ISMS consultants in comparison: External structure of an ISO/IEC 27001:2022 system

An ISMS consultant leads a company's information security management system (ISMS) from an initial maturity analysis to readiness for certification according to ISO/IEC 27001:2022. The standard requires a risk-based approach with documented processes for all 93 controls from Appendix A, a Statement of Applicability (SoA), a risk assessment and risk treatment plans, internal audit and management review. In traditional consulting, the setup takes between six and twenty-four months, depending on the size of the company, the level of preparation and the availability of internal resources. The initial certification effort for medium-sized companies is typically between 60,000 and 250,000 euros consulting fee plus certification costs of the testing centre. These costs are a main reason why companies ask themselves which model is actually worthwhile.

This article classifies the role of the ISMS consultant, compares classic consulting with platform-supported in-house performance and officer-as-a-service and shows how CIVAC as a compliance platform and officer-as-a-service puts the structure on a verifiable path. Licence the workspace for your internal representatives or have our representatives order it. Both models result in the same proof. The appointment certificate, signed, filed, verifiable. The choice is therefore not just a cost decision, but a control decision that will shape the next three audit cycles. Anyone who initiates the development now will secure options for customer relationships that would be lost without a certificate.

An ISMS consultant typically supports four phases. Firstly, a maturity analysis in which the status quo is compared against the standard requirements, including an inventory of the existing processes, documents and controls. Secondly, the structure, which includes the statement of applicability, the information security policy, the risk assessment and the risk treatment, supplemented by procedural instructions for all 93 controls from Annex A of ISO/IEC 27001:2022. Thirdly, the test run with an internal audit, management review and correction of the deficiencies found. Fourth, the external Stage 1 and Stage 2 audit is accompanied by an accredited certification body.

The standard requires several specific artifacts. The Statement of Applicability explains for each of the 93 controls whether it is applicable and how it is implemented. The risk assessment identifies threats and vulnerabilities, evaluates impacts and probabilities of occurrence and derives risk owners. Risk treatment documents accepted, avoided, shifted or reduced risks with measures, responsible persons and deadlines. In addition, there are awareness trainings, supplier assessments, incident response and continuous improvement in a plan-do-check-act cycle.

The consulting service is successful when the ISMS is lived and does not just exist as a stack of files. Supervisory authorities and auditors quickly recognise whether an ISMS has been set up or anchored. The CIVAC workspace traces every requirement back to an audit template and an owner, so orders, training and reviews come together in one reporting line. The information security officer does not work in a Word document, but in a testable control environment with versioning and audit trail. This anchoring is the difference between a certificate and a reliable level of protection. The interactions with NIS-2 and the GDPR are also part of the methodological core because the standard explicitly refers to integrated management systems and avoids duplication of work between cyber, data protection and supplier risks.

External advice makes sense if there is neither methodological experience nor capacity internally and the company has a fixed certification date. Typical occasions are a customer request for a certificate, a tender with ISO/IEC 27001 as a minimum criterion, an NIS 2 requirement or a corporate requirement. In these cases, an experienced consultant provides a structured roadmap, experience from multiple projects and an external driver to remind management of results. The effect depends crucially on the availability of internal contacts.

Classic advice makes less sense if internal competence is available or if the advice is intended as a substitute for internal responsibility. ISMS consulting can set up a system, but cannot operate it. As soon as the consultant leaves, the driver is missing and the system becomes outdated within months. Without internal anchoring, the certificate expires again in the surveillance audit phase, often visible in defect lists that are not processed. The alternative is a model in which the platform takes over the control and the consultant provides the methodological contributions.

CIVAC therefore offers two models as an alternative to classic hourly rate consulting. Firstly, the workspace for internal ISBs with 490 audit templates, pre-built SoA framework, risk register and audit mode. Secondly, the Officer-as-a-Service, where an external ISB is appointed to permanently manage the ISMS. The choice depends on internal staffing levels and risk exposure. In both cases, the consulting service becomes a management service, with a clear appointment certificate and SLA. The appointment certificate, signed, filed, verifiable. An honest comparison of both models over three audit cycles regularly shows that the ongoing control costs via the platform are lower than recurring consulting fees for each recertification and surveillance audit.

The selection of an ISMS consultant follows three sets of criteria. Firstly, personal certificates such as ISO/IEC 27001 Lead Auditor, ISO/IEC 27001 Lead Implementer, CISSP or CISM. These are a necessary condition, but do not replace project experience. Secondly, industry experience in comparable sectors, because regulatory expectations vary greatly depending on the industry. A consultant with experience in financial services knows MaRisk and DORA, a consultant in the healthcare sector knows KHZG and medical hygiene law. Thirdly, references with certification success, ideally with statements from former customers about the actual anchoring of the system after the end of the project.

