Skip to content

ISO 27001, SOC 2, the DPDP Act and manual VAPT. Book a Free Scoping Call

Buyer's guide

How to Choose an ISO 27001 Consultant: Independence, Questions and Red Flags

An ISO 27001 consultant builds your information security management system; an accredited certification body audits it and issues the certificate, and the two cannot be the same firm. This guide from SecureRoot Risk Advisory LLP shows how to check the certification body, what to ask a consultant, which red flags end the conversation and how to compare two quotes.

Request an assessmentBook a 30-45 minute scoping call

Who is writing this

SecureRoot is not an accredited ISO certification body; certificates come from the certification body. We are a consultancy, one of the provider types compared below, so this guide states our limits as well as the checks.

Start here

What does an ISO 27001 consultant do, and what does the certification body do?

Five parties touch an ISO 27001 certificate. Only one of them issues it.

  • Your consultant

    Sets the scope, runs the gap and risk assessments, drafts the Statement of Applicability and policies, and prepares you for both audit stages.

    Issues
    Nothing that counts as certification. Its outputs are your documents.
    How you check it
    Named people, their credentials, and a redacted Statement of Applicability.

  • The accredited certification body

    Runs Stage 1 and Stage 2, decides on certification, then returns for surveillance and, after three years, recertification.

    Issues
    The certificate.
    How you check it
    NABCB's directory, or another recognised accreditation body's, and IAF CertSearch.

  • The accreditation body

    Assesses certification bodies. In India that is NABCB, a constituent board of the Quality Council of India.

    Issues
    The certification body's accreditation, never your certificate.
    How you check it
    Its signatory status under the international recognition arrangement (the IAF MLA until 2026, now run by the Global Accreditation Cooperation).

  • ISO

    Writes and publishes the standard.

    Issues
    Nothing. ISO states that it does not provide certification.
    How you check it
    A certificate claiming to come from ISO itself is wrong on its face.

  • Your internal auditor

    Audits the ISMS under clause 9.2 before the certification body arrives.

    Issues
    The internal audit report, which Stage 1 reads.
    How you check it
    Whether they wrote the controls they are auditing.

Compliance platforms are software. They track evidence and tasks, and they are not a party to the audit. The phases a consultant runs are set out on our ISO 27001 certification consultants in India page, and how the months divide in the ISO 27001 certification timeline.

Independence

Can the same firm build your ISMS and certify it?

No. Under ISO/IEC 17021-1:2015 clause 5.2.5, an accredited certification body shall not offer or provide management system consultancy, and writing your Statement of Applicability counts as consultancy. For an ISMS, ISO/IEC 27006 adds its own rules on top. The current edition is ISO/IEC 27006-1:2024, published in March 2024; NABCB’s January 2026 criteria still cite the 2015 edition with its 2020 amendment.

So read any “certificate included” offer as a question: which legal entity issues it, and who accredited that entity? Who signs which security document is set out in who can sign your security report.

Check it yourself

How do you check that a certification body is accredited?

About ten minutes. No general Indian law requires an accredited certificate, but customers and some sector regulators check, and will notice its absence.

  1. 1Find the certification body on NABCB's directory of accredited bodies, under management systems, with ISMS in its scope. A body accredited by another signatory to the international recognition arrangement (formerly the IAF MLA) is equally acceptable; check that body's own directory.
  2. 2Look up a certificate the body has issued on IAF CertSearch. ISO's help centre notes it holds accredited certificates only. If one is missing, ask the certification body or the accreditation body before drawing a conclusion.
  3. 3Read the certificate: edition, scope statement, sites, the body's name, the accreditation mark and the dates. The edition must be 2022. Under IAF MD 26, every 2013 certificate expired or was withdrawn by 31 October 2025.

The directories: NABCB accredited bodies and IAF CertSearch.

Do you need one?

