ISO 27001 Without a Consultant: UK SMB Guide

Yes — a UK small business can get ISO 27001 certified without a consultant, and the parts that make it possible are the parts people expect to be hardest. The documentation is doable in-house; the risk assessment is doable in-house; the two things that break DIY implementations are scope definition and the technical controls you do not currently have. If your organisation already has reasonable security hygiene and someone with eight to twelve weeks of part-time capacity, DIY is realistic. If your scope covers a product you build and operate, or your Annex A gaps are technical rather than documentary, buying targeted help for those specific gaps is cheaper than buying a full implementation.

What a consultant is actually being paid for

Consultancy on ISO 27001 typically bundles five things. Separating them is the whole decision.

What you are buying	Can a competent SMB do it in-house?
Scope definition	Risky — the most common expensive mistake
Risk assessment method and execution	Yes, with a method to follow
Documentation set	Yes — this is the bulk of the cost and the most doable part
Technical control implementation	Depends entirely on the gaps
Audit readiness and rehearsal	Yes, if you run a real internal audit

The two rows marked risky are where DIY implementations fail. Everything else is work, not expertise.

The part you can genuinely do: documentation

The mandatory documented information for ISO 27001 is a known, finite list. It is not a mystery and it does not require a specialist to draft — it requires someone who knows the business and will sit down with it.

Our ISO 27001 mandatory documents guide sets out the full list by clause. The pieces most businesses find fiddliest, with the guides for each:

Statement of Applicability — the document auditors spend most time on
ISO 27001 risk assessment — method, scoring and a worked example
ISO 27001 policy templates — which policies you need and what each must say
ISO 27001 list of controls — what each Annex A control asks for in plain English
ISO 27001 internal audit guide — programme planning and checklist structure

Start with a gap analysis and the free Annex A controls checklist, which walks the Annex A controls with an applicability assessment.

The part that breaks DIY implementations: scope

Scope is the single decision that determines how much work everything else is, and it is the one people get wrong.

Too wide and you are implementing controls across systems, sites and people who did not need to be in scope — months of unnecessary work and permanently higher audit costs. Too narrow and the certificate does not cover what your customer asked about, which means you have spent the money and still fail the requirement.

The test that matters: what did the customer or contract actually ask you to certify? Read the question you are answering before you draw the boundary. If a customer's security questionnaire asks about the platform that processes their data, the scope needs to cover that platform, its supporting infrastructure, and the people who operate it — and not necessarily your whole company.

If you take one piece of paid advice on the entire project, take it here. Half a day of an experienced pair of eyes on a scope statement is the highest-value money in an ISO 27001 implementation.

The other part that breaks DIY: technical gaps

Documentation gaps are writing. Technical gaps are engineering, and no amount of consultancy fixes them for you — a consultant tells you the gap exists and you still have to close it.

Run the free Annex A controls checklist early and sort the gaps into two piles: gaps that are "we do this but have not written it down" and gaps that are "we do not do this". The first pile is a documentation exercise. The second is a project with a budget.

Where UK guidance helps: the NCSC's 10 Steps to Cyber Security and its risk management guidance are free, authoritative and map closely onto the practical side of an ISMS.

Cyber Essentials is also worth considering as a stepping stone. NCSC describes it as "the minimum standard of cyber security recommended by the Government for organisations of all sizes", built on five technical controls: "Firewalls", "Secure configuration", "Security update management", "User access control" and "Malware protection". Those five overlap materially with the technical end of Annex A, and the scheme is a far cheaper way to find out whether your technical baseline is sound — NCSC lists Cyber Essentials pricing as starting at £320 plus VAT depending on organisation size, against an ISO 27001 certification bill in the thousands. Certifying to Cyber Essentials first is not a requirement and does not shorten an ISO 27001 audit, but failing it tells you something useful before you have spent the larger sum.

An honest capacity estimate

For a single-site business under 50 people with a software or services scope, working from a reasonable security baseline:

Phase	Realistic effort
Scope definition and agreement	1–2 days (plus, ideally, paid review)
Gap analysis against Clauses 4–10 and Annex A	2–3 days
Risk assessment and risk treatment plan	3–5 days
Documentation set	8–12 days
Closing technical gaps	Unknown until the gap analysis — this is the variable
Running the ISMS to generate records	2–3 months elapsed, low effort
Internal audit and management review	2–3 days

Call it eight to twelve weeks of part-time work for one capable person, excluding technical remediation. That is the honest number. If nobody has that capacity, the choice is not DIY versus consultant — it is consultant versus not doing it, and a stalled half-implementation is the worst of the three outcomes.

When to buy help anyway

Your scope covers a product you build and operate. More moving parts, more judgement, higher cost of getting the boundary wrong.
You are certifying against a deadline in a contract. DIY timelines slip because the work competes with the day job. A deadline changes the maths.
Your gap analysis surfaces a long technical pile. You need engineering time, not documentation time, and someone has to scope that work.
You need ISO 9001 as well. Running both together is cheaper than sequentially, but the integration itself takes design. ISO 9001 vs ISO 27001 covers which you need, and the ISO 27001 certification cost guide covers the numbers.

The middle path is usually right: do the documentation yourself, buy a day for scope and a day for a pre-audit review. That is a four-figure spend against a five-figure one, and it puts the money where the risk actually is.

Practical takeaway checklist

Write the scope from the question your customer actually asked
Get one experienced review of the scope statement before building anything
Run the Annex A controls checklist early
Sort gaps into "not written down" and "not doing it"
Budget engineering time for the second pile before committing to a date
Consider Cyber Essentials as a cheap test of your technical baseline
Use NCSC guidance for the practical security side — it is free and authoritative
Draft the documentation in-house; it is the largest and most doable cost
Run the ISMS long enough to generate real records before booking Stage 2
Run a genuine internal audit with an independent auditor

If you are at the "where do I even start" stage, ISO 27001 compliance for small businesses sets out the five-step route from scope definition to certification audit.

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. Cyber Essentials pricing and control descriptions are quoted from NCSC guidance as at the date shown and may change. ISO 27001 is a voluntary standard, not a legal requirement. Verify certification requirements with your UKAS-accredited certification body.