Sted vs a consultant or DIY templates

Hire a consultant when you need judgement, accountability and someone in the audit room, and can fund year one. Buy a template toolkit when you have the time and someone who knows the standard. Choose Sted when you want applicability decided, documents drafted and the system run after the certificate, at a published price.

Who each is for

A consultant suits a founder who needs ISO 27001 for a customer deadline and wants someone accountable for scope and risk. Some UK consultancies publish fixed fees by company size; Precursor Security’s cover gap analysis, risk assessment, documentation and support through the Stage 1 and Stage 2 audits². After the certificate, the surveillance audits, reviews, training and records are yours unless you buy more time.

A toolkit suits a team with time and someone who knows the standard. You buy a one-off licence for Word and Excel templates and tailor them yourself⁶, then run reviews, training and records in documents and spreadsheets.

Sted suits a small team that wants the decisions and first drafts made in the product and the system kept running after the audit. It recommends what applies, drafts your documents, and tracks owners, review dates, training and records.

Where a consultant or a template pack is stronger

• Judgement on scope and risk. A consultant runs the gap analysis, designs the management system and carries out the risk assessment with you, for a fixed fee set by company size².
• Accountability in the audit room. Precursor Security’s fixed fee covers liaison with the certification body through Stage 1 and Stage 2 and attendance at Stage 2².
• A programme that runs the audit cycle with you. The iSEO Blue consultant’s 90-day programme includes five one-to-one sessions, a risk-based internal audit, a workshop on running the management review and free remediation if you do not pass³.
• Speed through the programme. The iSEO Blue consultant says most clients finish its programme in 8 to 12 weeks³.
• A one-off price for a full template set. The GRC Solutions template toolkit is one licence for one organisation, with about 100 Word and Excel items covering clauses 4 to 10, the 2022 controls, a gap analysis tool and a Statement of Applicability⁶.
• Expert review with templates. Advisera’s template toolkit of 45 documents adds expert review of a completed document and live one-to-one consultations⁷.

Where Sted is stronger

• Changes at no extra cost. Adding GDPR or ISO 9001 later, a new product or a change to your profile costs nothing extra: on a paid plan you add as many standards and regulations as you like and regenerate, because plans meter seats and features, never standards.
• A knowledge base Sted maintains. Sted maintains the standards, regulations and best practice in its knowledge base. When its recommendations for a document you have worked on change, Sted keeps your version, prepares an updated draft beside it at no extra cost and raises a review task for the owner, who accepts or declines each change.
• Breadth across eight assurance areas. Sted’s catalogue holds 85 standards, regulations and schemes: information security, privacy, AI governance, medical devices, payments and financial services, NHS digital health, quality and environmental, and sustainability reporting.
• Applicability decided and explained. Sted recommends the standards that apply to you or would help, including ones you had not asked about, with its reasons; its rules decide, not the AI model.
• Drafts that fit together, not blank templates. From Sted’s knowledge base of 64 policies and procedures and 168 record templates, Sted drafts one framework for every standard you choose, adapted to your organisation, and each requirement names the standards it helps you meet.
• Control after approval. A draft cannot be approved until every updated recommendation is decided. Approving sets a review date, a review task opens 30 days before it, and superseded versions stay in History.
• Evidence and readiness that keep running. Training is completed against each approved version, and records follow templates and can repeat, with a task raised when one falls due; records are part of the Full Management System plan. Administrators see audit readiness per adopted standard.
• A price you can pay today. You choose a plan at its published price and pay through Stripe Checkout.

Side by side

Sted beside the two non-software routes. The consultant column draws on consultancies that publish fixed fees, and the toolkit column on publishers that list their prices; each cell is dated and numbered to its page.

Pricing as published

Sted publishes the monthly and annual price of every plan, excluding VAT¹.

Precursor Security² and iSEO Blue³ publish fixed consultancy fees, and the median UK contract day rate for ISO 27001 roles, from ITJobsWatch, is in the table⁵. GRC Solutions⁶ and Advisera⁷ publish toolkit prices.

Every route leaves the certification body’s fees and surveillance audits on top². Most organisations that use personal information also pay the ICO’s data protection fee¹¹, which the Data Protection (Charges and Information) Regulations 2018 set by size at £52, £78 or £3,763, each £5 less by direct debit¹³, and Cyber Essentials has its own fee, banded by organisation size¹².

Using them together or switching

You can use both, with the jobs split. The consultant brings the judgement: scope, risk decisions, the internal audit and the audit day. The product holds the documents, owners, review dates, training and records between audits. An administrator can invite your consultant by email to join your organisation, where they take one of your plan’s user places.

Moving from a toolkit means bringing the policies you have already approved. Sted drafts its documents from the knowledge base, and you review each draft against your approved version before approving it. Administrators enter the risks from your toolkit’s spreadsheet in the risks and opportunities register, which they keep.

Read the ISO 27001 hub, the Cyber Essentials hub and the GDPR hub for the requirements, and the internal audit guide and management review guide for the work a consultant often leads. How Sted generates your framework shows what the drafts start from, and the compliance automation platforms comparison covers the software alternatives, with Sted vs Qualio for medical devices.

Frequently asked questions