1. Who will actually do the work?
Ask for the names and experience of the people on your project, not only the sales contact. The consultant who scopes your project and writes your controls should be a practitioner, not someone handing you over to a junior team after signing.
2. Will they implement, or hand over templates?
A pile of templates leaves you to work out what to do. Ask whether they will work alongside your engineers on access control, logging, vendor management and incident response, and how often. Policies that do not match how you operate fail audits and are ignored by your team.
3. Which certification body, and is it accredited?
The certificate is issued by an independent certification body, not the consultant. Make sure it is accredited for ISO 27001 (in the UK, by UKAS), because accreditation is what makes the certificate credible with buyers. Ask who books the audit and whether dates are already secured.
4. Is the timeline realistic and explained?
The industry norm is six to nine months. A shorter timeline can be real for a tight scope and a responsive team, but it should be explained, with the assumptions stated. Be careful with promises that ignore certification-body scheduling and the fact that the ISMS must operate before Stage 2.
5. What is in the quote, and what is not?
Total cost usually has three parts: consultancy support, tooling and the certification body's fees. Ask which of these the quote covers, what happens if scope grows and whether the internal audit is included.
6. Will they be with you on audit day?
Ask whether the consultant attends Stage 1 and Stage 2 with you and answers the auditor's questions directly. Support that ends before the audit leaves you defending the work alone.
7. Do they understand your scope and customers?
A SaaS company selling to US and UK enterprises needs different advice from a manufacturer. Ask about experience with your kind of scope, your regions and the other frameworks your customers ask for, such as SOC 2, GDPR or DORA.
How we approach it
ISONEX is a remote-first practice built around these questions: practitioner-led delivery, hands-on implementation, coordination with an accredited certification body and support through both audit stages. Our target is a Stage 2 audit within 75 days of kickoff for a defined scope, subject to certification-body scheduling. See our ISO 27001 page, or book a free advisory session. If you are a UK startup, ISO 27001 for UK startups covers where to begin, and fintech teams can read ISO 27001 for fintech companies.
