ISO 27001 Consultancy
Information security management, built around your business
What is ISO 27001?
ISO 27001 is the international standard for information security management systems (ISMS). It gives you a structured, risk-based way to protect the information your business relies on.
That covers your own data, such as financial records, intellectual property and staff details, and the data customers and partners trust you with. The standard looks at people, processes and technology together, not just IT.
At Smart Quality, we build information security management systems that fit how your business already works. You get controls proportionate to your real risks, and a system that will stand up to a UKAS-accredited certification audit.
Talk to us today about a fixed fee for your ISO 27001 project.
Why get ISO 27001 certification?
Cyber attacks are rising and customers want proof their data is safe with you. ISO 27001 helps you:
- Meet tender and contract requirements where ISO 27001 is mandatory or heavily weighted.
- Answer customer security questionnaires quickly, with one recognised certificate.
- Show insurers you manage risk properly, which can help with cyber insurance.
- Demonstrate how you protect personal data under UK GDPR.
- Reduce the chance, and the damage, of a data breach or cyber incident.
- Win work in sectors that expect strong security credentials, such as technology, finance, healthcare, defence and government.
Want to know more? Read our blog on what ISO 27001 can do for your business.
Benefits of ISO 27001
A well-run ISMS protects your information and strengthens the business at the same time.
- Stronger security: consistent controls against data breaches, cyber attacks and unauthorised access.
- Lower business risk: fewer incidents means less exposure to financial loss, fines and reputational damage.
- Greater customer confidence: clients can see you take their data seriously, which builds trust and opens doors.
- Easier compliance: a solid framework for meeting UK GDPR and sector-specific requirements.
- A competitive edge: stand out in tenders where information security is scored.
Find out more about the business case for ISO 27001 on our blog.
Looking for a straightforward ISO 27001 consultant?
One fixed fee, agreed up front, from gap analysis to your certification audit.
How will ISO 27001 help my business?
ISO 27001 makes information security part of how the business runs, not a one-off IT project. In practice, that means:
Access to new markets
many contracts in technology, finance, healthcare, defence and government now require ISO 27001.
Better risk management
a clear way to identify, assess and treat the information security risks that matter most.
Smoother operations
tighter access control, asset management and supplier checks often remove waste and confusion too.
Security-aware staff
people understand their responsibilities, and your biggest risk becomes your first line of defence.
Faster recovery
a tested plan for detecting, responding to and recovering from incidents keeps disruption to a minimum.
ISO 27001 and Cyber Essentials, delivered with CyberSmart
Through Smart Cyber Services, we deliver Cyber Essentials and Defence Cyber Certification alongside your ISO 27001 work, in partnership with CyberSmart. Cyber Essentials is the Government-backed minimum standard of cyber security for organisations of every size, and a natural first step towards ISO 27001.
Cyber Essentials: year-round compliance, with device protection, automatic patching and optional £25k insurance cover.
Cyber Essentials Plus: the independently audited certificate, plus staff security training and a privacy toolbox.
Defence Cyber Certification: the MoD framework for defence suppliers, Levels 0 to 3, with Level 0 requested by 31 December 2026.
Combining these with ISO 27001 means one joined-up approach to security, rather than separate projects with separate evidence.
Our guarantee
Fixed fee. Guaranteed. No surprises.
We agree one price up front for everything you need to reach your first certification audit. And we guarantee that the information security management system we build will meet the requirements of any UKAS-accredited certification body.
We keep systems simple. We document what you need, not what looks impressive in a folder, so your system is quick to build, easy to maintain and flexible as you change.
Your fixed fee includes
- A gap analysis of your current information security arrangements
- A bespoke information security management system built to ISO 27001
- A full set of internal audits, carried out for you
- Chairing your first management review
- Support right through to your certification audit
- Guidance on choosing the right UKAS-accredited certification body
ISO 27001 frequently asked questions
What is ISO 27001?
ISO 27001 is the international standard for information security management systems. It helps organisations protect information such as financial data, intellectual property, staff records and customer information, by identifying risks and putting the right controls in place. It works for any size of organisation in any sector.
How long does it take to get ISO 27001 certified?
It depends on your size, how many sites you have, your IT set-up and how much is already in place. Most of our single site SME clients reach their certification audit within 4 to 6 months. We give you a realistic timeline at the start, based on your gap analysis.
How much does ISO 27001 consultancy cost?
We quote a fixed fee, agreed before we start, covering everything up to your first certification audit. The price depends on your size, sites and scope. Certification body fees are separate and paid directly to the body you choose. We can provide indicative certification costs from our UKAS-accredited CB partner network.
Do I need a consultant to get ISO 27001?
