Practical guide / United Kingdom
ISO 27001 certification in the UK: scope, costs and responsibilities
Decide what needs to be certified, what work belongs in the project and how to compare proposals without confusing consultancy with certification.
Researched 18 October 2026. Examples are original fictional learning aids, not client results or legal advice.
What does the customer actually need?
Start with the request, not the certificate logo. Ask which legal entity, product or service the customer is buying, which standard and edition they specify, whether accredited certification is required, and when evidence must be available. A certificate for a different entity or an unrelated activity may not answer the requirement. Keep the exact contractual wording in the project brief.
How do implementation and certification fit together?
Implementation establishes and operates the information security management system. Internal audit examines agreed criteria and evidence with impartiality arrangements. An independent certification body performs the certification assessment and makes its own decision. Selecting a consultant does not appoint a certification body or guarantee its decision. Management remains accountable for the system.
What should an ISO 27001 cost comparison include?
Compare the same scope and separate consultancy, internal audit, certification assessment, continuing certification costs, technical remediation, licences and staff time. Ask whether the quote includes risk workshops, the Statement of Applicability, operating records, management review preparation and follow-up. A low headline fee can exclude the work your customer actually requires. Service fees are indicative. The written proposal confirms the agreed scope, applicable taxes and total payable before work begins.
What changes the timetable?
An organisation with working controls and accessible evidence starts differently from one that first needs to identify its systems and owners. Scope decisions, supplier dependencies, client availability and unresolved findings affect readiness. Agree milestones based on evidence rather than promise a universal number of weeks. The certification body controls its assessment availability and certification decision.
How should you check a certification claim?
Inspect the entity, scope, standard, validity and issuing body. UKAS CertCheck helps verify UKAS-accredited management-system certification; check the relevant accreditation scope as well. Where another accreditation arrangement is proposed, confirm that the customer accepts it. A consultant’s logo or an individual Lead Auditor certificate is not evidence that your organisation is certified.
What should you send with a request for a proposal?
Provide a non-confidential product description, the customer requirement, approximate scope, existing certifications, relevant platforms and target procurement milestone. Ask the provider to identify assumptions and exclusions. Agree secure channels before supplying system exports or client records.
What are the requirements, controls and documents?
An ISMS connects organisational context and scope with leadership, planning, support, operation, evaluation and improvement. Annex A is a reference set used when determining controls; it is not a universal instruction to deploy every control identically. Use the licensed standard for the complete requirements and control wording. Policies should connect to responsibilities and evidence, not exist as a detached template pack.
What should a gap analysis explain?
It should compare the agreed criteria with the actual starting position, distinguish missing documents from ineffective operation and identify evidence still needed. Ask for priorities, owners and dependencies. “Compliant” without a clear boundary and supporting evidence is not a useful implementation plan. Do not treat a gap review as independent certification.