Short answer
Part of ISO 27001 you can set up yourself: describing your processes, assessing risks and implementing measures. But you cannot issue the certificate yourself. That is done by an independent, accredited certification body that assesses your organization against the standard. Doing it yourself and outsourcing are therefore not two separate choices, but two steps in the same process.
Whether you need a consulting firm mainly depends on how much time, knowledge and internal capacity you have yourself. For a small business with a straightforward IT environment, setting up the system is often perfectly doable on your own. For an organization with multiple locations, suppliers and systems, that process usually takes so many hours that guidance shortens the process.
What exactly is ISO 27001
ISO 27001 is an international standard for information security. The standard does not describe technical products, but a system of agreements: how you assess risks, what measures you put in place to counter them, and how you maintain that system. This whole thing is called the ISMS, the information security management system. A certificate demonstrates that an independent party has assessed this system, not that nothing can ever go wrong.
What you can do yourself
Setting up the ISMS yourself is in principle not work that is reserved by law to an external party. You can: create an overview of what information and systems you protect, carry out a risk analysis, draw up policies and procedures, implement measures such as access control and backups, and conduct an internal audit to check whether everything is actually happening as written. Many companies do this with a dedicated employee who takes on the role of information security officer, supplemented by a template or action plan.
The challenge is less the content than the completeness. The standard calls for a large number of mutually related components, and a certification body specifically checks whether nothing is missing. Those doing this for the first time often underestimate how much documentation and evidence is needed to demonstrate that a measure not only exists, but is also actually implemented.
What you cannot do yourself: the certification body
The certificate itself comes from a certification body that is accredited to assess against the ISO 27001 standard. This body conducts an external audit, usually in two phases: first an assessment of the documentation, then an assessment in practice. You cannot carry out this step internally, even with a very experienced employee: the independence of the assessor is part of what makes the certificate valuable. You do choose which accredited body you engage.
What a consulting firm adds
A consulting firm does not replace the certification body, but helps with the step before: setting up and putting the ISMS in order so that the external audit has a better chance of success. This can involve structuring existing documentation, training employees, or guiding the internal audit. For companies without their own IT or compliance department, this mainly saves time: someone who already knows the standard does not need to figure out each component from scratch.
Whether that time saving justifies the cost of a consulting firm varies by organization. A company with one location and a straightforward application landscape has a shorter path than a company with multiple locations and many external parties in the chain.
Is ISO 27001 always necessary, or is there an alternative
Not every customer who asks for demonstrable information security requires an ISO 27001 certificate as such. Some clients accept a self-evaluation, a questionnaire, or a statement about the key measures, especially if your company is small or has limited access to sensitive customer data. It is therefore wise to first check what your customer is asking for exactly, before you embark on a certification process. the explanation per topic in the knowledge base shows which concepts often underlie such a question and how they relate to each other.
Supplia.eu does not certify or assess anything and therefore cannot determine whether your organization meets the standard. What we do is recognize your customer's questionnaire and fill in the answers from one supply chain file, so you don't have to explain from scratch each time which measures you have already taken. With a few questions you can see approximately where your situation standswithout this saying anything about a certification process itself.
What you can do now
Start by finding out whether your customer requires a certificate or is satisfied with a substantiated answer to the questionnaire. Then look at how much of the ISMS you already have informally in place: risk management, access control, backups and incident handling are often already partly set up, even without anyone having called it that. Only once you know what is still missing does it make sense to determine whether you tackle that yourself or bring in a consulting firm for the step towards the certification body.
On the page about how the information on supplia.eu is created you can read where our explanation comes from, so you can consult it alongside the official standard. If you are still unsure whether your situation requires a certificate, take the free quick-scan or view frequently asked questions about questionnaires and evidence for a first direction.