Do you need an ISO 27001 consultant at all? Seven routes compared

Do you need an ISO 27001 consultant at all? Seven routes compared
RouteWhat you getWho owns the ISMS afterTypical fitMain risk
In-house, from the standardYour team reads ISO/IEC 27001:2022 and builds the systemYouA team with someone who has run or audited an ISMSCalendar time, and a Stage 1 that finds what nobody knew to write
Compliance platform aloneSoftware that tracks controls and evidence, with policy templatesYou, inside the platform's structureCloud-native teams with engineering timeTemplates adopted unread; the risk assessment is still yours
Platform plus consultantTooling for evidence, a person for scope, risk and audit preparationYouTeams already on a platform for SOC 2Unclear ownership of the risk assessment
Independent consultantOne experienced personYou, if the handover is done properlySmall, single-site scopesOne person's availability; nobody else to audit objectively
Specialist firm (SecureRoot sits here)A small team that implements, runs the internal audit and supports both stagesYouStartups and mid-size firms with a customer deadlineA smaller bench; confirm who does the work
Large consultancyA wide bench, many locations, procurement-ready contractsYouMulti-entity or multi-country scopesDay rates; the people you met may not do the work
“Certification package” sellerOne price for documents and a certificateOften nobody: templates, not a working systemNo buyer whose customer will checkAn unaccredited certificate, or one seller on both sides of the audit

No vendor is named. Every route but the last can end in an accredited certificate.

Why this page does not rank named vendors

The “top consultants” lists for this search are mostly written by firms that appear on them. Another firm’s people and methods cannot be verified from its website, so we give you the checks instead.

The checks

What qualifications and criteria should an ISO 27001 consultant meet?

Seven criteria, each with the clause or document behind it.

  • 1. Named, credentialed people

    What to ask for
    Who works on your scope, with their ISO 27001 Lead Implementer or Lead Auditor certificates.
    Source
    Personal credentials, checkable with the training body. None is legally required, so ask.

  • 2. How they set scope

    What to ask for
    Where they would draw your ISMS boundary, and what that does to fees and audit days.
    Source
    ISO/IEC 27001:2022 clause 4.3; NABCB BCB 125 section 6 on audit days.

  • 3. Their risk method

    What to ask for
    The method, and a redacted Statement of Applicability.
    Source
    Clauses 6.1.2 and 6.1.3: risk assessment and treatment, ending in the Statement of Applicability.

  • 4. An objective internal audit

    What to ask for
    Who runs it, and whether they wrote the controls being audited.
    Source
    Clause 9.2: auditors chosen so the audit is objective and impartial.

  • 5. Support through both audit stages

    What to ask for
    Whether they attend Stage 2 and help close nonconformities.
    Source
    The two-stage initial audit in ISO/IEC 17021-1.

  • 6. Fit with what else you owe

    What to ask for
    How the controls map to the DPDP Act, RBI or SEBI directions, and SOC 2.
    Source
    Your own obligations. One control set can serve several if designed that way.

  • 7. A fixed price after scoping

    What to ask for
    One price for the agreed scope, exclusions in writing, the certification body's fee as its own line.
    Source
    ISO/IEC 17021-1 clause 5.2.5 keeps the certification body separate from the consultant, so ask for its fee as its own line.

If a customer has asked for SOC 2 as well, read ISO 27001 vs SOC 2 before you scope either, and see how a SOC 2 consultant is chosen. If your risk assessment calls for a penetration test, the evidence it should produce is in ISO 27001 penetration testing.

On the first call

Which questions should you ask before you sign?

  1. 1Which certification bodies have your clients used, and are they accredited?A good answer: Names, and where to check each.
  2. 2Who on your team writes our risk assessment?A good answer: A named person, with our risk owners in the room.
  3. 3Can we see a redacted Statement of Applicability?A good answer: Yes, with a reason beside every exclusion.
  4. 4Is the certification body's fee inside or outside your quote?A good answer: A clear answer, and a contract between you and the body either way.
  5. 5Who runs our internal audit?A good answer: Someone who did not write the controls being audited.
  6. 6Do you attend Stage 2?A good answer: Yes, to answer questions and help close findings.
  7. 7What happens if Stage 2 raises a major nonconformity?A good answer: A correction plan, the evidence the body needs, and the cost.
  8. 8What do we own after you leave?A good answer: Every document, editable, in our systems.
  9. 9Is surveillance support priced?A good answer: Yes, separately, so year two is no surprise.
  10. 10What does our team do each week?A good answer: Named tasks and hours per role.

