ISO 27001: DIY vs consultant vs compliance platform

Three routes to the same certificate, and only one of them publishes a price. The GRC platforms list real dimensions on AWS Marketplace. Consultants publish no day rate, and neither do certification bodies. So this comparison is not a cost table: it is an honest account of what each route changes, what stays the same no matter which you pick, and how to decide.

Updated July 2026

The route does not change the audit

Start here, because it removes the most common reason people choose badly. The certification body determines audit time under ISO/IEC 27006-1:2024 from your scope, the number of people doing work under your control inside it, the complexity and risk of the ISMS, your sites, and your delivery mode. How you prepared is not one of the inputs. Nobody gets a discount for having used a platform, and nobody pays a premium for having done it themselves. The audit fee was never the variable these three routes compete on, and the choice is much clearer once you stop treating it as one.

What each route actually changes

DIY

No published external price, because there is nothing to buy

You run the ISMS yourself: policies, risk assessment, Statement of Applicability, evidence collection, internal audit, management review. The external spend is the audit and the standard.

What it removes: subscription and engagement cost
What it adds: all the repetitive evidence work, in-house
Needs: someone who knows the standard, and time that actually exists
Real risk: the work competes with the day job and loses quietly

Platform

The only route with published list prices

The platform automates evidence collection against integrations, carries policy templates, and tracks control state. You still own the ISMS, the risk decisions and the scope.

What it removes: repetitive evidence gathering
What it adds: a subscription with a published band, up to about 100 people
Needs: an owner who makes the decisions the tool cannot
Real risk: mistaking a green dashboard for a management system

Consultant

No published day rate anywhere

A consultant brings judgement: scope decisions, risk treatment reasoning, audit preparation, and the experience of having seen what auditors ask for.

What it removes: the learning curve, and some of the decisions
What it adds: an engagement priced per engagement
Needs: a scope in writing and named deliverables
Real risk: a certificate the organisation does not understand or own

These are not exclusive and most organisations combine them. The useful framing is not which one to pick but which parts of the work you want to own. A platform absorbs the repetitive work. A consultant absorbs the judgement calls. Everything neither of them does is yours by default, and the scope decision, the risk decisions and the management commitment are always in that category whatever you buy.

The platform layer, on published figures

Every figure below is read off the vendor's public AWS Marketplace listing and checked July 2026. Each is a separate pricing dimension on a 12-month contract. AWS publishes no combined total, so we do not present one, and where a listing calls a figure a starting price it is a floor and we label it.

Platform	Published dimensions (per 12-month contract)	Listing
Vantastarting price	$14,000 Essentials Package (1-20 employees, per 12-month contract) $21,500 Plus Package (1-20 employees, per 12-month contract) $23,000 Professional Package (1-20 employees, per 12-month contract)	AWS Marketplace
Drata	$25,000 Platform Fee (capacity for a 100 FTE org, per 12-month contract) $7,500 ISO 27001 framework (per 12-month contract)	AWS Marketplace
Secureframe	$7,500 Access the Secureframe Platform (up to 100 employees, per 12-month contract) $7,500 First Framework (choice of any framework, per 12-month contract)	AWS Marketplace
Sprintostarting price	$7,500 Starter Platform (up to 100 employees, per 12-month contract) $2,000 First Compliance Framework (starting at $2,000 each, per 12-month contract)	AWS Marketplace
Scytalestarting price	$7,500 Software Platform (bundles one framework, per 12-month contract) $2,100 Additional Framework (per 12-month contract) $4,000 Consulting (per 12-month contract)	AWS Marketplace

Note the ceilings as much as the figures. Vanta publishes an employee range only for its Essentials package at 1-20. Secureframe and Sprinto publish platform dimensions up to 100 employees. Drata publishes its platform fee as capacity for a 100 FTE organisation. Scytale publishes no employee band at all. Above those lines every platform moves to a private offer, so the published advantage of this route is real at startup size and gone by mid-market. See what changes at 100 to 500 people.

The two layers nobody publishes

Consultants

No consultant day rate is published. Firms quote per engagement, and we do not print a band we would have to assemble from assumptions. What makes consultant quotes comparable is not a rate, it is a brief: the same scope, the same deliverables, the same definition of done, sent to more than one firm.

Worth asking:

What are the named deliverables, in writing?
Who does the work, and are they the person in this meeting?
What happens if the audit raises findings?
What do we own and operate after you leave?

