Compliance · ISO 27001
ISO 27001 consultancy for UK organisations
Independent ISO 27001 consultancy, from gap analysis to certification, with one accountable partner. We scope your ISMS, lead the implementation with vetted specialist practitioners, prepare you for audit, and keep you audit-ready between surveillance audits.
Last reviewed . Regulation moves, so check the regulation tracker for the current position.
What we cover
What our ISO 27001 consultancy covers
ISO 27001 consultancy is the help an organisation brings in to design, implement and evidence an information security management system (ISMS) that is ready for certification. Threat Protect leads the programme as your single point of accountability, with hands-on work delivered by vetted specialist ISO 27001 practitioners that we select and oversee.
- Gap analysis against clauses 4 to 10 and the 93 Annex A controls
- ISMS scope, drawn tightly enough to be proportionate and broad enough for clients to accept
- Risk assessment and risk treatment plan, using a method your team can keep running
- Statement of Applicability recording which Annex A controls apply, and why
- Policies, procedures and control evidence written around how you actually work
- Internal audit and management review before the certification audit
- Stage 1 and Stage 2 audit preparation, and support closing any findings
- Surveillance-year support, so the ISMS keeps working after the certificate arrives
The standard
The ISO 27001 standard: clauses 4 to 10 and Annex A
ISO 27001 defines how to build and run an ISMS: a risk-based system of policies, controls and evidence, rather than a checklist. The current edition is ISO/IEC 27001:2022. Clauses 4 to 10 set out the management system itself: the context and scope of the ISMS, leadership, risk assessment and treatment, support, operation, performance evaluation and improvement.
Annex A lists 93 information security controls, grouped into organisational, people, physical and technological themes. Your risk assessment decides which apply, and the Statement of Applicability records each decision and why. Most organisations apply the large majority of them.
Who needs it
When a recognised standard is the price of entry.
It is widely expected by enterprise clients, insurers and regulators, and frequently appears as a hard requirement in supplier audits and bids.
It is often the answer to international client audits, including those driven by DORA, where a buyer needs evidence of a mature control framework rather than a baseline. Regulators such as the FCA and the ICO do not require a specific certification, but they treat ISO 27001 as strong evidence of mature security management.
Step by step
How ISO 27001 certification works, step by step
Certification has three distinct phases that are often confused: preparation, which takes most of the time; your own internal audit; and the external certification audit by an independent, UKAS-accredited body. The durations below are typical for a mid-sized organisation with some controls already in place. Your scope and starting point move them in either direction.
- Preparation, scope and gap analysis, around four weeks: agree what the ISMS covers and measure the gap to the standard
- Preparation, risk assessment and treatment, two to six weeks: identify information security risks and decide how to treat each one
- Preparation, Statement of Applicability and policies, four to eight weeks: select the Annex A controls and document how they work
- Preparation, operate the controls: run them for weeks or months, not days, so there is real evidence for an auditor to sample
- Internal audit (clause 9.2), typically one to five days: a competent auditor who did not build the ISMS tests all of it, ideally a month before the external audit so there is time to fix what it finds
- Management review (clause 9.3): leadership reviews the internal audit results, risks and objectives, and agrees corrective actions
- External Stage 1 audit, typically one to four days depending on headcount: the certification body reviews your documentation, risk assessment, Statement of Applicability and internal audit records
- External Stage 2 audit, typically two to seven days, usually a few weeks after Stage 1: an operational audit that samples evidence and interviews staff to test the controls work in practice
- Certification decision, usually within a couple of weeks of Stage 2 once any nonconformities are closed: a three-year certificate, with annual surveillance audits and recertification in year three
External audit
Why your external audit should be UKAS-accredited
A certificate is only as credible as the body that issues it. UKAS is the UK’s national accreditation body. It does not certify organisations itself: it accredits and oversees the certification bodies that do, against ISO/IEC 17021-1, with audit time set by the rules in ISO/IEC 27006.