No, but ISO 27001 is one of the more demanding standards, and most businesses find a consultant saves a lot of time. We know what auditors look for and keep your controls proportionate to your real risks.
What is UKAS accreditation and why does it matter?
UKAS is the UK's national accreditation body. It checks that certification bodies are competent and impartial. A UKAS-accredited certificate is the one buyers, tender panels and main contractors recognise, particularly in the public sector supply chain.
Do you issue the certificate?
No. We are consultants only. We build and support your management system, and an independent UKAS-accredited certification body audits you and awards the certificate. We are registered with several, including BSI, NQA, ISOQAR, SGS, URS, AUVA and Interface NRM, and help you choose the right one.
Will ISO 27001 create lots of paperwork?
Not if it is built properly. ISO 27001 does need certain documents, such as a risk assessment and a Statement of Applicability, but we keep them concise and use your existing policies wherever we can.
Is ISO 27001 suitable for small businesses?
Yes. The standard scales to your size and risk. A small business with cloud-based systems will need a much simpler ISMS than a large data processor.
What information security risks do I need to consider?
Anything that could affect the confidentiality, integrity or availability of your information: cyber attacks, phishing, lost or stolen devices, human error, supplier failures, system outages and physical threats to premises. We help you identify and assess them, and decide how to treat each one.
What controls might I need?
The current version, ISO/IEC 27001:2022, lists 93 reference controls in Annex A, grouped into organisational, people, physical and technological themes. You only apply the controls your risks call for, and record your choices in a Statement of Applicability.
How does ISO 27001 help with UK GDPR?
UK GDPR requires appropriate security for personal data. ISO 27001 gives you a recognised framework for doing that and evidence that you do it, which supports your data protection compliance. It does not cover every GDPR requirement on its own, such as data subject rights.
Which industries benefit most from ISO 27001?
Any business that handles valuable or sensitive information. It is most often required in IT and software, managed services, finance, healthcare, legal and professional services, defence, and public sector supply chains.
Do I need ISO 27001 if I already have cyber insurance?
Insurance helps you recover the cost of an incident. ISO 27001 helps stop the incident happening and limits the damage if it does. Insurers increasingly expect to see good controls, so the two work well together.
Do I need Cyber Essentials as well?
Cyber Essentials covers core technical controls and is often required for government contracts. Many businesses start with Cyber Essentials and build up to ISO 27001. Through Smart Cyber Services, we can deliver both.
What happens at the certification audit?
Certification is usually a two-stage audit. Stage 1 reviews your system and readiness. Stage 2 checks that the system is working in practice across the business (say what you do, do what you say and prove it). We prepare you for both.
How do I keep my ISO 27001 certification?
Certificates run on a three-year cycle, with surveillance audits in between and a recertification audit at the end. You keep the system running through risk reviews, internal audits, management reviews and corrective actions. We offer ongoing maintenance support if you want help.
Can ISO 27001 be combined with other standards?
What does senior management need to do?
Leadership is a core requirement. Senior managers set the information security policy and objectives, accept the risk treatment plan, provide resources and take part in management reviews. We keep their time commitment focused.
How does ISO 27001 help prevent data breaches?
By finding weak points before attackers do: controlling who can access what, keeping systems patched, training staff to spot phishing, vetting suppliers and having a plan for incidents. Regular audits keep those controls working.
What is an information security policy?
It is a short statement, approved by top management, setting out your commitment to protecting information and the direction for your security controls. We help you write one that reflects your business.
How does ISO 27001 support business continuity?
ISO 27001 requires you to plan for keeping information secure and available during disruption, such as a cyber attack or system failure. For a full business continuity management system, we also support ISO 22301.
How does Smart Quality approach ISO 27001?
We start with a gap analysis, then build a bespoke system around how you work. We carry out your internal audits, chair your management review and support you through certification, all for a fixed fee. Our consultants are IRCA qualified, and we work with businesses across the UK from our base in Bournemouth.
What our clients say
Smart Quality Services were an outstanding partner in helping 4Thought Digital achieve ISO 9001 certification. Richard Duff’s expertise in developing a robust Quality Management System, combined with Sara Duff’s exceptional account management, ensured the process was smooth, collaborative, and aligned with our diverse service lines: Consultancy, Managed Services, and Social Ventures. Their professionalism, deep knowledge, and practical approach gave us confidence at every stage. We highly recommend Smart Quality Services to any organisation seeking a trusted partner for quality and compliance.
We must give huge credit to Richard Duff and the Smart Quality Services team who have helped us transform our management systems. The step change has added value to the business and enables us to even better meet the needs of all our stakeholders. If there are businesses out there considering the journey, please do speak to Richard Duff.
Find out how we can help you
Tell us about your business and your timescale, and we will come back with a clear plan and a fixed fee quote for ISO 27001.