Short answer: Choose an ISO 27001 consultant by checking whether they understand your scope, can explain who owns each decision, produce usable work, transfer knowledge, and state clearly what they can and cannot guarantee. A consultant can support readiness; certification is a separate independent assessment decision.
Start with the outcome you need
Be specific about the work: scope definition, gap assessment, risk treatment, control mapping, policy drafting, implementation support, internal audit preparation, or project coordination. Ask for deliverables and acceptance criteria for each stage instead of buying a vague promise of “compliance”.
Ask who owns each decision
The consultant may facilitate risk workshops or draft documents, but your organisation remains responsible for its scope, risk acceptance, policy approval, implementation, and evidence. Ask how those decisions will be made and recorded. Be cautious when a proposal implies that a document pack alone will make the business certified.
Test the approach with a real example
Ask how the consultant would handle an unclear asset owner, a supplier dependency, an out-of-scope system, or a control that is not yet implemented. A good answer distinguishes facts, assumptions, gaps, and decisions. It does not fill missing information with confident prose.
Check for knowledge transfer
The team should be able to maintain the ISMS after the engagement. Confirm who will be trained, what working files and decisions will be handed over, and how future reviews will run without permanent consultant dependency.
Keep certification boundaries explicit
Ask which activities the consultant performs and which must be performed by an independent certification body or other reviewer. Review the engagement for confidentiality, data handling, conflicts of interest, change control, and support after delivery.
Practical example
Ask a consultant to scope one product, identify interested parties, describe the readiness deliverables, and show how open decisions will be tracked. A useful proposal names what the consultant will do, what the client must decide or implement, and what an independent certification body would assess.
FAQ
Can a consultant guarantee ISO 27001 certification?
No. A consultant can support readiness work, while an independent certification body makes the certification decision for the defined scope.
What should a consultant proposal include?
It should state scope, deliverables, assumptions, client responsibilities, decision points, evidence expectations, timetable, fees, and exclusions.
How Framework Pro fits
Aneo Framework Pro uses questionnaire answers and business context to generate tailored, editable security policy drafts and supporting readiness documents. The outputs still require human review, approval, implementation, and evidence. They do not certify a business, guarantee compliance, replace controls, or provide legal advice.