Which ISO 27001 consultant is right for your company?

As of October 15, 2026. Provider details come from each provider's own website, checked on October 15, 2026.

Key takeaways

• The right ISO 27001 consultant depends on what your company is missing: project know-how to build the ISMS, or a person to run it permanently afterward. Mid-sized companies often lack both.
• ISO 27001 consulting comes from four models: specialist information security consultancies, consulting arms of testing organizations, large consulting firms, and platforms with in-house experts.
• The certification body may not consult on your ISMS. Under ISO/IEC 27006-1, it must also be independent of whoever performs your internal ISMS audit.
• ISO 27001 does not require an external consultant. It requires assigned roles and responsibilities for information security and an ISMS that keeps running through the three-year certificate cycle.

No single ISO 27001 consultant is the best choice for every company. The right one depends on two questions: does your company need help building the ISMS or a permanent information security officer role, and how much of the work can your team do itself? A defined project from gap analysis to certification audit is what specialist consultancies (such as HiSolutions, usd AG, or carmasec), consulting arms of testing organizations (such as TÜV Rheinland Consulting or DEKRA), and large consulting firms (such as PwC or KPMG) deliver. If nobody will run the ISMS after the project, you also need an external information security officer or CISO mandate. Several specialist consultancies offer one, as do platforms with in-house experts such as TrustSpace, Proliance, or Kertos. ISO 27001 is an international standard, so the same models apply whether your company sits in Germany, the UK, the Netherlands, or the Nordics.

What types of ISO 27001 consulting are there?

The four models differ in what they deliver and in who carries the work after the certification audit.

Two standards set one rule for planning. Under ISO/IEC 17021-1, clause 5.2, a certification body may not offer management system consultancy itself. Where a body related to it has consulted on your ISMS, the standard names as a recognized safeguard that the certification body does not certify it until at least two years after the consultancy ends. ISO/IEC 27006-1 adds a requirement specific to the ISMS: the certification body must be independent of whoever performs your internal ISMS audit, and according to European Accreditation no two-year period cures that conflict. If your consultant also runs the internal audit, settle which body will certify you before you sign. For an overview of certification bodies, see ISO 27001 auditors in Germany.

Which providers offer ISO 27001 consulting?

The providers below are examples of the four models, all active in the German market. The descriptions reflect what each provider states about ISO 27001 on its own website (checked October 15, 2026). The list is not a recommendation for your case and is not complete. The large consulting firms, the testing organizations, and several of the platforms also serve clients outside Germany.

What should an ISMS consultant deliver?

A complete ISMS engagement covers seven phases. For each phase, expect the following:

1. Scope and context (clause 4): a scope that answers your customers' question, and a list of interested parties and their requirements.
2. Gap analysis: a review against clauses 4 to 10 and Annex A that includes HR, purchasing, and operations. ISO 27001 creates work well beyond IT.
3. Risk assessment and Statement of Applicability: a method your team can repeat without the consultant, and a justification for every control included or excluded.
4. ISMS build: policies and Annex A controls that describe how your company works, with owners and evidence.
5. Internal audit and management review: an internal audit by someone who does not audit their own work, and a documented review by top management.
6. Support during the stage 1 and stage 2 audits: preparation for the auditor's questions. Your team shows evidence in the systems where it is created; an export in advance is usually not needed.
7. Operations and surveillance audits: a named person who keeps risks, evidence, and suppliers up to date. Models and monthly costs are compared in the vCISO provider comparison.

Five criteria separate offers in a first conversation:

• What stays in the company after the project? A person with a role and time, or only documents.
• Where does the evidence live? In the consultant's documents and templates, or in a tool your team keeps using.
• Fixed price or day rate? Ask for the days per phase.
• Can the work be reused for TISAX or NIS2? Ask whether risks and controls are mapped to several requirement catalogs.
• Who audits internally and who certifies? Settle independence under ISO/IEC 17021-1 and ISO/IEC 27006-1 before you sign.