Certification bodies

No accredited body publishes a rate card, and the audit-time provisions sit in ISO/IEC 27006-1:2024 Annex C, which ISO sells. Both inputs to the fee are unpublished, so the fee is unpublished. This layer is identical across all three routes.

Worth asking:

How many audit days did you determine, and on what basis?
Are you accredited for ISO/IEC 27001 specifically?
What does the full three-year cycle cost?
How are travel and expenses quoted?

Which route is right for you

Has anyone here run an ISMS before?

If yes, the learning curve is not your constraint and a platform plus your own judgement is a coherent route. If no, that gap gets filled by a consultant or by time, and time is the more expensive of the two when a deal is waiting.

Is the scope genuinely settled?

Scope is the largest lever over audit time and it is never a tooling decision. If the scope is contested internally, that is a conversation to have before you buy anything, because every route prices against a scope you have not fixed yet.

Are you above roughly 100 people?

If yes, the platform layer stops having a published price and becomes a negotiation like everything else. That does not make it wrong, but it removes the one advantage this route had that you could verify independently.

Who owns the ISMS after certification?

The certificate is not the end of the work. Surveillance audits, evidence, and management review are ongoing. A route that produces a certificate but no owner produces a problem at the first surveillance visit.

Is a real deal waiting on this?

If yes, the constraint is calendar rather than cost, and the thing that does not compress is the ISMS running long enough for Stage 2 to test it. If no, the honest question is why you are doing this now at all.

Consultant engagements

Models, and what to ask before you sign

How audit fees are set

The layer no route changes

What is published for your size

Platform bands by headcount

Frequently asked questions

Can you get ISO 27001 without a consultant?

Yes. Nothing in the standard requires a consultant, and nothing in it requires a platform either. ISO 27001 requires an information security management system that meets the standard's requirements, and an accredited certification body audits whether you have one. It is indifferent to who did the work. What a consultant and a platform change is where the labour sits and how much of it is repetitive, not whether the certificate is achievable or what it is worth once you hold it.

What does a compliance platform cost?

This is the only route with published prices. On AWS Marketplace, Vanta lists a $14,000 Essentials package for a 1-20 employee band. Secureframe lists $7,500 for platform access up to 100 employees plus $7,500 for a first framework described as a choice of any framework. Sprinto lists $7,500 for its Starter platform up to 100 employees, with frameworks from $2,000 each. Scytale lists a $7,500 starting price bundling one framework. Drata lists a $25,000 platform fee for capacity for a 100 FTE organisation plus $7,500 for ISO 27001. All checked July 2026, all separate 12-month contract dimensions, and none of them a total. Above roughly 100 employees the published bands run out.

What does an ISO 27001 consultant cost?

No consultant day rate is published, so we do not print one. Consultancies quote per engagement, and any site giving you a day-rate band has assembled it from assumptions or from aggregators we do not cite. What you can do is compare structure rather than price: ask for a fixed scope with named deliverables, ask who is actually doing the work rather than who is selling it, and ask what happens if the audit surfaces findings. A consultant who will put deliverables in writing is comparable against another one who will.

Does DIY actually save money?

It moves cost rather than removing it. The external spend falls because you are not buying a platform subscription or a consultant engagement, and the internal time rises because the evidence collection, policy authorship and audit preparation still have to happen and now happen in-house. We do not publish a percentage for the trade, because that would require a consultant day rate we cannot source and an internal hours figure specific to your team. The audit fee does not change either way: certification bodies determine audit time from your scope, headcount and risk, not from who prepared you.

Which route is right for a startup?

At 5 to 25 people the published platform bands genuinely cover you, which is not true higher up. Vanta's only published employee range, 1-20, sits on exactly that band, and Secureframe, Sprinto and Scytale all publish figures that a startup can read before speaking to anyone. That is real information available to you and nobody else on this site, so it is worth using. Whether you add a consultant on top is a question about whether anyone in the building has done this before, not a question about size.

Does the route change the audit fee?

No. The certification body determines audit time under ISO/IEC 27006-1:2024 from the number of people doing work under your control within the ISMS scope, the scope itself, the complexity and risk of the ISMS, the sites involved, and how much of the audit runs remotely. How you prepared is not an input. What preparation changes is how the audit goes: a well-run ISMS with evidence where the auditor expects it produces fewer findings and less remediation, which is real value that shows up in your calendar rather than in the quote.