ISO/IEC 27001:2022
ISO 27001 Consultants & Certification (UK)
ISO 27001 consultancy from a UK firm that is ISO 27001 certified itself. We take you from gap analysis through ISMS implementation and internal audit to certification, which typically takes three to nine months, with the Stage 1 and Stage 2 audits carried out independently by our partner certification body, MQA International.
Prefer to talk? Call +44 161 523 5276
- ISO 27001 certified ourselves
- Certification audits by MQA International
- Evidence reused from PCI DSS & Cyber Essentials
Trusted by banks, payment providers and global brands
On this page
- ISO 27001 consultancy services, from gap analysis to certificate
- ISO 27001 certification vs accreditation
- How long does ISO 27001 certification take?
- How much does an ISO 27001 consultant cost?
- Consultant vs certification body: who does what
- ISO 27001 consultants in London, Manchester and across the UK
- Free ISO 27001 templates
- How our ISO 27001 consultancy works
- Why choose Sovereign Secure as your ISO 27001 consultant?
- Frequently asked questions
- Guides and tools in this section
Overview
What an ISO 27001 consultant does, and what the certification body does
The short answer
An ISO 27001 consultant helps you build an information security management system that meets ISO/IEC 27001:2022, then prepares you for the Stage 1 and Stage 2 audits. Most small and mid-sized organisations take three to nine months. The certificate is issued by an independent certification body; for our clients that is MQA International.
An ISO 27001 consultant helps you build an information security management system (ISMS) that meets ISO/IEC 27001:2022: the mandatory clauses 4 to 10 and the 93 Annex A controls, grouped into four themes (organisational, people, physical and technological). We scope the ISMS, run the risk assessment on the confidentiality, integrity and availability of your information, write what is needed and prepare you for audit. We never issue the certificate. An independent certification body does, and for our clients that is MQA International.
Common starting points. A customer or tender needs a certificate by a fixed date. You already hold Cyber Essentials or comply with PCI DSS and want to build on that evidence rather than repeat it. An ISMS started from a template pack has stalled. Or you are a startup or small business that needs a proportionate ISMS, not a corporate one. Each of these starts with an ISO 27001 gap analysis. If you are still weighing up whether certification pays off, see the benefits of ISO 27001.
Startups and SaaS companies. When your first enterprise customer asks for ISO 27001, a lean scope built around your product, cloud platform and people keeps the ISMS proportionate to a small team. Our guide to ISO 27001 for startups covers scope, timeline, cost drivers, secure development controls and when SOC 2 fits better.
Beyond ISO 27001. A working ISMS gives you much of the groundwork for related standards: ISO/IEC 27701 for privacy information management, the cloud codes of practice ISO/IEC 27017 and 27018, ISO 22301 for business continuity, ISO/IEC 20000-1 for IT service management and ISO/IEC 42001 for AI management systems. We design your ISMS so those can be added later without a rebuild. Someone also has to own the ISMS once it is certified; our guide to the virtual CISO (vCISO) explains one way smaller organisations fill that role. For quality management, see ISO 9001 consultancy; every other standard we support is on our ISO certification page. If you have EU operations or EU customers, the NIS2 directive asks for security measures that a working ISMS covers for the most part.
What's included
ISO 27001 consultancy services, from gap analysis to certificate
Take the full package or only the step you need. The usual path is gap analysis, implementation, internal audit, then certification by MQA International.
- 01
Gap analysis
A gap analysis against clauses 4 to 10 and all 93 Annex A controls of the 2022 edition, with a risk-ranked roadmap to certification.
- 02
ISMS scope, risk assessment and SoA
Define the ISMS boundaries, run a business impact analysis and risk assessment, and produce the Statement of Applicability that justifies each control.
- 03
Policies and procedures
Security policies and procedures written for how your organisation works, rather than copied from a template pack.
- 04
Control implementation
Options analysis, technical design review and hands-on help putting the selected controls in place, from access control to supplier security.
- 05
Training and awareness
Leadership briefings and staff security awareness training, which ISO 27001 requires you to provide and evidence.
- 06
Incident response and continuity
Incident response plan review and development, tabletop exercises if required, and continuity planning that can grow into ISO 22301.
- 07
Penetration testing
ISO 27001 penetration testing scoped to give auditors evidence for Annex A 8.8 (technical vulnerabilities) and 8.29 (security testing).
