Can we achieve ISO 27001 with a toolkit and no consultant?

Yes, and many small organisations do, provided you budget the real cost: the toolkit fee, commonly 100 to 200 hours of internal time from someone capable, and an impartial internal audit before certification, which most toolkit users still buy separately. Build the risk assessment and Statement of Applicability with care, because auditors dismantle those two documents most readily.

What does a consultant add that a toolkit does not?

Judgement at the points where templates are silent: a scope that your customers will accept, a risk methodology your managers can actually repeat, control decisions proportionate to your business, documents written around how you operate, and rehearsal for the interviews your team will face. A consultant who has also been an auditor knows what will be tested and builds that in from the start.

What is the middle route between DIY and full consultancy?

Do the work internally with periodic senior input: a consultant-led gap analysis and plan, checkpoints at risk assessment and Statement of Applicability, and an independent internal audit before you book Stage 1. You keep the learning and the ownership, avoid the expensive errors, and pay only for the days you need; my gap analysis starts from £2,400 and standalone internal audit from £1,950.

ISO 27001 Consultant vs Toolkit: Which Route Fits?

What do the three routes to ISO 27001 cost?

Route	Cash cost (small organisation)	Internal time	Succeeds when
DIY with toolkit or platform	Hundreds to a few thousand pounds, plus certification fees	100–200 hours	A capable owner has protected time and the scope is simple
Hybrid: internal work, senior checkpoints	Gap analysis from £2,400; internal audit from £1,950; checkpoint days at £1,250	60–120 hours	You want ownership without the expensive mistakes
Consultant-led implementation	Typically £10,000–£16,000 at ISO Security for up to 50 staff, plus certification fees	20–50 hours, mostly decisions and interviews	Deadline, complexity, or nobody internal can own it

All three routes pay the same certification-body fees on top. Full figures, with published market comparisons, are in my UK cost guide.

Where do toolkits struggle?

Scope judgement. A template cannot tell you whether excluding your main service will make the certificate worthless to the customer who demanded it.
The risk methodology. Downloaded registers arrive pre-scored with somebody else's risks. Auditors ask your managers to explain scores they did not set.
The Statement of Applicability. Grid-based SoAs are the most common Stage 1 problem I see; justifications must come from your risk assessment.
Interview reality. Stage 2 interviews test your people, and preparation for that is a service.

When is the DIY route enough?

If you are a small, single-site organisation, your systems are modern and mostly cloud, a manager can protect a day a week, and no deadline is pressing, the DIY route with a bought-in independent internal audit is respectable. I will tell you so on a readiness call.

Price the internal hours honestly before you choose. The project cost is your senior people's time, and the toolkit fee is only a small part of it; the Lean Tree case study shows the support route in practice for one growing firm.