Yes. You can get ISO 27001 certified without a consultant in 2026 by building and running your information security management system internally. You still need competent people, evidence that your controls work, an objective internal audit and an independent certification body; removing the consultant does not remove those requirements.
Can you get ISO 27001 certified without a consultant?
ISO 27001 does not require you to hire a consultant. It requires you to establish, implement, maintain and continually improve an information security management system, often shortened to ISMS.
You choose how to organise that work. The practical choice is between managing preparation manually, using software or buying advice for work your team cannot complete confidently.
| Preparation route | Best for | Main advantage | Main limitation |
|---|---|---|---|
| Internal team with documents and spreadsheets | Businesses with competent staff and time to manage records | Direct control over decisions and documentation | Your team handles tracking, updates and evidence organisation |
| Internal team with compliance software | Businesses that want to automate repeatable compliance tasks | Software supports administration and control management | People still approve policies, assess risks and own decisions |
| Consultant-supported implementation | Businesses with a defined knowledge or capacity gap | Access to specialist advice for the agreed work | Advice does not replace internal accountability or independent certification |
Start with an ISO 27001 gap analysis before certification. Identify missing requirements before deciding whether you need software, specialist advice or simply clearer ownership.
A consultant is an implementation adviser, not a substitute for the certification body. Keep those roles separate when you compare proposals.
Why this matters
Choose the support your business needs, not a compulsory service that the standard does not require. A capable internal team can lead certification preparation, but someone must still coordinate the work and secure management decisions.
For a SaaS business preparing in 2026, the useful question is whether your team can explain its security decisions and prove that its processes operate. A folder full of policies cannot answer that on its own.
The requirements sit across 7 management-system clauses, clauses 4–10. Annex A contains 93 reference controls across 4 control themes: organisational, people, physical and technological.
These figures describe ISO/IEC 27001's requirements and reference controls, not a workload estimate. You must address the management-system requirements and determine which controls are necessary for your risks and obligations.
How to achieve ISO 27001 without a consultant
Follow this sequence to organise your preparation. Each step needs an owner and a clear output, whether you use spreadsheets or software.
1. Scope
Define exactly what you want certified. Describe the services, teams, locations, systems and information covered by your management system.
For a SaaS company, consider the product environment and the supporting activities that affect its security. Do not exclude an important dependency merely because another team or supplier operates it.
Record:
- The services and business activities within scope.
- The information those activities use.
- The systems, people and suppliers supporting them.
- The boundaries and interfaces with activities outside scope.
Your certificate will describe a scope. Check that it matches the assurance your customers actually need.
2. Ownership
Give the programme an accountable internal owner. That person coordinates work, follows up actions and brings decisions to management.
You also need people who can implement technical controls, manage employment-related processes and approve business decisions. Assign responsibilities to the people who actually control those activities.
ISO 27001 requires competence, not a particular job title. Identify what each responsible person needs to know, assess their competence and address gaps through appropriate training or support.
Management must remain involved. A consultant or software platform cannot accept business risks on management's behalf.
3. Risk assessment
Assess the information security risks within your scope. Set a consistent method for identifying risks, evaluating their significance and deciding what treatment is needed.
Make each risk specific enough to act on. State what information or service is affected, what could happen and what the consequences would be.
Your records should connect:
- The identified risk and its owner.
- The assessment criteria and evaluation.
- The treatment decision and required actions.
- The controls selected to address the risk.
- Approval of the treatment plan and acceptance of residual risk.
Avoid copying a generic register without checking it against your business. An auditor needs to understand your decisions, not the template author's assumptions.
4. Controls
Choose controls that address your risks and applicable obligations. Compare your selection against Annex A to check that you have not overlooked necessary controls.
Your Statement of Applicability records the necessary controls, why you included them and whether they are implemented. It also explains exclusions from Annex A.
For your 2026 programme, do not treat the 93 reference controls as an instruction to implement every control identically. The selection must follow your assessment and other requirements, with justified exclusions.
Write policies around actual working practices. If a policy says access is reviewed, identify who reviews it, what they check and where the result is recorded.
5. Evidence
Keep records that show your management system operates. Evidence should demonstrate completed activity, not just an intention to do it later.
