Govern / United Kingdom
Build an information security management system around what your organisation does, what your customers need and the risks you have to manage.
Last reviewed . Fees in pounds sterling plus VAT.
A certificate should describe the business your customers actually buy.
Scope and pricing
Service fees are indicative. The written proposal confirms the agreed scope, applicable taxes and total payable before work begins.
From £6,300
Indicative range £6,300–£7,800
A delivery plan built around your starting point.
Internal audit is separately scoped unless included in the written proposal. Certification-body fees, licences and technical remediation are separate cost items.
From £7,800
Indicative range £7,800–£9,400
Six-week planning target within a 5–7-week window.
For suitably scoped organisations with fewer than 10 people, subject to readiness and capacity. The target concerns implementation and internal audit, not a certificate in six weeks.
Fixed fee after scoping. Applicable VAT, payment terms, third-party costs and exclusions will be stated in the written proposal.
Standalone UK prices in GBP. Fees are agreed in writing for the confirmed scope.
ISO 27001 consultancy for UK organisations
Start with what you sell and the evidence a customer or tender actually needs. The plan connects scope, risk and working controls—not simply a library of policies.
Confirm the product, legal entity, customer requirements, systems and dependencies. Record the current position before selecting documents or controls.
The output A scope statement and prioritised gap register, with owners and decisions needed.
Assess information-security risks, agree treatment and record the applicable controls. Connect the Statement of Applicability to the treatment plan and real control owners.
The output A risk register, treatment decisions and a maintained Statement of Applicability.
Work through the agreed procedures and technical actions with your team. Capture records from real operation rather than backdating or manufacturing evidence.
The output An evidence index connecting each record to an owner, frequency and usable location.
Prepare management review and the agreed readiness checks. Where internal audit is included, a different competent auditor reviews the evidence with documented impartiality safeguards.
The output A clear record of findings, outstanding actions and responsibilities after handover.
The requirement in context
ISO/IEC 27001:2022 sets requirements for an information security management system. For a UK tender or supplier review, first record the exact evidence requested and the relevant legal entity. Do not assume ISO 27001, Cyber Essentials and an individual training certificate satisfy the same requirement.
Inside the work
Fictional working example: a business sells a hosted scheduling application. These are scoping decisions to resolve—not a certificate scope to copy.
| Decision | Working example | Evidence to agree |
|---|---|---|
| What is being sold? | The hosted application, its development and customer support. | Product description and the actual customer security requirement. |
| What keeps it running? | Production hosting, identity, code repositories, support tooling and relevant people. | Service map, asset owners and supplier interfaces. |
| What is outside the boundary? | An unrelated product line may be excluded only after dependencies are assessed. | Recorded rationale and controls for shared services; exclusions are not a way to hide relevant risk. |
| What proves the system operates? | Access reviews, controlled releases, supplier review, incidents and management decisions. | Record owner, frequency, retention and a usable evidence location. |
Fictional example · Not a client result, legal determination or complete audit checklist.
Download this working example (CSV)What you take away
Build an information security management system around what your organisation does, what your customers need and the risks you have to manage.
How the work moves forward
Responsibilities and access are agreed before the engagement. Work stays connected to the outcome—not the number of documents produced.
Agree the entity, product, people, systems, suppliers and customer requirement.
Assign owners, select treatment and controls, and produce records from real work.
Review the evidence, arrange an impartial internal audit and address findings before independent certification.
Your delivery team
Qualifications, professional credentials and formal training held across Aegentra’s delivery team.
Credentials are held across the delivery team and matched to assigned roles. The proposal identifies the consultants, responsibilities and relevant qualification evidence before work begins.
Further training and audit qualifications across the team include ISO/IEC 42001 Lead Implementer training, ASD ISM General and Technical audit codes, ISO/IEC 27017 and ISO/IEC 27018 audit codes, and ISO 9001 and ISO 19011 audit qualifications.
For internal audit, competence, objectivity, impartiality and prior involvement are checked before the work is accepted. Implementation, internal audit and independent certification have separate roles.
These are individual qualifications held across the wider team, not a claim that every consultant holds every credential or that Aegentra is an accredited certification body.
