outcome
Work stays in-house: plan the independent auditor now
Your people own and do the work. Name now who will audit the areas the ISMS manager runs, and keep the approvals, records and control owners as agreed. Do not describe the plan as a guarantee of certification: only the certification body decides, after it has sampled your records.
In the pack
- P08-A08 ISMS Internal Audit Programme & ProcedureAuditor independence and competence
Outcome
Split agreed: your people own it, the help is bounded
Review the arrangement at each gate: the hours used, the records produced and whether the gap has closed. Do not describe a consultant's involvement as a guarantee of certification. Only the certification body decides, after it has sampled your records.
In the pack
- P08-A02 ISO 27001 Implementation Methodology & Project PlanPhase 4 — Implement and operate (12 weeks)
Practical checklist
- Draft the scope and write why you want the certificate before asking for any quote.
- Name an ISMS manager and agree their time with top management.
- Say whether the gap is knowledge, hours or independence, and buy for that gap only.
- Write the task list and deliverables into the engagement, with the records the helper leaves behind.
- Give the audit to someone who did not help build the ISMS.
- Ask your certification body whether the helper has any link to it.
Evidence to have ready
- The approved roles and the time agreed for the ISMS manager and control owners.
- The engagement letter listing tasks, deliverables and what the helper will not do.
- The auditor's independence statement for each internal audit.
- Documents drafted by a helper, approved and under your own document control.
Assumptions
- You aim for ISO/IEC 27001:2022 certification and have not yet hired help, or want to check an arrangement you already have.
- Effort and cost figures are the pack's defaults for an organisation of 100 to 300 people. Quotes and your own estimates replace them.
- Top management has not yet said no to the project. If it has, start with the commitment question.
Not covered here
- Getting top management to approve the people, time and money. That is “How do we get the top management commitment and resources an ISO 27001 project needs?”.
- Working out the cost and the date. That is “When will certification realistically happen, and what will it cost?”.
- Running the internal audit when you are small, including who is independent. That is “How do we run an internal audit when we are small?”.
- Choosing a certification body. That is “How do we choose a certification body and agree our audit dates?”.
Related questions
- How do we get the top management commitment and resources an ISO 27001 project needs?
- When will certification realistically happen, and what will it cost?
- How do we run an internal audit when we are small?
- How do we choose a certification body and agree our audit dates?
- How do we set the scope of our ISMS?