- 08
Internal audit and management review
An independent ISO 27001 internal audit (clause 9.2) and management review support (clause 9.3), so Stage 1 and Stage 2 hold no surprises.
- 09
Certification and surveillance
Preparation for and support through the Stage 1 and Stage 2 audits by MQA International, then each annual surveillance audit and recertification, plus guidance on using the certification mark correctly under the ISO 27001 logo rules.
ISO 27001 certification vs accreditation
Buyers often ask for an "ISO 27001 accredited" supplier, but organisations are certified; certification bodies are accredited by an accreditation body that checks they are competent and impartial enough to audit. A request for an ISO 27001 accredited supplier usually means one that holds a valid ISO 27001 certificate.
| Who | What they hold | What it means |
|---|---|---|
| Your organisation | ISO 27001 certification | An independent certification body has audited your ISMS and confirmed it meets ISO/IEC 27001:2022 |
| The certification body | Accreditation | An accreditation body has assessed it as competent and impartial to audit and certify management systems, under ISO/IEC 17021-1 and the ISMS rules in ISO/IEC 27006 |
| The consultant | Neither | Helps you build the ISMS and prepares you for audit; it cannot certify you or accredit anyone |
Keeping consultancy and audit in separate organisations is what makes the certificate credible. Our partner certification body, MQA International, is accredited for ISO/IEC 27001 by IAS, the International Accreditation Service. If a customer or tender names a particular accreditation body, tell us at the start and we will confirm how your certificate will be issued before you commit.
How long does ISO 27001 certification take?
For most small and mid-sized organisations, three to nine months from gap analysis to certificate. The biggest variables are how mature your controls already are, how wide the scope is and how quickly decisions are made. An indicative six-month plan for a mid-sized organisation looks like this:
| Phase | What happens | Indicative timing |
|---|---|---|
| Gap analysis and scope | Leadership commitment, ISMS scope and a gap analysis against the standard | Month 1 |
| Risk assessment and SoA | Risk assessment, treatment plan and Statement of Applicability | Month 2 |
| Build the ISMS | Policies, controls and staff training | Months 2 to 4 |
| Operate and keep records | Run the controls so the auditor has records to sample | Months 3 to 5 |
| Internal audit and management review | Clauses 9.2 and 9.3, completed before Stage 2 | Month 5 |
| Stage 1 and Stage 2 audits | Documentation review, then the effectiveness audit by the certification body | Month 6 onwards |
A small, cloud-based organisation that already holds Cyber Essentials can be nearer three months; a multi-site scope or in-house development and hosting push it towards nine. The certificate then runs for three years, with a surveillance audit in each of years two and three. Our ISO 27001 implementation guide sets out every step.
How much does an ISO 27001 consultant cost?
Published prices from UK providers we reviewed in September 2026 put consultant-led implementation packages at £8,000 to £25,000 and the initial certification audit at £3,000 to £8,000. Where you land depends on headcount, sites, scope and your starting point; see ISO 27001 consultant costs for day rates and what each model includes, and we then give you a fixed quote for your scope.
Consultant vs certification body: who does what
Under ISO/IEC 17021-1 a certification body may not advise on the management system it certifies, so preparation and audit always come from different organisations.
| Task | Consultant (Sovereign Secure) | Certification body (MQA International) |
|---|---|---|
| Scope and risk assessment | Helps you set the scope and runs the risk assessment with you | Reviews both at Stage 1 |
| Policies and Statement of Applicability | Drafts them to fit how you work | Checks they meet the standard and are followed |
| Internal audit | Can act as your independent internal auditor (clause 9.2) | Checks that it was planned, done and acted on |
| Stage 1 and Stage 2 audits | Prepares you and supports you through them | Carries them out |
| Certification decision | No role | Makes the decision and issues the certificate |
| Surveillance and recertification | Keeps the ISMS audit-ready each year | Audits in years two and three, then recertifies before expiry |
ISO 27001 consultants in London, Manchester and across the UK
We work across the UK, including London, Manchester and the North West, from our head office in Accrington, Lancashire, and internationally through our offices in Los Angeles, Singapore, Dubai and Dhaka. For local services in the North West, see cyber security in Manchester and cyber security in Lancashire.