Depending on your selected controls and processes, relevant records include access reviews, training records, supplier assessments, incident handling and corrective actions. Connect each record to the activity or requirement it supports.
Check evidence quality before collecting more:
- Does the record cover the relevant scope?
- Does it identify what happened and when?
- Does it show the outcome, including unresolved issues?
- Can the responsible person explain it?
A screenshot proves only what it shows. It does not automatically prove that a recurring process operates consistently.
6. Internal audit
Audit your management system before relying on the certification assessment to find gaps. Plan the internal audit around the requirements, your processes and the importance of the activities being audited.
Select auditors and conduct the audit to preserve objectivity and impartiality. Having someone approve their own work without independent challenge does not meet that aim.
Record findings, investigate nonconformities and take corrective action. Check whether the action addressed the cause rather than merely changing the document an auditor questioned.
Management review is a separate requirement. Management must review the system's performance and suitability, make decisions and retain evidence of the results.
7. Certification
Engage an independent certification body to assess your management system. If your customers require accredited certification, check the body's accreditation and relevant scope before appointing it.
Initial certification follows 2 audit stages. Stage 1 reviews readiness and relevant management-system information; Stage 2 evaluates implementation and effectiveness.
Agree the scope and audit arrangements with the certification body. Make sure process owners can explain their work and locate supporting records.
Address any nonconformities through the certification body's process. Completing preparation or passing a software check does not itself award certification.
Internal ownership connects risk decisions, working controls and the independent certification assessment.
Why the need for consultant support varies
The right level of support depends on your team's capability and the work inside scope. Assess the gaps before choosing a full implementation engagement.
- Internal competence: Your team must understand the requirements and apply them to your organisation. Training or focused advice addresses a specific knowledge gap.
- Available capacity: Someone must maintain records, coordinate actions and obtain approvals alongside normal business work.
- Scope and dependencies: More services, locations and supplier relationships create more information to assess and explain.
- Existing processes: Established access management, incident handling and supplier reviews provide a starting point. Undocumented or inconsistent processes need attention.
- Audit objectivity: Your internal audit arrangements must preserve impartiality. External audit support is an option when internal arrangements cannot do that.
Use these factors to write a precise brief for any outside help. Ask for a defined outcome, such as reviewing your risk method, rather than handing over an undefined responsibility to get you certified.
Where compliance automation fits
OneClickComply is best for growing businesses that want ISO 27001 compliance automation while retaining internal ownership. The platform supports certification preparation and maintenance through security control auto-remediation, policy generation and risk management.
You can use OneClickComply to support those tasks instead of treating every compliance activity as a separate manual exercise. Its role is to help operate the programme, not to replace the independent certification assessment.
The limitation matters: generated policies still need review against your practices. Your team must approve risk decisions, check the effect of control changes and explain how the management system works.
For a 2026 implementation, separate tasks you want to automate from decisions that need an accountable person. That distinction gives you a clearer software brief and a clearer implementation plan.
Can your team conduct its own internal audit?
Yes. ISO 27001 allows an internal audit conducted by your own organisation when auditor selection and audit conduct preserve objectivity and impartiality. Competence is also necessary.
Use someone who can challenge the process without simply validating their own work. If your team cannot arrange that, buy a focused internal audit service rather than assuming you need a consultant for the entire programme.
Can software replace the certification auditor?
No. Compliance software does not replace the independent certification body. Software supports preparation and ongoing management; the certification body evaluates conformity and makes the certification decision.
Keep that distinction explicit in your 2026 plan. A completed dashboard is useful operational information, not a certificate.
How do you know you are ready for certification?
You are ready to seek assessment when your management system is implemented and you can demonstrate how it operates. Check that the scope, risks, controls and evidence tell a consistent story.
Complete your internal audit and management review, and address identified issues. Ask process owners to explain a real example of their work before scheduling around a customer deadline.
Frequently asked questions
One last thing
Test your independence before you test your readiness. Ask a process owner to explain a risk, show the related control and find evidence that it works—without relying on the person who wrote the policy.
If your team can do that, the knowledge sits inside your business. That is the aim of a consultant-free programme: not doing everything manually, but keeping ownership clear.
Seriously Simple Cyber Compliance.