ISO 27001 consultant is bought by a regulated small business at the moments a program is most anxious and least able to say what it needs: before a license, before an examination, after a finding. The seller's value is judgement about what the regulator expects; the buyer's leverage is knowing the program in numbers first, because an engagement scoped from the register is smaller, cheaper and better than one scoped from a brochure. This page walks what to bring to ISO 27001 consultant, what the engagement should change, what must come back at the end, and where the free sheets on this site work the program's own figures, with no account, so the first meeting starts from them.
A consultant, singular
A single consultant's time is the scarcest thing in the engagement, and the client who has counted the program before the first meeting spends it on judgement rather than discovery. Bring the register sheet's items and hours and the control-testing sheet's tests and failures; ask which the consultant would change and by how much.
The iso 27001 certification process a consultant takes you through
Unlike SOC 2, this one really is a certification, issued by a certification body against the standard and maintained on a three year cycle with surveillance visits in between. The sequence is scope, risk assessment, controls and documentation, internal audit, management review, then a Stage 1 audit of the documentation and a Stage 2 audit of the operation. A consultant is useful in the middle of that and cannot sit at either end: the certification body has to be independent of whoever built the system, so the firm that wrote your policies may not certify them. Ask a consultant which certification bodies they have taken clients through and what the Stage 1 findings usually were.
What the engagement should change
The count of obligations actually owed, the controls that satisfy several at once, the evidence each control needs and no more, the audit days per year, the gap rate and the hours per gap. Each is an input to a sheet on this site, so the before and after of the engagement is a pair of worked sheets rather than a slide. For regulatory compliance the sheet to start with is the obligations register sheet. Ask for the before and after in that form; a provider who promises maturity rather than numbers is promising a feeling.
What must come back
The register, in a form the program keeps updating without the provider: obligations, controls, evidence templates, an audit plan the program can run itself next year, and the attestations with who signed them. A deliverable that lives only in the provider's portal is a subscription to the provider. The guide this page supports covers choosing among regulatory compliance consulting firms in detail. Attestvio Pro keeps the register under the client's own name and exports it; the sheets stay free.
What to bring
The register's numbers: obligations, controls per obligation, evidence items per control, minutes per item, reviewers and their hours. The obligations register sheet on this site returns the items, the hours and the months to a full attestation. For a regulated small business the record behind those numbers is the obligations, the controls, the evidence, the incidents, the cases and the attestations; bring it as a count, not a folder. A provider of ISO 27001 consultant who can read the sheet and say which obligations are over-evidenced and which are bare has found the engagement's value in the first hour.
Iso 27001 cost: the consultant, the certification body and your own hours
Three payees and only one of them is negotiable on scope. The certification body charges by audit days, which follow headcount and the number of sites and systems in scope, and it charges again each surveillance year. The consultant charges for the build, which is where a complete register saves the most money because it is the artefact they would otherwise produce. Your own hours go on the risk assessment, the internal audit and the evidence, and they recur. The audit certification cost index on this site records what assessors publish, and most publish nothing, which is itself the finding: a quote is the only real number here.
The iso 27001 internal audit you still have to run yourself
The standard requires the organization to audit its own management system at planned intervals and to feed the results into a management review, and no consultant or certification body discharges that for you. It is the requirement small programs most often discover late, because it needs an auditor independent of the work being audited, which in a small team means somebody borrowed or bought in. Plan it as a recurring item with an owner and a date rather than as a task before the Stage 2 visit. The audit scope sheet on this site works the days from the number of controls and the sample you intend to take.
Questions people ask about ISO 27001 consultant
What does ISO 27001 consultant cost?
Providers quote after scoping and this site publishes no figure for them. The number that matters is the fee against the reviewer hours and audit days the engagement removes, which the free sheets on this site work from your own program.
How do I scope ISO 27001 consultant?
From the register: obligations, controls, evidence items, reviewer hours and the months to attestation, worked on the free obligations register sheet and brought to the first meeting.
Does Attestvio provide ISO 27001 consultant?
No. Attestvio is software that keeps the register, evidence and attestations and works the arithmetic; it gives no view on what a regulation requires. The sheets make any provider's engagement scoped and checkable.
Which iso 27001 mandatory documents does the auditor ask for first?
The scope statement, the information security policy, the risk assessment method with its results and the risk treatment plan, the statement of applicability, and the records of internal audit and management review. Those are the ones a Stage 1 audit reads, and a program that has them written and dated is most of the way through that stage.