--- title: "ISO 27001 for Consultancies and Professional Services" description: "ISO 27001 for consultancies and professional services firms: scope by service line, control client information, manage associates, win tender assurance." canonical: https://www.isosecurity.co.uk/resources/iso-27001-for-consultancies updated: 2026-11-10 --- # ISO 27001 for consultancies and professional services A consultancy's information risk is unusual: almost none of the sensitive data belongs to you, and it sits in client documents, client system logins and associates' laptops. ISO 27001 done properly proves you hold other people's information as carefully as they hold it themselves, and I implemented it at Lean Tree, a UK digital transformation consultancy, so I know how this feels from the inside. ## Why do professional services firms certify? - **Tenders and frameworks:** one certificate replaces the security section of every bid, at a quality a questionnaire answer cannot match. - **Client trust:** regulated clients increasingly require it contractually from firms with access to their systems and data. - **Questionnaire load:** as my [questionnaires guide](/resources/customer-security-questionnaires) explains, a certificate converts a hundred questions into an attachment. - **Discipline:** joiners, leavers, associates and client-access hygiene are real risks in this sector; the ISMS makes them routine. ## What is different about ISO 27001 in this sector? **People controls carry the weight.** Screening, confidentiality terms, awareness and (above all) offboarding that actually revokes client system access are where consultancy audits succeed or fail (Annex A 6.1 to 6.6, 5.15 to 5.18). Auditors follow leavers through your systems, so make sure the trail is short and dated. **Client information needs handling rules people follow.** Classification, approved transfer and storage channels, and restrictions on personal drives and messaging apps (5.10 to 5.14, 8.10 to 8.12). In a consultancy the policy is only real if partners model it on live engagements. **Key-person risk is an information security risk.** When one expert holds the client relationship and all the working papers, continuity controls (5.29, 5.30) mean named deputies, a document repository someone else can restore, and handover records. Auditors ask about this more often than firms expect. **Your own suppliers mirror your clients' questions.** The accounting platform, CRM, IT support provider and any subcontracted delivery all need proportionate assurance: the same diligence your clients apply to you, one level down. ## What is the route to certification for a consultancy? 1. Scope by service line, agreed with the partners whose clients will rely on it. 2. Gap analysis focused on people, client-information handling and associate controls. 3. Risk assessment run with practice leads, using real engagement scenarios. 4. Slim policy set written around how engagements actually run, including client-site work. 5. Evidence period: access reviews per engagement, closure checklists, supplier checks. 6. Internal audit, management review, then Stage 1 and Stage 2. A consultancy of up to about 50 staff usually sits in the smallest implementation band, and my [UK cost guide](/resources/iso-27001-cost-uk) has the figures. My [small business guide](/resources/iso-27001-for-small-businesses) covers the proportionate approach in more detail, and firms that would rather not build internal ISMS capacity often keep the system running afterwards through [virtual CISO services](/virtual-ciso-services). For how this ran in practice, I have written up [my implementation of ISO 27001 at Lean Tree](/case-studies/lean-tree-iso-27001), the employee-owned digital transformation consultancy. ## Frequently asked questions about ISO 27001 for consultancies ### How should a consultancy scope its ISMS? By service line and information type: a workable scope reads like 'the provision of advisory and delivery services to clients, including all information received from or created for clients, across all UK personnel and company-managed devices', which survives remote working, client-site work and new hires. When your people log into a client's own systems, those systems stay inside the client's ISMS, while your access to them (requested, reviewed, revoked) belongs inside yours. ### Do associates and subcontractors fall inside our certification? They fall inside your supplier management, which auditors test. Anyone delivering client work under your name needs screening proportionate to their access, signed confidentiality and security terms, controlled onboarding to client systems, and prompt revocation when the engagement ends, because auditors sample exactly this and will ask you to show them an associate who left and when the access was removed. ### Our clients only ask for Cyber Essentials. Do we need ISO 27001 as well? Cyber Essentials answers technical-baseline questions, while vendor-risk teams at larger corporates, financial services firms and the public sector score how you govern client information, suppliers and incidents. If your pipeline is moving in that direction, ISO 27001 is the credential they ask for, and my comparison of the two schemes sets out where each one stops. ### Can we implement it ourselves rather than hiring a consultant to consult us? Yes, if someone internally has read the standard properly, can run a risk process your partners will engage with, can chair a management review that makes decisions, and can audit impartially. External help earns its fee in a consultancy through speed and pattern recognition (knowing which auditor questions matter and which documentation is theatre), and my consultant vs toolkit comparison prices the internal-hours route honestly. ## Contact Clients auditing the firm that advises them? Arrange a readiness discussion: [contact ISO Security](/contact) or email info@isosecurity.co.uk.