INFORMATION SECURITY, GUIDED
£7,000 + VAT, fixed. Single entity, roughly fifty people or fewer in scope, and a named internal owner. Goldline builds the management system and directs the work. Your team executes it. The same standard as a full Sprint, because you are doing the half that does not need a practitioner.
You have a customer asking for ISO 27001 and an engineering team with capacity. You do not need somebody to collect your evidence and you are not going to pay senior practitioner rates for somebody to do it. What you need is the part you cannot get from a template: a scope boundary your buyers will actually accept, a Statement of Applicability that survives an auditor, a risk methodology that is yours rather than a sample, and somebody who tells you when what you have built will not pass.
If nobody internally owns this, Guided will fail and it will cost you more than the Sprint would have. The programme runs on your team's hours. Before it starts we agree who owns it and how many hours they genuinely have, and if the answer is nobody we will say so and recommend the Sprint instead.
A named internal owner, and 40 to 60 hours of your team's time across the engagement. Leadership available to approve policies and sit the management review. Access to the people who actually operate the controls.
Single legal entity. One site or cloud hosted. Under approximately 50 people. One product or service in scope. Above any of those, the engagement is a Sprint and is priced accordingly.
Drata, Vanta, Sprinto and the rest automate evidence collection well. They do not define your scope, run your risk assessment, write your Statement of Applicability or sit in front of an auditor. On a single entity under fifty people, a maintained spreadsheet meets the standard, and adding a platform subscription to a £7,000 engagement can double what you spend in year one.
Goldline is a partner across Drata, Thoropass and Sprinto and will deliver on any of them if you already run one or want one. It is not a condition of this engagement and we will tell you plainly when it is not worth the money.
WHO OWNS WHAT
Guided runs on the Plan, Do, Check, Act cycle, delivered against a PECB Lead Implementer methodology. Goldline sets the direction and holds the standard. Your team does the build. The bar on each phase shows how the effort actually splits, and the accountable owner never moves. Phases are sequenced, not timed: a small single-entity scope can move through them considerably faster than twelve weeks.
SCROLL RIGHT TO FOLLOW THE PHASES →
WHAT GETS PRODUCED
ACCOUNTABLE
Your top management. Scope and risk appetite are decisions only you can take.
WHAT GETS PRODUCED
ACCOUNTABLE
Your named ISMS owner. This is the phase that sets the pace of the whole engagement.
WHAT GETS PRODUCED
Not Goldline. Clause 9.2 requires the internal audit to be independent of the work being audited. Goldline directed this build, so Goldline does not audit it. We hold a network of independent, credentialled auditors and will introduce one, or brief a competent person inside your own organisation to do it properly.
WHAT GETS PRODUCED
ACCOUNTABLE
Your named ISMS owner. At handover the system is yours to run, and the operating calendar tells you how.
NEITHER OF US
The certificate is issued by an accredited certification body, not by Goldline, and the audit is booked into their calendar. Their fee is paid to them direct and is separate from the £7,000, and carries no Goldline margin. Goldline is not a certification body and does not issue certificates, and will not sell implementation and certification to the same organisation for the same scope.
Guided is priced flat at £7,000 because the labour sits with you. If Goldline did the Do phase as well, that is a Sprint and it prices from £14,000. The qualifying test is a single entity, roughly fifty people or fewer inside the scope, and a named internal owner with the time to do the Do phase. Without that owner the split above does not hold, and the honest answer is a Sprint rather than a cheaper number. Pace is set by how fast your team can move through Phase 02, which is why the phases carry no fixed dates.
Delivered against the Plan, Do, Check, Act cycle by a PECB certified ISO/IEC 27001 Senior Lead Implementer. Every deliverable is keyed to a clause of ISO/IEC 27001:2022 or an Annex A control. Effort splits are typical for a Guided engagement and are confirmed at scoping.
£7,000 + VAT, fixed, whatever your headcount inside the eligibility above. Single entity, roughly fifty people or fewer in scope, and a named internal owner. The ISO 27001 Readiness Assessment, from £1,950 + VAT, credits in full against this. This engagement credits in full against a subsequent Sprint if you decide part way through that you want it delivered rather than directed.
THE CHOICE
| A consultant | A platform on its own | Goldline | |
|---|---|---|---|
| Who does the work | Someone senior, billed by the day | Your team, guided by the software | The practitioner who scoped it, on a fixed scope |
| What you get | Advice, and documents you then implement | Evidence collection and continuous control monitoring | The management system, and the evidence to prove it operates |
| Scope and Statement of Applicability | Usually included | Not produced. It records decisions only you can take | Written and defended at audit |
| Clause 9.2 internal audit | Only if independent of the build | Not performed. Software cannot audit itself | Delivered independently, or an independent auditor introduced |
| Your team's time | Meetings, then the work lands with you | Substantial. The platform tracks tasks, it does not do them | A few hours a week during delivery |
| In the room at Stage 2 | Depends on the engagement | No | Yes |
| Commercial shape | Day rate, open ended | Annual licence | Fixed scope, fixed fee, agreed before work starts |
Certification body audit fees are billed separately and pass through at cost.
TWO ROUTES
| ISO 27001 Guided | ISO 27001 Sprint | |
|---|---|---|
| Who does the implementation | Your team, with direction | Goldline |
| What you need to have | Engineers, and a named internal owner with time | A decision maker and access |
| Your team's time each week | Several hours | A few hours |
| Scope and Statement of Applicability | Drafted with you | Written for you |
| Policy framework | Templates plus review | Written for your operating environment |
| Internal audit | Independent auditor introduced | Independent auditor introduced |
| Stage 2 attendance | Available | Included |
| Best for | A team that has the people and wants the method | A team whose people are building the product |
When to choose ISO 27001 Guided: you have engineers and a named internal owner with the time, and you want to come out of it understanding the management system well enough to run it yourselves.
When to choose the ISO 27001 Sprint: your team is building the product and cannot carve the time out, and you would rather the work sat with the practitioner.
Both routes deliver the same management system. The difference is who does the work and how much of your week it costs.
We use cookies and similar technologies to measure how this site is used, to see which organisations visit, and to measure our advertising. If you accept, we load Plausible, Google Analytics and Google Ads, Microsoft Clarity, which records session replays, and Apollo. Nothing loads until you accept. Read our Cookies policy.