UK enterprise buyers and public-sector tenders often expect a UKAS-accredited certificate, and an unaccredited one can be rejected at due diligence. It cannot be converted later either: moving to an accredited body means certifying again from the start. Accredited certificates carry the UKAS mark and can be checked independently on UKAS CertCheck.
We strongly recommend a UKAS-accredited certification body for your external audit, and the certification bodies we work with are UKAS-accredited, chosen to suit your scope, sector and timetable. They audit independently: accreditation rules stop them designing your ISMS or writing your policies.
Cost
How much does ISO 27001 certification cost in the UK?
The cost of ISO 27001 certification has two separate parts: the certification body’s audit fees, and the consultancy and internal time needed to get ready. They have to be separate: an accredited certification body cannot implement the system it then certifies.
Certification body fees are driven by audit days. Accredited bodies calculate audit time using the rules in ISO/IEC 27006, mainly from the number of people within the ISMS scope, adjusted for the number of sites, the complexity of your systems and how much is outsourced. You pay for Stage 1 and Stage 2 in year one, a shorter surveillance audit in years two and three, and a recertification audit after that.
Consultancy cost depends on the same scope, plus how much is already in place and how much your own team can take on. That is why we scope before we quote. Our ISO 27001 consultancy is priced on application, and you get a clear quote once the scope is agreed.
- The number of people and locations in scope
- The complexity of your systems, cloud services and outsourced suppliers
- Existing policies, controls and certifications, such as Cyber Essentials
- How much internal time you can commit to the programme
- Whether you want support through the surveillance years
Timeline
How long does ISO 27001 take?
For a mid-sized organisation with a reasonable starting position, six to nine months from kick-off to certificate is a realistic plan. Published UK industry guidance generally gives a range of three to twelve months: small organisations with a narrow scope and existing controls at the short end, larger or more complex organisations, or those starting from very little, at the long end. Treat these as planning figures, not promises. Your gap analysis gives you a timeline for your own scope.
Almost all of that time is preparation, typically three to six months, much of it spent running the controls long enough to produce evidence. The internal audit and management review then take two to four weeks, including time to fix what they find. The external certification audit is the short part: from Stage 1 to certificate typically takes three to six weeks, provided findings are closed promptly.
The things that most often slow a programme down are a scope drawn too wide, too little internal time, and slow corrective action after an audit finding. The certification body needs evidence that the ISMS has been operating, including the internal audit and management review, so the preparation phase cannot be squeezed indefinitely.
Gap analysis
ISO 27001 gap analysis: where you stand, in about four weeks
An ISO 27001 gap analysis compares how you work today with the requirements of clauses 4 to 10 and the Annex A controls: scope, risk assessment, policies, the controls in place, and the evidence an auditor would ask for. It lets you decide whether to commit to certification, and what it will involve, before you start.
- A gap report against every clause and Annex A control
- A proposed ISMS scope
- A prioritised implementation roadmap
- A realistic timeline to certification for your organisation
Why independent
Why use an independent ISO 27001 consultant
We are not tied to any compliance platform or security vendor, so the advice follows what your risk assessment needs rather than what someone would like to sell you. Certification is carried out by an independent UKAS-accredited certification body, kept separate from the consultancy work as accreditation rules require.
ISO 27001 rarely stands alone. One ISMS can carry the evidence for Cyber Essentials, SOC 2, DORA, NIS2 and ISO 42001, so a shared control is evidenced once rather than three times. After certification, continuous compliance keeps that evidence current all year, so surveillance audits become routine rather than a scramble.
Who we work with
ISO 27001 for regulated UK organisations
Most of our ISO 27001 work is for organisations of 250 staff or more in regulated sectors, where clients and regulators ask the hardest questions: financial services and wealth management, legal, energy, pharma and life sciences, healthcare suppliers and manufacturing, plus the technology and SaaS firms that sell into them. We work across every sector, including smaller firms that need ISO 27001 to win a contract.
We meet clients in person across London and the South East, and work remotely with organisations across the UK.