A trial session with a specific task from your own company is helpful. In a one-hour meeting, the consultant should discuss a risk assessment for a selected business process, explain the statement of applicability using an example control and be able to suggest a pragmatic way of dealing with a vulnerability finding. Vague answers or mere references to standards are a warning signal. The good consultant provides concrete recommendations with an estimate of the effort and risk information.

The soft criteria include cultural fit, communication style and availability of the specific people employed. Consulting firms often sell with senior profiles and deliver junior profiles that rotate after three months. This must be secured in the contract by naming names and changing rights. CIVAC addresses this risk structurally because the reporting line to a permanent representative remains stable in terms of personnel and the platform carries the knowledge base, not a single consultant. In this way, you avoid loss of knowledge when personnel changes and ensure continuity across audit cycles. It is also worth checking whether the consultant has experience with the specific accreditation body of your testing centre, because testing cultures differ between DAkkS-accredited and internationally operating bodies in terms of sample selection and depth.

The initial certification according to ISO/IEC 27001:2022 typically causes expenditure in three blocks in medium-sized companies. Consulting fees between 60,000 and 250,000 euros, certification costs for the testing centre between 8,000 and 30,000 euros depending on the number of locations and person-hours, as well as internal expenses of 200 to 1,200 person-hours in the line organisation. These internal expenses are often not shown in consulting offers, but are relevant to the balance sheet and lead to the actual doubling of the total costs in many projects.

The most important cost drivers are the number of locations, the complexity of the IT landscape, the number of relevant business processes, the existing level of maturity and the willingness of the departments to participate. A company with three locations, hybrid cloud, existing IT governance and committed management achieves certification in nine to twelve months. A company with ten locations, mature IT, weak supplier management and competing priorities requires eighteen to twenty-four months and the upper end of the cost range. An honest effort estimate is the basis of all project planning.

Platform-based models typically reduce costs by 30 to 50 percent because they automate documentation effort, template reuse and audit preparation. The CIVAC workspace provides 490 audit templates and 93 control data cards as a starting point and shortens the initial intake to two working days instead of the classic four to eight weeks. Others run compliance like a filing cabinet. We run it like software. The auditor calls, the evidence is ready. This acceleration does not just work once, but also with every annual surveillance audit and every three years of recertification. These realistic figures must be clearly reflected in management's investment planning so that budget, personnel and time are planned consistently and no delivery obligations clash with tightly budgeted surveillance audits.

CIVAC combines compliance platform and officer-as-a-service. The workspace brings a standards database for ISO/IEC 27001:2022 with all 93 controls from Annex A, an SoA framework, a risk register with inherent and residual risk, a measures register, a supplier register, an internal audit plan and a management review mode. Each requirement is linked to an audit template, which serves as a starting point for the company-specific version and becomes final when the version is released by the ISB.

The representative is either your internal ISB, which licences the workspace, or our external ISB, which is ordered via Officer-as-a-Service. In both models, the reporting line to management is clearly regulated, the order is written, and the SLA is documented. The workspace has EU data residency, access segregation, audit trail and versioning as standard. The system thus meets the documentation requirements that an external auditor expects in the audit and significantly reduces the preparation time for the audit.

The consulting service becomes a control service. Instead of hourly rate advice with timesheets, the work takes place as a guided workflow in the workspace. Tasks are assigned, processing times are measured, approvals are documented. During a surveillance audit or recertification, the ISB exports the relevant evidence in less than two working days instead of the classic two to six weeks. Licence the workspace for your internal representatives or have our representatives order it. Both models result in the same proof and both models survive the hectic pace before the audit equally cleanly. Dual licensing of workspace and external ISB is the most sought-after hybrid mode in the market because it keeps knowledge external and at the same time firmly anchors operational responsibility within the company.

ISO/IEC 27001:2022 requires in Chapter 9 at least one internal audit per year and a documented management review. The internal audit checks the ISMS against the standard and its own guidelines. The internal auditor must be independent of the process being audited; in small companies this role is often filled externally. The audit report contains findings, deficiencies, opportunities for improvement and recommendations. Defects must be dealt with with measures, responsible persons and deadlines and verified in follow-up tests.

The management review according to Chapter 9.3 is a periodic discussion between top management with defined input values. Status of security objectives, changes in internal and external topics, results of internal and external audits, fulfilment of security requirements, status of measures from the last review, supplier performance, incidents and key figures. Decisions about resources, goals and improvements follow from the review. Without a documented review, the ISMS is considered not managed and the certificate is at risk because senior management does not fulfil its control responsibilities.

