The ISO 27001 RFP & quote comparison worksheet

What to put in your brief, how to normalize CB quotes, and the engagement-letter red flags that cost companies real money.

Your RFP brief (one page is enough)

1. Company facts: industry, total and in-scope headcount, sites and countries.
2. ISMS scope: which systems, teams, and data are in scope — and what's excluded.
3. Current state: existing policies, prior audits, tooling, internal security staff.
4. Schemes: ISO 27001 only, or plus ISO 27701 / SOC 2.
5. Timeline: target certification date and any deal-driven deadlines.
6. Ask for: Stage 1 days, Stage 2 days, day rate, travel, surveillance pricing (years 2–3), recertification pricing, named audit team, and accreditation details.

Quote comparison worksheet

Normalize every quote to the same columns before comparing totals:

Engagement-letter red flags

• No audit-day breakdown. A lump sum with no days, no headcount band, no sites is a change order waiting to happen.
• Surveillance pricing left "to be determined." Years 2–3 are where the margin hides. Get them in writing now.
• Change-order triggers undefined. "Scope changes" should be defined — headcount growth thresholds, added sites, added schemes.
• No named audit team. "A qualified lead auditor" is not a name. Get names and CVs.
• Consulting bundled in. The CB that finds gaps shouldn't bill to fix them — independence is an accreditation requirement.
• Certificate-issuance fees hidden. Ask whether the certificate itself, IAF CertSearch registration, and the mark license cost extra.