Can a consultant take responsibility for the ISMS?

Which tasks and authorities can be delegated depends on your organisation and agreement. Internal decisions, resource approvals and risk acceptance must remain explicitly assigned.

How do I recognise a successful handover?

The internal team can handle a new case independently, find authoritative records and obtain necessary decisions. A delivered folder alone does not demonstrate that.

ISMS with an external consultant: Agree on collaboration and handover

An external consultant can bring structure, experience and additional capacity to your ISMS. For the organisation to continue afterwards, it needs more than a finished document folder: internal owners, traceable decisions and a practised operational workflow.

Agree on handover at the start. This guide helps separate consulting support from ongoing responsibility.

Do we need a consultant alongside Kopexa?

Not necessarily. If you have the expertise and capacity internally, you can organise your ISMS yourselves using Kopexa. If you need support with methodology, initial setup or specific requirements, a consulting partner can complement your team. The deciding factor is the particular gap in your team, rather than simply whether you buy software.

Kopexa provides a shared working basis: requirements, measures, evidence and document reviews remain available in the system you continue to use. You can use external support selectively and take ongoing operation in-house. An external audit must be planned separately.

Clarify who prepares and who decides

A consultant can facilitate risk discussions, identify gaps and propose measures. Your defined decision-making process must make clear who approves resources or accepts a residual risk.

NIST CSF 2.0 treats established responsibilities and coordination with suppliers and partners as part of security governance. It does not prescribe a particular consulting model, but provides a useful reason to agree explicitly on collaboration. NIST CSF 2.0, GV.RR and GV.SC

Work	Consultant’s contribution	Internal responsibility
Assess a risk	Explain the method and challenge assumptions	Assess business impact
Develop a policy	Provide a draft and expert input	Review and approve the content
Plan a measure	Suggest an approach and evidence	Commit to implementation, capacity and deadline
Treat residual risk	Explain options and consequences	Decide within defined authority

Name people and deputies, rather than departments alone. Our article on responsibility during GRC implementation helps with this allocation.

Work from one shared, controlled basis

Avoid competing versions of the truth in the consultant’s storage, email and internal spreadsheets. Agree where the authoritative state is kept, how comments are handled and when a version counts as approved.

Limit external access to what is needed. Record its start, end, contact person and revocation. Where personal or particularly confidential information is involved, establish the agreements and safeguards required by the actual collaboration.

A document version needs a traceable approval path. Introducing a new policy version therefore goes beyond uploading a draft.

Agree on deliverables someone can take over

“ISMS finished” leaves too much open. Define a verifiable result for each package: a reasoned risk assessment, approved policies, assigned measures or a decision brief for management.

Handover also includes unanswered questions, known limitations and outstanding decisions. An empty task list is no success if unresolved points were simply removed from the project.

Fictional case: A consultant prepares the risk register. During a joint walkthrough, an internal process owner explains an outage assessment themselves, names the underlying assumptions and shows the planned measure. Nobody can do this for another risk. That risk remains an open handover item, rather than disappearing behind a signed completion record.

Test handover using a change

Before the project ends, choose a manageable real case: a new supplier, a changed policy or an overdue measure. The internal team handles it; the consultant observes and helps only when needed.

Check:

Can the team find the current state and associated evidence?
Can it explain the decision and involve the right person?
Is the change reflected wherever it matters?
Is the next review trigger clear?

A risk review provides a suitable workflow. Passing a practical test shows more than confirming that every document has been presented once.

How Kopexa supports collaboration

In Kopexa, measures can be brought together with their evidence and mapped controls. Document versions pass through an approval process, and a review interval can be set for documents. This keeps the subject-matter work traceable at the relevant item.

Software replaces neither internal decision-makers nor the quality of consulting. It helps keep the results usable in ongoing ISMS work.

Plan the final joint meeting as an operational handover: review open measures, upcoming reviews, owners, access and required records. Document who takes over operations and what support remains agreed.