Lesson 10 of 10 · Track C · · Updated
Expert-led, partner-led or self-serve: who does the ISMS work
ISO 27001 platforms differ most in who does the work with you. Scytale describes a dedicated compliance expert with weekly meetings. Vanta and Drata describe partner networks. Sprinto describes support channels on its entry plan, and Scrut describes AI agents for ISMS tasks. The right model depends on whether you have someone in-house who can own the ISMS.
What does the expert-led model look like?
One named person on the vendor side works with your team through readiness and the audit. Scytale says its dedicated compliance expert manages the entire audit-readiness process, holds weekly meetings, and takes over full management of the audit process with your chosen auditor. Its Build DFY bundle lists LaunchReady Consulting and a pen test alongside the platform. This suits teams without a security or compliance lead, and first certifications with a deadline.
What does the partner-led model look like?
The platform vendor provides software and connects you with outside specialists for services. Vanta's Essentials plan includes access to expert partners, and it lists vCISOs, MSPs and MSSPs as service providers; its Essential Eight page also mentions a dedicated Customer Success team. Drata states 1300+ partners, with vCISO partners providing security leadership. This gives choice and often local expertise, and it means one more contract to manage.
What does the support-and-agents model look like?
The vendor provides software, support and AI features, and your team does the ISMS work. Sprinto's Foundation plan lists 24x5 email and in-app support. Scrut describes AI agents called Scrut Teammates, including a Policy Architect, Risk Analyst and Internal Auditor. Secureframe describes automation backed by experts without detailing the service model on the pages we reviewed. This suits teams that already have a capable owner.
How do you choose?
Ask three questions. Is there someone in-house with the time to own the ISMS, run internal audit and prepare management review? How firm is the certification deadline? And will the program grow into more frameworks next year? If the first answer is no and the deadline is firm, an expert-led model is the lower-risk option. If you have an owner, partner-led or self-serve can cost less. Our expert guidance criterion scores what each vendor describes, and the cost estimator shows which plans list consulting.
What should the contract say?
Whatever the model, get the scope of help in writing: who drafts the risk assessment, who writes policies, who attends the audit, and what happens after certification. The ISMS stays yours either way, and the certificate names your organisation, not the vendor.
Can you change models later?
Yes, and many companies do. A common path is expert-led help for the first certification, then a smaller service scope once an internal owner has run one audit cycle. Moving is easier if your policies, risk register and evidence can be exported, so ask about export formats before you sign, whichever model you start with.