I'll pitch in here regarding ISO/IEC 27001 as I know something about it. I'm familiar with COBIT also but generally ignore it in my line of work so won't say much about it here and will leave that to someone who knows a lot more about it:-
ISO/IEC 27001 can be a major commitment but it depends on many factors. It basically requires top management support for an information security management system (ISMS) throughout the organization - so it can be a major undertaking if you are a large organization or geographically dispersed, for example. Its all about a management framework and processes and how you go about implementing it will depend on what exactly you are trying to achieve. In an nutshell its a business risk management standard focused on the preservation of the confidentiality, integrity, and availability of business information.
If there is no-one in the company currently who understand this standard or 'management systems' in general then I would highly suggest getting in some help, or at the very least going on a training course.
Probably the best training courses that I am aware of are the ones offered by BSI. They offer various courses, but I would suggest that you first attend a 1 day "Introduction" and follow up with the "Implementation" or "Lead Implementer" courses. The implementer courses will take you through the major steps of a typical project.
There is also the PECB certifications, but in my opinion, these courses are mostly slide shows (theory - snore) with a little bit of interaction, whereas the BSI courses are very interactive and practical. Full disclosure -- I have delivered training for both PECB and BSI.
If you are hiring in a consultant, then look for these qualifications along with the ISO/IEC 27001 Lead Auditor qualification. Also look at the consultant's CV. This is not an IT or technical standard and consultants who only look at things from this perspective often don't 'get it'. Look for some broad experience in other areas of security, like physical security, and experience in general with 'management systems', 'risk management' and business related disciplines.
Things to bare in mind: 27001 is not a technical standard and it is normally a bad thing if you try to do it just in an IT environment alone (ISO/IEC 20000-1 would be appropriate if that is the intention). Registration/certification itself is for the organization and will incur ongoing audit costs (audits are conducted by external 3rd party audit bodies).
Note also that the 2005 version of the standard is now obsoleted and the new version is 2013. This is the version that you would need to implement and certify against (if certification/registration is required).
My first suggestion, and the cheapest, is that you buy the standard from ISO.org, download, and read the standard. You want to have a look at clauses 4 through 10, which provides all requirements that you must meet.
COBIT and ISO/IEC 27001 will live together in perfect harmony. There is no contradiction and you will have benefits in many ways by implementing both - if done properly. ISO/IEC 27001 will give you a big umbrella, COBIT will give you some IT related specifics that will fall under that umbrella.