The CIVAC workspace carries out internal audit and management review as interlocked modules with templates for audit plans, audit checklists, audit reports and review protocols. Defects are added to the action register, those responsible are notified, deadlines are monitored. The external ISB creates the audit report and the management review proposal in less than a week instead of the classic three to six weeks. This speed moves the ISMS from delivery obligation to control mode and improves the quality of management decisions. The key figures that flow into the review are also configured as dashboards in the workspace, so that upper management can see the trend over several reporting periods and decisions are made based on data. This shifts the role of the external ISB from file maintenance to strategic advice to management.

The most common audit findings according to ISO/IEC 27001:2022 concern the area of ​​suppliers and interfaces. With Controls 5.19 to 5.23, Appendix A contains its own requirements for supplier relationships, the risk assessment per supplier, the contractual definition of security requirements and the ongoing monitoring of supplier performance. In practice, there is often a lack of ongoing monitoring, which requires documented security assessments beyond the initial conclusion of the contract.

Cloud providers are a special case. They usually provide SOC 2 or ISO 27001 reports that must be integrated into your own supplier register. Responsibilities in the shared responsibility model must be clearly separated, including identity and access management, encryption, patching and logging. An evaluation of the configuration by the customer is mandatory because the provider only certifies the platform layer. Anyone who fails to do this risks receiving a failing grade in the area of ​​supplier management in the examination, which regularly leads to the suspension of the certificate in the surveillance phase.

Interfaces with processors in accordance with Art. 28 GDPR override the requirements. The ISMS consultant must synchronize the two spheres so that the supplier list, AVV register and risk assessment show the same data. The CIVAC workspace maintains a unified supplier file that brings together ISO 27001 controls and GDPR obligations in one view. Licence the workspace or have our officers appointed it. In both cases, ISB and DSB see the same truth, which closes the most common source of contradictory audit statements and makes corporate reporting coherent. This synchronization reduces the effort required for inquiries from customers, regulatory authorities and insurance companies because a single supplier list forms the basis for all of the organisation's viewing and reporting obligations. Sub-service providers of your suppliers must also be included in the assessment if they have access to your data or systems because the ISMS maps the entire chain.

Certification is carried out by an accredited testing centre in two stages. Stage 1 is a document inspection with an on-site appointment in which the auditor checks the documentation for completeness and fundamental suitability. The statement of applicability, the risk assessment, the information security policy, the audit plan and the management review are compared against the standard. Stage 1 identifies areas that will be examined in more depth in Stage 2 and gives the organisation a final opportunity for improvement.

Stage 2 is the actual certification audit. The auditor checks the effectiveness of the controls using random samples in the departments, conducts interviews with those responsible, checks records and receipts and observes processes in the company. Findings are classified into categories. Major Nonconformities prevent certification until they are closed, Minor Nonconformities enable certification with tasks, Observations are notices without obligation. If the audit is successful, the testing centre issues the certificate for three years, with annual surveillance audits between recertifications.

Surveillance audits are smaller than the initial certification, but methodologically identical. You check the ongoing effectiveness of the ISMS, the correction of the previous year's findings and the timeliness of the documentation. Without a living ISMS, organisations do not pass the surveillance phase and the certificate expires. The CIVAC workspace runs an audit mode with prepared dossiers, deficiency lists and document indices for each certification date. Audit-proof, documented, paragraph-proof. Surveillance audits are usually successful without major nonconformities and with reduced internal lead times. The preparation also includes briefing the department representatives, who have to give valid answers in interviews because the auditor does not derive effectiveness from documents alone, but from statements and evidence at the same time.

Anyone who sets up an ISMS is faced with the choice between a classic consulting project and a model in which the platform and the representative work together. Classic consulting provides methodology and structure, but often leaves behind documentation that becomes outdated after the end of the project. CIVAC replaces this path with a compliance platform and officer-as-a-service in which ISMS construction, operation and audit preparation occur in one reporting line. Others run compliance like a filing cabinet. We run it like software. This means that the system remains alive even after the initial certification.

You have two options. If you licence the workspace for your internal officers, your information security officer will work in an environment with EU data residency, 93 ISO/IEC 27001:2022 controls, 490 audit templates and a structured mode for internal audits and management reviews. Or have our officers appointed it. CIVAC then takes over the function of the external ISB with an appointment certificate, reporting line and SLA. Both models result in the same proof. The appointment certificate, signed, filed, verifiable.

If you are planning an initial certification, preparing a surveillance audit or want to get an existing ISMS out of the dust, the quality of the control system determines the audit process. CIVAC shortens audit preparation to two working days instead of the classic two to six weeks. Turn reading into an assignment. Write to info@civac.de or use the contact form on civac.de/faq to start an initial assessment of your ISMS maturity level. You will receive a response within 24 hours with the next steps and an estimate of the effort. The initial assessment includes a gap analysis against ISO/IEC 27001:2022, an indicative effort estimate for both models and a three-phase roadmap that can be discussed with your management in one hour.