I’ve had an experience where an ISO 27001 consultant promised to streamline our information security management system within three months, However after six months we were still facing significant gaps and missed deadlines. This has made me cautious about hiring new consultants.

What are some strategies or best practices to ensure that consultants stay true to their commitments and deliver the promised results? Are there specific red flags to watch out for during the selection process?

Any insights or experiences would be greatly appreciated!