---
title: "ISO 27001 Consultant vs Toolkit: Which Route Fits?"
description: "DIY toolkit or consultant for ISO 27001? Real costs in money and internal hours, where each route succeeds and fails, and the hybrid most firms should pick."
canonical: https://www.isosecurity.co.uk/resources/iso-27001-consultant-vs-toolkit
updated: 2026-11-10
---

# ISO 27001 consultant vs toolkit: an honest comparison

A toolkit plus 100 to 200 hours of capable internal time can get a small organisation certified, and sometimes that is the right route. A consultant costs more cash and far less of your calendar, and earns it at the decisions templates cannot make for you.

## What do the three routes to ISO 27001 cost?

| Route                                     | Cash cost (small organisation)                                                        | Internal time                                | Succeeds when                                              |
| ----------------------------------------- | ------------------------------------------------------------------------------------- | -------------------------------------------- | ---------------------------------------------------------- |
| DIY with toolkit or platform              | Hundreds to a few thousand pounds, plus certification fees                            | 100–200 hours                                | A capable owner has protected time and the scope is simple |
| Hybrid: internal work, senior checkpoints | Gap analysis from £2,400; internal audit from £1,950; checkpoint days at £1,250       | 60–120 hours                                 | You want ownership without the expensive mistakes          |
| Consultant-led implementation             | Typically £10,000–£16,000 at ISO Security for up to 50 staff, plus certification fees | 20–50 hours, mostly decisions and interviews | Deadline, complexity, or nobody internal can own it        |

All three routes pay the same certification-body fees on top. Full figures, with published market comparisons, are in my [UK cost guide](/resources/iso-27001-cost-uk).

## Where do toolkits struggle?

- **Scope judgement.** A template cannot tell you whether excluding your main service will make the certificate worthless to the customer who demanded it.
- **The risk methodology.** Downloaded registers arrive pre-scored with somebody else's risks. Auditors ask your managers to explain scores they did not set.
- **The Statement of Applicability.** Grid-based SoAs are the most common [Stage 1](/resources/iso-27001-stage-1-stage-2-audit) problem I see; justifications must come from your [risk assessment](/resources/iso-27001-risk-assessment).
- **Interview reality.** Stage 2 interviews test your people, and preparation for that is a service.

## When is the DIY route enough?

If you are a small, single-site organisation, your systems are modern and mostly cloud, a manager can protect a day a week, and no deadline is pressing, the DIY route with a bought-in independent [internal audit](/resources/iso-27001-internal-audit) is respectable. I will tell you so on a readiness call.

Price the internal hours honestly before you choose. The project cost is your senior people's time, and the toolkit fee is only a small part of it; the [Lean Tree case study](/case-studies/lean-tree-iso-27001) shows the support route in practice for one growing firm.

## Consultant or toolkit?

### Can we achieve ISO 27001 with a toolkit and no consultant?

Yes, and many small organisations do, provided you budget the real cost: the toolkit fee, commonly 100 to 200 hours of internal time from someone capable, and an impartial internal audit before certification, which most toolkit users still buy separately. Build the risk assessment and Statement of Applicability with care, because auditors dismantle those two documents most readily.

### What does a consultant add that a toolkit does not?

Judgement at the points where templates are silent: a scope that your customers will accept, a risk methodology your managers can actually repeat, control decisions proportionate to your business, documents written around how you operate, and rehearsal for the interviews your team will face. A consultant who has also been an auditor knows what will be tested and builds that in from the start.

### What is the middle route between DIY and full consultancy?

Do the work internally with periodic senior input: a consultant-led gap analysis and plan, checkpoints at risk assessment and Statement of Applicability, and an independent internal audit before you book Stage 1. You keep the learning and the ownership, avoid the expensive errors, and pay only for the days you need; my gap analysis starts from £2,400 and standalone internal audit from £1,950.

## Contact

Deciding which route your organisation can actually sustain? Arrange a readiness discussion: [contact ISO Security](/contact) or email info@isosecurity.co.uk.