The route decision
Three routes to ISO 27001, costed
Every ISO 27001 journey takes one of three routes: do it yourself with a toolkit, run it on a compliance platform, or have it delivered and then run for you as a managed service. We sell the third, which is exactly why this page owes you a straight account of the first two.
| Factor | DIY toolkit | Compliance platform | Consultancy-led |
|---|---|---|---|
| Year-one cost (published UK analysis) | Roughly £8,000 all-in, most of it the UKAS audit | Roughly £17,000 to £21,000 including subscription | Typically £21,000+ all-in |
| Recurring cost | Audit and surveillance fees only | Subscription every year, plus audit fees | Audit fees; our managed service keeps running the ISMS |
| Your team's time | Months of it: the toolkit gives structure, you do everything | Substantial: with Drata or Vanta you still collate evidence, run the platform, input data, chase failed control tests and design the controls | Hours in workshops and decisions; the drafting is done for you |
| Quality risk | Template documents that describe a business that is not yours | Checklist-driven ISMS shaped by the tool's model, not your risks | Depends entirely on the consultancy; ask who does the work |
| Best when | You have in-house security expertise with genuine spare capacity | You want continuous compliance tooling and expect SOC 2 too | You need it done properly, first time, without consuming the team |
Year-one figures from published UK market analyses (2026); every route also pays the certification body's audit fee, itemised on the cost page.
The failure mode of each route
How each route goes wrong
Toolkits fail as shelfware: documents describing a fictional company, exposed the first time an auditor interviews a real employee. Platforms fail as dashboards nobody owns: green ticks accumulating over an ISMS no one is actually managing. And build-and-leave consultancies fail as cliff edges: an ISMS nobody operates the day the consultant walks out.
The managed service exists to remove that cliff: your team keeps every decision that matters and the documents describe your real operation, but there is no handover moment to survive, because the practitioners who built the ISMS carry on running it through surveillance and recertification.
A fair self-test
Choose the toolkit if someone senior owns security full-time and has months of capacity. Choose a platform if continuous compliance tooling and SOC 2 are both on your roadmap. Choose consultancy when the certificate is deadline-driven, the team is at capacity, or the ISMS needs to be right first time. If you are unsure which describes you, that is what the gap analysis is for.
Quick answers
Route questions, answered
Which route is cheapest overall?
The toolkit route, if your team's time is free, which it is not. Published UK analysis puts toolkit year-one totals around £8,000 against £17,000 to £21,000 for platforms and £21,000+ for consultancy, but the toolkit number excludes months of internal effort. Price your own hours before calling it the cheap option.
Do compliance platforms replace a consultant?
They replace the filing cabinet, not the thinking. Platforms such as Drata and Vanta are genuinely good at structuring the work and automating parts of evidence collection, and if SOC 2 is also on your roadmap they earn their subscription. But the ISMS is still yours to run: you collate the remaining evidence, operate the platform, input the data, run the reports, fix the failed control tests and establish the controls and processes internally. The risk assessment, scoping decisions and audit judgement still have to come from somewhere.
Can we mix the routes?
Yes: a toolkit start with a practitioner reviewing the output and running the internal audit, or a platform subscription with our team operating it for you rather than your own. We will recommend a mix when it serves you better than our full managed service; the comparison only stays credible if we mean it.
Why should we trust a consultancy's comparison of consultancies?
A fair challenge. The figures here are from published third-party UK analyses rather than our marketing, we name the situations where the other two routes win, and we sell no toolkit and no platform, so nothing on this page earns us a commission either way.
Route undecided?
Get a recommendation with no commission behind it
A free 45 minute scoping call weighs your team, deadline and budget against all three routes, including the two we do not sell.