Major enterprise client asked for ISO 27001 certification, can we handle it ourselves without hiring a consultant?

We're an 18-person team in Jeddah, we got certified last year. We paid 38,000 SAR for consulting and 18,000 SAR to the accredited audit firm. The whole process took exactly 5.5 months. If we had tried doing it on our own, our DevOps engineer would've had to stop all dev work for at least 3 months, which would've cost us way more in the end.

Don't dump this entire burden on your DevOps engineer. ISO 27001 isn't just about firewalls and encryption; HR hiring processes, physical office security, vendor contracts, and asset management make up more than half the standard. An engineer can write the technical controls, but they'll hit a brick wall when it comes to process management.

Be very careful when hiring a consultant. Most of them just copy-paste generic Word templates floating around the market into your company and pocket 40,000 SAR. When the auditor walks in and asks "Who executes this procedure?" your staff won't even know what they're talking about. Look for someone who will actually sit down and design the processes with you not just sell off-the-shelf templates.

we initially thought we'd try it ourselves with templates we found online, but after 2 months we were totally drowning in paperwork. once the external auditor pointed out all the gaps right in our faces during stage 1, we had no choice but to hire a consultant. if you have a hard 6-month deadline, imo don't push your luck.

Since your client is a semi-governmental entity in Saudi Arabia, did they ask solely for ISO 27001, or are they also expecting NCA ECC (Essential Cybersecurity Controls) compliance? Read the RFP carefully; government tenders often include NCA requirements that are far stricter than the ISO standard, and you need to ask the consultant about this right from the start.

An important regulatory reminder: Having the consulting firm and the auditing body be the same entity or sister companies violates accreditation standards. When collecting proposals, make sure to verify the validity of the independent certification body's accreditation (such as IAS, UKAS, or SASO-aligned).

The first thing you should do is narrow the scope. Don't scope out the entire company's operations; focus only on the infrastructure of the software you deliver to the client and the dev team behind it. The smaller the scope, the fewer assets there are to audit, which speeds up the timeline and cuts consulting costs.

You're right. If you get three different answers on a topic, the question was asked wrong.

If you post the result here, it will help others too.

I've been dealing with this for a long time. When we decide without measuring, we always end up in the same place.

If you have questions, write them; I'll answer as best I can.

weve heard this a lot but it never happened like that for us. anyway dont hesitate to ask; those who dont ask always pay more.

this is my opinion Im not claaiming its absolute truth.

Here's how it went for us. Security isn't absolute; it's about making attacks not worth the effort.

I'm also curious if anyone does it differently.

Let me share what happened to me; it might be useful. Processes without records never improve, because you don't know what to fix.

Of course, it varies if your situation is different.

We need to make a distinction here. If you scold false alarms, nobody will report again.

I'm also curious if anyone does it differently.

We need to make a distinction here. If 2FA is on, a stolen password alone is useless.

Proven by experience.

You're right, I've been down that road too. Most incidents start with a leaked password, not a vulnerability.

If I were you, I'd go this route.

There's a common mistake people make when doing this. An automated scan report is not the same as a penetration test.

Correct me if I'm wrong.

I have a question. Most incidents start with a leaked password, not a vulnerability.

Solutions that work at a small scale collapse when you grow; I learned this late. Correct me if I'm wrong.

Could you elaborate on that? Having backups accessible on the same network and with the same identity makes them part of the target.

Just leaving this note, it might be useful.