ISO 27001:2022
ISO 27001 consulting: when you need it and when you don't
Many small companies reach ISO 27001 without a consulting project, provided someone internally owns the topic and the basic measures are in place. A consultant makes sense when the management system has to be built from scratch or the scope is complex. Zertify offers a route without a consultant and without an on-site audit: an online self-assessment with 48 yes/no questions.
01: Decision
Do you need an ISO 27001 consultant?
Not by default. The standard does not require external help. It asks you to assess information security risks, set a policy and objectives, select controls from Annex A and keep records. A person in your company who knows the systems can do this work.
A consultant pays off in specific cases. Nobody on your team has the time or the experience to run the risk assessment. The scope covers several sites or a complicated cloud setup. A customer demands a full audit by a certification body and you want to pass it the first time.
Small IT firms, agencies and online shops often have most of the measures already: access rights, backups, password rules, a patching routine. What is missing is the written risk assessment and the documentation that proves it.
02: Consultant tasks
What an ISO 27001 consultant actually does
Scope differs from project to project. These are the usual building blocks.
- Gap analysis
- The consultant compares your current measures with the requirements of the standard and Annex A and lists what is missing.
- Risk assessment
- Together with you, the consultant chooses a method, lists your assets and builds the risk register. This is the part that decides which controls you need.
- Policies and Statement of Applicability
- The consultant drafts the security policy and objectives and the Statement of Applicability, which states for every Annex A control whether you apply it and why.
- Staff training
- A session or two that explains the policy, phishing, handling of customer data and how to report an incident.
- Internal audit and management review
- Clause 9 requires both. The consultant often carries out the first internal audit and prepares the management review.
- Support during the certification audit
- For the classic route, the consultant prepares you for the on-site audit by a certification body and answers its findings.
03: Cost
What does ISO 27001 consulting cost?
Consultants bill by the day, so the total depends on how much you already have in place. The figures below are indicative ranges only. Quotes vary by provider, region and scope.
Day rates in Switzerland are indicatively between CHF 1,000 and CHF 2,000. Rates in Germany, Austria and France are usually lower.
| Project type | Typical scope | Indicative effort |
|---|---|---|
| Gap analysis only | Review of current measures, list of gaps | 1 to 3 days |
| Small company, one site | Risk assessment, policies, SoA, training, internal audit | 10 to 25 days |
| Medium company, several systems or sites | Same as above, plus wider scope, more interviews and records | 25 to 50 days |
Multiply the effort by the day rate and a small project lands in the five-figure range. The audit fee of the certification body comes on top in the classic route.
04: Do it yourself
When you can certify without a consultant
The decisive question is whether your measures exist and someone can describe them truthfully. If you run your own servers or cloud accounts, manage access rights and have a backup routine, you already operate most of what Annex A asks for. Answering the questions yourself then takes hours, not weeks.
A consultant remains the better choice if you do not know where your risks lie, if several departments handle sensitive data in different ways, or if a tender explicitly names a classic audit with an on-site visit.
The two approaches also combine. Some companies answer the self-assessment first to see which of the required points are still open, and bring in a consultant only for those.
05: Zertify
How Zertify certifies you without a consulting project
Zertify certifies the state of your company as you describe it. It does not build the management system for you. The ISO 27001:2022 self-assessment runs online and takes you through the questions in order.
The certificate is issued by G6 Agency AG under licence from SICE (Swiss Institute of Certification and Education). SICE reviews every assessment before the certificate is issued. There is no on-site audit.
Answer 48 yes/no questions
Thirteen of them are mandatory requirements of the standard and must all be answered yes. Of the other 35, at least 24 need a yes.
Pay and receive the certificate
After you pass and pay, the certificate arrives within 4 hours. No account is needed to buy.
Show it to customers
Every certificate has a number and a QR code on the PDF. Your customer's purchasing department checks it on the public verification page.
Confirm it every year
A short online re-audit confirms the certificate each year. It is valid for 3 years.
The price is CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the yearly online re-audit. The subscription renews automatically and you can cancel it at any time in your customer account, effective at the end of the current year. Swiss and Liechtenstein customers pay 8.1% VAT, already included. Combining several standards earns a discount of 20% for two and 30% for three or more.
06: Choosing
Which route fits your situation?
The right route depends on what you already have and on what the person asking for proof expects.
| Your situation | Suitable route |
|---|---|
| Measures exist, you need proof for a supplier questionnaire or quote | Zertify self-assessment |
| Nothing is documented and nobody owns security | Consultant first, then certification |
| A tender requires an on-site audit by a certification body | Classic route, with or without a consultant |
07: FAQ
Questions about ISO 27001 consulting
08: Guide
Related pages
Check whether you need a consultant at all
Answer the 48 questions and see which requirements of ISO 27001 your company already meets.
Free and without registration.