Read about our team’s capabilityA practical starting point
Start with the legal entity, product or service you sell and the systems and suppliers that support it. Agree that boundary before writing policies. A narrow certificate that excludes the service your customer buys may not answer the requirement.
For a software provider, scope the hosted product, its development and support processes, production environment and relevant supplier interfaces. Record any exclusions and their rationale. This is a fictional scoping example, not a client claim.
Before you commission the work
The agreed work can include scoping, a gap review, implementation planning, risk assessment, a Statement of Applicability, control ownership and readiness support. Management retains responsibility for decisions and running the ISMS.
Implementation starts from £6,300 (indicative range £6,300–£7,800), or fast-track implementation plus internal audit from £7,800 (indicative range £7,800–£9,400). Service fees are indicative. The written proposal confirms the agreed scope, applicable taxes and total payable before work begins. Compare the same scope: consultancy, internal audit, certification-body fees, licences and technical remediation are different cost items. A headcount alone does not describe the work.
We agree a plan after reviewing the ISMS boundary, current controls, evidence and client capacity. For suitably scoped organisations with fewer than 10 people, the fast-track option uses a six-week planning target within a 5–7-week implementation and internal-audit window. Operating evidence and corrective actions take time; certification by a particular date is not promised.
It is a core ISMS record linking applicable controls to the organisation’s treatment decisions. A useful working record identifies the rationale, implementation state and owner; it should not simply mark every control as implemented.
Yes, within the agreed scope. We help organise evidence in your chosen platform or existing tools. Platform subscriptions, integrations and access arrangements are agreed separately.
No. This service concerns your organisation’s ISMS. A PECB Lead Implementer course develops an individual’s knowledge and prepares them for an exam; it does not implement or certify the organisation.
A defined product or service can shape the ISMS boundary, but relevant dependencies still need consideration. Identify shared staff, identity, development, hosting and support before proposing exclusions. Confirm that the resulting scope answers the customer’s requirement; do not simply exclude a weak control.
Agree a handover that identifies control owners, operating routines, evidence locations, open risks, unresolved actions and review triggers. Ask the team to demonstrate how an access review or change approval works. A policy library alone does not establish an operating ISMS.
Describe the organisation, product or service, customer requirement, systems and preferred timing. Do not send passwords or confidential records through the enquiry form. We agree secure evidence handling separately.
A clearer view of information-security risks, named control owners, repeatable operating practices and evidence that can support customer assurance requests. The value depends on controls actually working and being maintained. A certificate alone does not guarantee new contracts, prevent every incident or replace specific legal and contractual obligations.
Agree completion evidence for the work, not just a document count. Examples include approved scope decisions, risk treatments with owners, scheduled access reviews completed with exceptions resolved, and corrective actions verified for effectiveness. Management selects useful measures, reviews the results and decides what to improve; these are not automatic certification scores.
It compares the agreed scope and existing arrangements with the management-system requirements and relevant controls. The useful output is a prioritised action plan: the gap, owner, dependency and evidence needed to close it. A gap analysis identifies work; it is not an internal-audit opinion or a certification decision.
A clear business boundary, an available decision-maker, accessible system owners and usable existing evidence. We check dependencies, including suppliers, technical changes, staff availability and remediation, before confirming dates. If those conditions are not in place, we agree a longer plan rather than promise a six-week result.
No certification-body fee is included unless expressly identified in the written proposal. Aegentra provides the agreed consultancy and readiness support; an independent certification body conducts its own assessment and makes the certification decision. Its audit dates, evidence expectations and certification fees are separate.
The scope should describe the actual product or service and the people, systems, locations and dependencies supporting it. An unrelated activity may be outside the boundary, but shared access, hosting, suppliers and customer commitments still need consideration. The working example on this page shows how to record those decisions.
Service brochure
Review the ISMS scope, delivery approach, responsibilities and operating evidence in one document. We email it to your work address so you can read it or share it with your team.
“We certified our medical clinic for ISO 27001 through Aegentra, and the entire process was smooth and well managed.”
From Aegentra’s global client feedback; reproduced with permission. Aegentra supports implementation; independent certification bodies award certification.
Tell us what you need to achieve, what is in scope and where you are starting.
Talk about your project