Walk away

Red flags that end the conversation

  • Certification “guaranteed”.Only the certification body decides.
  • A certificate in days, with no gap between Stage 1 and Stage 2.Stage 2 tests controls in operation, which takes time to evidence.
  • The certification body is unnamed, or absent from NABCB and IAF CertSearch.An unaccredited certificate is a document, not a recognised certification.
  • One firm offers to build your ISMS and certify it.ISO/IEC 17021-1 clause 5.2.5 forbids an accredited body from doing both.
  • A template pack sold as an ISMS.Stage 2 looks for the gap between policy and practice.
  • Full payment before the gap assessment.Nobody knows the size of the work yet.
  • ISO/IEC 27001:2013 still quoted.Those certificates ended on 31 October 2025.
  • A CERT-In empanelment badge offered as ISO 27001 credentials.Empanelment is CERT-In's panel for security audits and VAPT, not ISO accreditation.

What it costs

How do ISO 27001 consultants price the work, and how do you compare two quotes?

Four models are common. Each needs a written scope to be comparable.

  • A fixed fee, whole or per phase, for a written scope.
  • Man-days or time and materials: flexible, predictable only with a cap.
  • A retainer for the surveillance years after the first certificate.
  • A platform subscription plus consultant hours: two bills.

Some firms quote consulting only; others quote a total. Put these lines side by side first:

  • The certification body's Stage 1 and Stage 2 audit: inside the quote, or a separate contract?
  • Surveillance audits in years two and three, then recertification.
  • Penetration test evidence, if your risk assessment calls for it.
  • Tooling and training licences.
  • Your own team's time, which no invoice shows and which is usually the largest cost.

Our published figure: Total budget, not our fee alone: ₹1.5 lakh to ₹8 lakh (band supplied 18 September 2026; $1,600 to $8,300 as of 2 October 2026), our programme plus the certification body's audit. The certification body invoices you directly. 4 to 7 months to a first certificate. The breakdown is in ISO 27001 certification cost in India, and every published band is on the pricing page.

Us, plainly

Where SecureRoot fits, and where it does not

Where we fall short

  • SecureRoot is not an accredited ISO certification body; certificates come from the certification body. We can introduce you to bodies; you contract with them directly.
  • SecureRoot is not CERT-In empanelled. That panel covers security audits and VAPT for regulators and tenders, not ISO 27001 certification.
  • SecureRoot is not a CPA firm and does not issue SOC 2 reports; a licensed CPA firm does.
  • No named client references in public. Our case studies are anonymised under NDA.
  • Two offices, both in Uttar Pradesh: Kanpur and Greater Noida West. Elsewhere we work remotely and quote on-site days.
  • A small firm. A multi-country programme may suit a larger bench.

Where we are strong

  • The director who scopes and oversees our ISO 27001 programmes is an ISO 27001 Lead Auditor.
  • One control set and one evidence base serve ISO 27001, SOC 2 and the DPDP Act.
  • A published band, total to certificate, with the date it was supplied.
  • A fixed price in writing after scoping, and dates committed after the gap assessment.
  • We sit alongside you through both audit stages and help close what the auditor finds.

What you receive

  • Gap assessment report
  • Statement of Applicability
  • Risk treatment plan
  • ISMS policy and procedure set
  • Certification audit support

Our compliance work beyond ISO 27001 is under GRC consulting in India, and the equivalent guide for testing firms is how to choose a VAPT company in India.

Book a 30-45 minute scoping callRequest an assessment

Questions

What buyers ask before they choose

  • Can an ISO 27001 consultant issue the certificate?