Free ISO 27001 templates
If you want to make a start before talking to anyone, our free ISO 27001 toolkit has the same working files we use with clients:
| Template | What it helps you do |
|---|---|
| ISO 27001 checklist (.xlsx) | Rate each clause of the ISO 27001 requirements and each Annex A theme, and track the evidence an auditor will sample |
| ISO 27001 gap analysis template (.xlsx) | Score every sub-clause and all 93 Annex A controls from 0 to 3 and rank the gaps |
| ISO 27001 implementation plan (.xlsx) | Run the 11-step project with owners, dates and progress by phase |
| Statement of Applicability template | Record and justify your decision on each of the 93 Annex A controls |
| ISO 27001 risk register template | Identify, score and treat risks to the information in scope |
| Information security policy template | Start your top-level policy and the topic-specific policies under it |
How it works
How our ISO 27001 consultancy works
- 1
Gap analysis and plan
We measure where you stand against ISO/IEC 27001:2022 and agree a realistic plan. Every phase and typical timelines are set out in our ISO 27001 implementation guide.
- 2
Build and check the ISMS
Scope, risk assessment, Statement of Applicability, policies and controls, then the internal audit and management review that must be completed before certification.
- 3
Independent certification
An independent certification body, MQA International, carries out the Stage 1 and Stage 2 audits and makes the certification decision. We support you through those audits, surveillance and recertification.
Why Sovereign Secure
Why choose Sovereign Secure as your ISO 27001 consultant?
Established in 2012, we deliver PCI, ISO and Cyber Essentials work for banks, payment processors, card manufacturers and fast-growing companies.
Read client testimonials →- We practise what we preach. Sovereign Secure is ISO 27001 certified, so we prepare you for the same kind of audit we go through ourselves.
- Independent certification. Stage 1 and Stage 2 audits by MQA International keep consultancy and audit separate.
- One set of evidence, several standards. As a PCI SSC-approved QSA company and an IASME-licensed Cyber Essentials certification body, we map ISO 27001 controls to PCI DSS, Cyber Essentials and GDPR.
- Where we work. Across the UK, including London, Manchester and the North West, from our head office in Accrington, Lancashire, and internationally through our offices in Los Angeles, Singapore, Dubai and Dhaka.
FAQ
Frequently asked questions
Can't find your answer? Call us on +44 161 523 5276 or send us a message.
What does an ISO 27001 consultant do?
An ISO 27001 consultant plans and builds your ISMS with you: scope, risk assessment, Statement of Applicability, policies, controls, training and an internal audit. The consultant prepares you for certification but cannot certify you; an independent certification body carries out the audit.
How do I choose an ISO 27001 consultant?
Look for experience with organisations of your size and sector, policies written for how you work rather than a template pack, clear separation from the certification body and a fixed scope of work. Our guide on how to choose an ISO 27001 consultant lists the questions to ask and the red flags.
How do I get ISO 27001 certification?
Build and run an ISMS, complete an internal audit and management review, then pass a two-stage audit by an independent certification body. Our ISO 27001 implementation guide sets out each step, and the ISO 27001 checklist tracks your readiness.
How long does ISO 27001 certification take?
For a small to mid-sized organisation, typically three to nine months from gap analysis to certificate, depending on how mature your security practices already are, the size of the scope and how quickly decisions are made.
How long does an ISO 27001 certificate last?
Three years, with surveillance audits in years two and three; our guide to the ISO 27001 audit explains each stage of the cycle.
How much does ISO 27001 cost?
It depends on your size, scope and starting point. Our ISO 27001 cost guide breaks down consultancy, Stage 1 and Stage 2 audit, surveillance and recertification fees. After a short call we give you a fixed quote for consultancy, and we can include the certification body fees so you see the full cost up front.
How much does an ISO 27001 auditor typically cost?
The certification body’s auditors are paid through its audit fee, which published UK prices we reviewed in September 2026 put at £3,000 to £8,000 for Stage 1 and Stage 2 together, while an internal audit under clause 9.2 is a separate cost; see ISO 27001 audit costs.
What is an ISO 27001 certification body?
The independent organisation that audits your ISMS, makes the certification decision and issues the certificate, separate from the consultant that helped you implement. For our clients that is MQA International, which audits you while we support you through the process.
Do you provide penetration testing for ISO 27001?
Yes. ISO 27001 does not name penetration testing as a requirement, but two Annex A controls usually apply: 8.8 (management of technical vulnerabilities) and 8.29 (security testing in development and acceptance), and a penetration test is often the clearest evidence for both. See penetration testing for ISO 27001.
What changed in ISO 27001:2022?
Annex A moved to 93 controls in four themes and the 2013 transition ended on 31 October 2025; our guide to ISO 27001 controls lists every change.