Related
Common pitfalls
Where ISO 27001 programmes go wrong.
- A scope drawn too wide, so the work is disproportionate, or too narrow, so clients do not accept it
- Policies that describe how things should work rather than how they actually do
- A risk assessment that does not drive the choice of controls
- An internal audit programme or supplier risk process that only exists on paper, two common Stage 2 findings
- Parking the ISMS between audits, which makes the next surveillance audit painful
FAQ
Questions buyers actually ask
How much does ISO 27001 cost?
It depends on scope. Certification body fees are set by audit days, calculated mainly from the number of people in scope plus sites and complexity, and recur each year for surveillance audits. Consultancy cost depends on the same scope, your existing controls and how much your team does itself. Pricing is on application, quoted once the scope is agreed.How long does ISO 27001 certification take?
Six to nine months is a realistic plan for a mid-sized organisation with a reasonable starting position, and published UK guidance generally ranges from three to twelve months. Most of that is preparation (typically three to six months), then two to four weeks for the internal audit and management review, then three to six weeks for the external Stage 1 and Stage 2 audits and the certification decision. A gap analysis gives you a timeline for your own scope.What is the difference between an ISO 27001 consultant and a certification body?
A consultant helps you design, implement and evidence the ISMS. A certification body audits it independently and issues the certificate. Accreditation rules stop a certification body from implementing the system it certifies, so the two must be separate organisations. In the UK, choose a UKAS-accredited certification body.Do we need ISO 27001 or SOC 2?
UK and European clients usually ask for ISO 27001; US enterprise buyers usually ask for a SOC 2 report. ISO 27001 ends in a certificate against an international standard, while SOC 2 is an attestation report from a licensed CPA firm against the Trust Services Criteria. The controls overlap heavily, so one programme can prepare for both.Do we need ISO 27001 or Cyber Essentials?
It depends on who is asking. Cyber Essentials proves a technical baseline and is often enough for UK public-sector contracts and insurers. ISO 27001 proves a managed, risk-based security programme and is what enterprise and international clients usually expect. Many organisations hold both.We were certified to ISO 27001:2013. Can you help?
Yes. The transition period to ISO/IEC 27001:2022 ended on 31 October 2025, so certificates against the 2013 edition have expired. We help you update the risk assessment, Statement of Applicability and controls to the 2022 edition and its 93 Annex A controls before you return to audit.What is a Statement of Applicability?
The Statement of Applicability (SoA) lists every Annex A control, states whether it applies to your ISMS and why, and records whether it is implemented. Auditors use it as the map of your ISMS, so it has to match your risk assessment and what actually happens day to day.Does ISO 27001 cover AI risks?
Partly. ISO 27001 covers information security risks wherever they arise, including AI tools that handle your data. It does not cover AI-specific governance such as bias, transparency and human oversight. ISO 42001 does, and it uses the same management-system structure, so it can share much of your ISO 27001 ISMS.What is the difference between the internal audit and the certification audit?
The internal audit (clause 9.2) is your own check of the whole ISMS, carried out by a competent auditor who was not involved in building it, before the certification audit. The certification audit is the external Stage 1 and Stage 2 audit by an independent certification body, which decides whether to issue the certificate. The certification body will expect to see the internal audit and management review records.Why does UKAS accreditation matter for ISO 27001?
UKAS accredits and oversees the certification bodies that issue ISO 27001 certificates. UK buyers and public-sector tenders often expect a UKAS-accredited certificate, and an unaccredited one can be rejected and cannot be converted later. Accredited certificates carry the UKAS mark and can be checked on UKAS CertCheck. We strongly recommend one, and the certification bodies we work with are UKAS-accredited.Do you work outside London?
Yes. We meet clients on site across London and the South East, and work remotely with organisations across the UK. Most of the implementation work can be done remotely, with on-site visits where they add value.
Thinking about ISO 27001?
We’ll help you scope it before you commit. Most quotes go wrong because the scope is wrong.
Book a call Also available in AWS Marketplace