    No. A recognised ISO 27001 certificate is issued by a certification body accredited by NABCB in India, or by another signatory to the international recognition arrangement (formerly the IAF MLA), after its own Stage 1 and Stage 2 audits. A consultant prepares you for those audits: scope, gap assessment, risk assessment, Statement of Applicability, policies, implementation support and an internal audit. Some sellers hand over a certificate from a body nobody accredited, and that paper rarely survives a customer who looks it up. So when a consultant mentions a certificate, ask which body issues it, who accredited that body, and where you can check it. ISO itself certifies nobody. SecureRoot is not an accredited ISO certification body; certificates come from the certification body. We prepare you and sit with you through both audits; the decision to certify is the body's alone.

  • Can the same firm implement and certify our ISO 27001?

    Not if the certificate is accredited. ISO/IEC 17021-1, the standard accredited management system certification bodies work to, says in clause 5.2.5 that the body, any part of the same legal entity and any entity under its organisational control shall not offer or provide management system consultancy. Clause 3.3 defines consultancy as taking part in establishing, implementing or maintaining a management system, such as writing its procedures or giving specific advice on building it. So a firm that writes your Statement of Applicability cannot be the accredited body that audits it. Where one brand offers both, ask which legal entity signs the certificate, who accredited it, and whether it is separate from the team writing your policies. A consultant may introduce you to certification bodies. It cannot be one, and it should never suggest it can steer the outcome.

  • How do we verify a certification body is accredited in India?

    Three checks, about ten minutes. First, find the body on NABCB's directory of accredited bodies, under management systems, and confirm its accreditation covers information security management systems. NABCB's January 2026 ISMS criteria say accreditation means the body is competent to certify against ISO/IEC 27001:2022. A body accredited by another signatory to the international recognition arrangement (formerly the IAF MLA) is equally valid; check that accreditation body's own list. Second, look up a certificate the body has issued on IAF CertSearch, which holds accredited certificates only. Third, read the certificate: the 2022 edition, the scope statement, the sites, the body's name, the accreditation mark and the dates. A 2013 edition certificate is no longer valid, because those expired or were withdrawn by 31 October 2025. If anything does not match, ask the certification body or the accreditation body directly before you sign.

  • ISO 27001 consultant or compliance platform: which do we need?

    It depends on what is missing. A compliance platform is software: it tracks controls, assigns tasks, collects evidence from your cloud accounts and usually ships policy templates. It does not draw your scope, run your risk assessment or answer an auditor, and it is not a party to the audit. A consultant does those things, but leaves no tooling behind unless you buy some. Teams with engineering time and someone who has run an ISMS before often manage with a platform alone. Teams facing a customer deadline, or starting without a security function, usually need a person for scope, risk and audit preparation, with or without a platform. Watch for templates adopted unread, because Stage 2 tests what you do rather than what you wrote. If you already use a platform for SOC 2, keep it and add consultant hours for the parts software cannot do.

  • What is included in an ISO 27001 consultant's fee?

    Usually the programme in front of the audits: scoping, gap assessment, risk assessment and treatment, the Statement of Applicability, policies and procedures, implementation support, an internal audit and management review, and support through Stage 1 and Stage 2. What varies is everything around it. Some firms quote consulting only and leave the certification body's audit to a separate contract. Others quote a total that includes the body's audit, still paid by you to the body. Surveillance support, penetration test evidence, tooling and training may sit inside or outside either figure. Our own published figure is a total to certificate, the certification body's audit included, so it should not be set against a consulting-only quote. Ask every firm for a fixed price against the same written scope, with exclusions listed and the certification body's fee shown separately.

Primary Sources

Where the Figures on This Page Come From

Clause numbers, accreditation rules and transition dates come from the documents below. ISO/IEC 17021-1 is paywalled, so its clauses are cited through European Accreditation's FAQ, which quotes them.

Send us the scope you would send the other firms

You get a written scope, a timeline and a fixed price back, with the certification body’s fee shown as its own line and a plain answer on which bodies you could use.

Request an assessment +91-7307148874