How to choose an ISO 27001 consultant in Mexico?

When choosing an ISO 27001 consultant in Mexico, evaluate five objective criteria: the consultant's real certification (Lead Auditor, not just a "specialist"), whether you work directly with the person who executes or with a junior team, whether the scope covers only compliance or also related areas like cloud costs and customer retention, price transparency before signing, and whether support continues after certification or ends there.

What certification should an ISO 27001 consultant really have?

Look specifically for the "Lead Auditor" title certified in ISO/IEC 27001:2022 — it's different from an introductory course or a "specialist" certification. The Lead Auditor is specifically trained in how a real audit is executed, not just the theory of the standard. Ask directly: "Do you have a current Lead Auditor certification, and in what year did you get it?"

Is a large consultancy (with platform and team) better, or an independent consultant?

It depends on your size and need, but there's a real difference worth understanding. A platform or firm with a team offers more simultaneous capacity, evidence-automation tools, and additional services (like SOC monitoring or pentesting), but the day-to-day work is usually executed by a junior consultant, not the senior expert you spoke with during the sale. An independent or boutique consultant lets you work directly with the person who holds the certification and executes the project, with greater customization, but less capacity to handle several large projects in parallel.

For startups and companies in the Diagnosis or first-implementation stage, the boutique model usually offers a better attention-to-investment ratio — for large organizations that need 24/7 operational security monitoring, a platform with more infrastructure can be justified.

Should the consultant cover only ISO 27001, or also related topics?

This depends on how isolated your problem is. In practice, companies that need ISO 27001 almost always have, at the same time, two additional problems that are rarely addressed together: uncontrolled cloud spend (FinOps) and a lack of visibility into the health of their key accounts (Customer Success). A consultant covering all three fronts prevents you from hiring three providers that don't coordinate with each other — but it only makes sense if you truly need all three; if your only problem is compliance, a pure specialist is also a valid option.

What should price transparency look like before hiring?

A serious consultant should be able to explain, before quoting the full project, a clear breakdown: the cost of diagnosis, the cost of implementation, and whether the certification body's audit is included or quoted separately (almost always separate, and that's normal). Be wary of any quote that doesn't separate these three components.

Should support end at certification?

It shouldn't. An ISMS that gets certified and is then abandoned documentally fails at the next surveillance audit (most certifications require annual follow-up audits). Explicitly ask whether the consultant offers any post-certification maintenance or periodic verification scheme, and at what cost.

Summary — a 5-question checklist before hiring:

1. Do you have a current ISO 27001:2022 Lead Auditor certification?

2. Will I work directly with you, or with a junior team under your supervision?

3. Do you cover only compliance, or also cloud costs and account health if I need them?

4. Can you break down the price into diagnosis, implementation, and external audit separately?

5. What happens after certification — is there any ongoing support available?