The ISO 27001 consulting industry exists for one reason: the standard reads like it needs an interpreter. For years, it did. But interpretation is exactly what software has gotten good at, and a startup in 2026 can go from zero to certificate without a single consultant day. Here's the complete playbook.
Step 1, Scope honestly (day one)
Define what the ISMS covers. For almost every startup the right answer is the whole company, buyers read scope statements, and a certificate covering "the Dublin office only" impresses nobody. Answer the scoping questions plainly; the AI turns them into your scope document.
Step 2, Connect everything (day one, continued)
Every integration you connect converts future manual evidence into automatic evidence. Cloud provider, directory, code hosting, workspace, connect them before drafting starts, because what the AI knows about your stack shapes every document it writes.
Step 3, Review the drafts like you mean it (weeks 2–3)
Policies, risk register, and Statement of Applicability arrive drafted. The no-consultant route fails only when this review is skipped: the auditor interviews humans, not documents. Read what you're adopting; adjust what doesn't match reality. The drafts are scoped to your company, so this is hours per policy-owner, not weeks.
Step 4, Close real gaps (weeks 3–6)
The gap list is where certification produces genuine security value: 2FA enforcement, offboarding automation, backup restore tests, supplier DPAs. Work it like a sprint backlog with owners and dates. This is also the phase where the risk register earns its keep, gaps map to risks, closures update them.
Step 5, Run the rhythm (weeks 4–8)
Before Stage 2 you need an internal audit and a management review, the standard checking that you check yourself. Neither needs a consultant: the internal audit needs someone independent of the thing audited (a co-founder works at startup scale), a checklist, and written findings. The management review is a structured meeting with minutes. Templates for both are generated; calendar discipline is on you.
Step 6, Choose your certification body early (week 2, in parallel)
- Only accredited bodies (UKAS or national equivalent), an unaccredited certificate is worthless to buyers.
- Get three quotes; fees and lead times vary widely. We introduce customers to three.
- Book Stage 1 the moment your document set stabilises, auditor calendars, not preparation, are the usual bottleneck.
What consultants actually sold was confidence that nothing was forgotten. A platform that tracks all 93 controls, every document, and every piece of evidence sells the same confidence, with a dashboard instead of a day rate.
What this costs and how long it takes
Four to eight weeks to Stage 1 readiness (timeline details), under €8K all-in including audit fees (cost details), versus €22K–€47K the consultant way. The certificate is identical. The difference is who did the tedious parts. Start today from €149/month.