Comparison
Consultant, Excel or Isodora?
In short
When a customer requires ISO 27001, a company with 10–100 employees has three routes. Consultant: fastest to start, SEK 80,000–300,000, but the knowledge leaves with the consultant and maintenance becomes a new engagement every year. Excel and Word: free in licence, 400–800 hours of own time, the highest risk of failing stage 2 and almost impossible to keep alive. Isodora: SEK 20,400 a year, the standard text from SIS, gap analysis, documents and automated evidence, 120–250 hours of own time — and the management system lives on after the certificate.
Last reviewed: September 2026
Comparison at a glance
| Option | Cost, time and risk |
|---|---|
| Consultant | SEK 80,000–300,000 per public price guides. 100–200 hours of own time. Fast start, high document quality. Risk: documents written for the auditor rather than for you, knowledge that leaves, annual maintenance as a new invoice. |
| Excel and Word | SEK 0 in licence. 400–800 hours of own time. Full control. Risk: no link between requirement, control and evidence, version chaos, and the stage 2 audit reveals the system is not used in practice. |
| Isodora | SEK 20,400 a year. 120–250 hours of own time. Standard text from SIS, gap analysis, generated documents, automated controls and time-stamped evidence. Risk: you still have to own the decisions and set aside time; the tool removes work, not responsibility. |
What happens after the certificate
The difference between the options is largest in year two. A consultant-built management system needs the consultant again before every surveillance audit. An Excel system decays quietly until the auditor finds a policy nobody has read in 14 months. A management system in Isodora keeps running controls, reminding owners and collecting evidence, so the surveillance audit becomes a report instead of a project.
Combinations that work
- Isodora plus a few hours of consultant review before stage 1: common among companies that want a second look at the risk assessment.
- A consultant for the internal audit itself, the rest in Isodora: the standard requires independence in the internal audit, and it is a bounded engagement.
- Excel as the starting point: import what you already have into Isodora instead of rewriting.
What you get with Isodora
The consultant’s structure and knowledge built into a tool you own, at a price that needs no procurement.
Nine AI experts instead of one consultant
Specialised agents build documentation against the right framework and answer questions about controls and gaps.
Documents you understand
Generated against the requirement text, in your language, from your business as the starting point.
Evidence without screenshots
Automated controls against your systems time-stamp evidence continuously.
The company brain remembers
Every requirement, control, decision and deviation remains when people change roles.
Consultant prices are ranges from public Swedish price guides in September 2026. Certification is issued by an accredited body after its own audit, whichever option you choose.
Frequently asked questions
- Do you need a consultant for ISO 27001?
- No. The standard requires a working management system and an independent internal audit, not a consultant. Many companies with 10–100 employees run the project themselves with a platform and buy a few hours of review when needed.
- Can you do ISO 27001 in Excel?
- Yes, it is possible, and many have. It costs 400–800 hours of own time, and the most common reason for failing stage 2 is that the system exists on paper but is not used. The challenge is not getting certified but staying certified.
- How much does an ISO 27001 consultant cost?
- Public Swedish price guides quote SEK 80,000–300,000 for implementation support, with hourly rates of SEK 1,200–2,000. Fully outsourced projects can cost more. The certification body’s audit is always extra.