Is ISO 27001 worth it if we already have Cyber Essentials?
Cyber Essentials covers five technical controls. ISO 27001 is a full management system covering risk, governance, people, suppliers, incidents and continuity. Many clients start with Cyber Essentials and move to ISO 27001 when larger customers or tenders require it; Cyber Essentials vs ISO 27001 compares the two side by side. If ISO 27001 is more than a small company needs, some buyers accept IASME Cyber Assurance instead, and our map of the NCSC 10 Steps to Cyber Security shows which areas Cyber Essentials and ISO 27001 each cover.
Last reviewed October 2026 by the Sovereign Secure assessment team.
Guides and tools in this section
- ISO 27001 Annex A controlsISO 27001 controls explained: all 93 Annex A (2022) controls in four themes, the 11 new ones, what changed from 2013 and where CE and PCI DSS set stricter rules.
- ISO 27001 auditISO 27001 audit guide: what happens at stage 1, stage 2 and surveillance audits, what auditors sample, how nonconformities are graded and how to prepare.
- ISO 27001 checklistFree ISO 27001 checklist for the 2022 standard: clause-by-clause readiness, an Annex A theme check and a Stage 1 and 2 audit checklist. Download the .xlsx.
- ISO 27001 for startupsISO 27001 for startups and software companies: a lean ISMS scope, realistic timeline, cost drivers, secure development controls and when SOC 2 fits. Get help.
- ISO 27001 logoISO 27001 logo rules explained: why ISO does not license its logo, how to use your certification body's mark, the right wording and where the mark can appear.
- ISO 27001 policy templatesFree ISO 27001 toolkit: editable information security, access control, acceptable use, supplier and cryptography policies (Word) plus five ISMS spreadsheets.
- ISO 27001 requirementsISO 27001 requirements explained: what clauses 4 to 10 of ISO/IEC 27001:2022 demand, every mandatory document and what auditors check. Plan your ISMS here.
- ISO 27001 risk assessmentHow to run an ISO 27001 risk assessment that stands up at audit: the clause 6.1.2 method, ISO 27005 approaches and a free risk register template with examples.
- ISO 27002ISO 27002:2022 explained: its 93 controls, the five attribute types, what changed from 2013 and how it differs from ISO 27001. Design controls that pass audit.
- Statement of ApplicabilityStatement of Applicability for ISO 27001:2022: what it must include, how to justify exclusions, a worked example and a free SoA template (.xlsx).
- What is ISO 27001?What is ISO 27001? The information security standard in plain English: the ISMS, clauses 4 to 10, Annex A, how certification works and who needs it. Start here.
Related services
- ISO 27001 certification costISO 27001 certification cost in the UK for 2026: consultancy, Stage 1 and 2 audits, surveillance and recertification by company size. Get a fixed quote.
- ISO 27001 gap analysisISO 27001 gap analysis against the 2022 standard: clauses 4 to 10 and all 93 Annex A controls, scored into a risk-ranked roadmap. Free template or a fixed quote.
- ISO 27001 implementationISO 27001 implementation in 11 steps, from scope and risk assessment to internal audit and certification, with realistic timelines, roles and a free project plan.
- ISO 27001 internal auditOutsourced ISO 27001 internal audit by an ISO 27001-certified UK firm: independent clause 9.2 ISMS audits before Stage 2 and every year. Get a fixed quote.
- ISO 27001 penetration testingISO 27001 penetration testing mapped to Annex A 8.8 and 8.29: what auditors ask for, how often to test and an audit-ready evidence pack. Get a fixed quote.
- Cyber Essentials vs ISO 27001Cyber Essentials vs ISO 27001, compared by an IASME certification body that is ISO 27001 certified: scope, cost, timescales and which one your buyers need.
- ISO certificationISO certification in the UK explained: what it is, how it differs from accreditation, how to get certified to ISO 9001, 14001, 45001 or 27001 and what it costs.
Free consultation
Talk to an assessor
We aim to reply within one working day, and send a fixed quote once your scope is confirmed.
- PCI SSC-approved QSA, QPA, CPSA, P2PE and 3DS assessors
- IASME-licensed Cyber Essentials certification body
- Clients across the UK, US, Europe, Middle East and Asia since 2012
“We are satisfied with the quality of work delivered by Sovereign Secure and would happily recommend them to any company that requires consultancy and guidance in obtaining their ISO 27001 certification.”
Call +44 161 523 5276
Email [email protected]