Which ISO 27001 consultant suits a mid-sized company?

For mid-sized companies, the project is rarely the problem. The problem comes afterward: the certificate is valid for three years, with a surveillance audit in years one and two and recertification in year three. Someone has to run the ISMS during that time. A project that ends by handing over to an information security officer the company does not have leaves a certificate the company cannot keep.

Effort grows with the number of people in scope. The audit time table in ISO/IEC 27006 sets the following audit days for initial certification; the certification body may deviate, in practice by up to 30 percent.

For a surveillance audit, certification bodies usually plan about one third of the initial audit time. That is common practice, not a value from the standard's table.

Example: a manufacturer with 150 employees has two automotive customers asking for ISO 27001 or a TISAX assessment. The IT lead handles the topic alongside operations, and no information security officer is appointed. If all 150 people are in scope, the certification body will plan around 13 audit days for initial certification. The company needs a project for the gap analysis and ISMS build, a person or mandate to run it afterward, and an evidence base it can reuse for the TISAX label.

Which software fits which starting point is covered in ISO 27001 software for mid-sized companies. If your company also falls under NIS2, the page on NIS2 consulting firms compares providers for that.

How much does ISO 27001 consulting cost?

Consulting day rates vary by country, firm size, and seniority, so compare offers by the number of days per phase rather than by the rate alone.

Kertos estimates the traditional consulting route in year one at €23,000 to €49,000 for companies with fewer than 50 employees and €37,000 to €80,000 for companies with 50 to 200 employees. This covers gap analysis and preparation, implementation, and certification body fees. The breakdown by cost block and the annual surveillance audits are on the page ISO 27001 certification cost. If you have no information security officer, the ongoing cost of that role comes on top.

When is Kertos the right choice, and when is it not?

Kertos combines a compliance platform with the AI agent KAIA and certified in-house experts. KAIA maps risks, Annex A controls, and evidence to each other and keeps them up to date. The experts support scoping, risk assessment, policies, the internal audit, and the certification body's audits.

• Model: platform plus certified in-house experts.
• External CISO / information security officer: as a mandate, in the same system.
• Frameworks: ISO 27001, TISAX, NIS2, GDPR, ISO 27701, ISO 42001, SOC 2, C5, and the EU AI Act from one evidence base.
• Headquarters and hosting: Munich, developed and hosted in Europe.
• Results: 100% audit pass rate; around 80% less manual compliance effort; AskUI achieved ISO 27001 certification in 8 to 10 weeks without external consultants.

Kertos is not the right choice in these cases:

• A group wants a project team from a large audit and consulting firm for international structures.
• You want a one-off consulting project without software.
• BSI IT-Grundschutz is your leading standard, meaning ISO 27001 based on IT-Grundschutz.
• You need an on-premises deployment.

To see how implementation would look for your scope, book a demo.

Frequently asked questions about ISO 27001 consulting

Do you need an external consultant for ISO 27001 certification?

No. The standard does not prescribe who builds the ISMS. Clause 5.3 requires top management to assign roles and responsibilities for information security, and clause 9.2 requires internal auditors to be objective and impartial, so they do not audit their own work. Whether you bring in help depends on whether someone on your team knows the standard and has time for the build and for operations. The certification process is described in the guide to ISO 27001 certification.

Can the certification body also act as your consultant?

Not on the same management system. Under ISO/IEC 17021-1, clause 5.2, a certification body may not offer management system consultancy itself. Where a related body has consulted, the standard names as a recognized safeguard a period of at least two years after the consultancy ends. For the ISMS, ISO/IEC 27006-1 adds that the certification body must be independent of whoever performs the internal ISMS audit.

How long does ISO 27001 consulting take until certification?

Realistically three to twelve months from project start to certificate. Scope, the maturity of your existing security, and the time your team can contribute make the difference. What speeds up a project and what does not is covered on the page The fastest way to ISO 27001 certification.