ISO 27001 is not something that a startup should be thinking about for years. Then an email arrives from an enterprise client who is promising: “Please provide your ISO 27001 certification as part of our vendor security audit.”
The issue of certification has been resolved and will be debated next year. It has to do with a contract the company is trying to close.
ISO 27001 is a good start for many small-scale businesses. It’s difficult to figure out the steps to take without turning an easily managed project into an invasive compliance programme for large corporations.
Week One is about Scope, not Shopping
The first reaction could be to begin comparing compliance systems and consultants. The better place to begin is to figure out what Information Security Management System, or ISMS is required to cover.
The scope of the document is important because trying to include unnecessary systems, locations or processes may result in further documentation requirements and proof requirements.
A small SaaS company, like might have a concentrated environment based around cloud infrastructure employees’ devices, customer details, and even a handful of essential vendors. Knowing the specifics of the environment will help you decide what your certification project should address.
Review the Security You Already Have
Companies who are looking at ISO 27001 for startups sometimes believe they must build an entirely new security process.
This may not be accurate.
Modern startups might already be using cloud services, and require multi-factor authentication and restrict access to employees. They may also keep the system logs and backups. These practices should be assessed against ISO 27001 requirements. However beginning with the elements which are working already will help avoid unnecessary duplicates.
The remainder of the work involves establishing policies, conducting the risk assessment, determining the applicable Annex A controls, completing the Statement of Applicability, and gathering evidence.
How to Know which invoice is credited for what?
The ISO 27001 cost becomes much easier to understand when expenses aren’t lumped into a single number.
The initial cost for a small company could be between $10,000 and $30,000 depending on the amount of time required by employees, the use of software to guarantee compliance, and independent certification audit. The cost of consulting is an additional expense, but it’s not a requirement.
The ISO 27001 certification cost charged by a certified certification body is especially important to distinguish from the fees for software. The compliance platform functions as a device that organizes work but cannot issue the certification. The process of independent auditing is the one that certifies the certificate.
Then comes the accusations
An employee policy that states that employees’ access to company resources is revoked after their departure isn’t enough. Auditors need proof that the process actually functioning.
This distinction between saying and demonstrating is the main point of ISO 27001.
CertAssist helps to manage this work without having to directly connect to live systems. It presents all 93 ISO 27001:2022 Annex A controls on one page It also provides editable policy and evidence templates It also supports the Statement on Applicability and also allows auditor access that is read-only.
If you have a small group, templates can also remove the tedious task of writing every policy from a blank document.
Certification Day isn’t the Day to Cross the Finish Line
An organization that is just starting from scratch may need to spend between three and six month getting ready to be certified. This will depend on their security policies and procedures, as well as the resources they have available. The certification body conducts the Stage 1 and Stage 2 audits.
Passing those audits isn’t permission to ignore the ISMS. The controls and evidence should be maintained, and surveillance audits follow after certification.
That’s an important consideration when creating the program. A small business doesn’t only require an ISMS it is able to afford to develop. It needs one its team will be able to run after the initial phase is over.
It’s rare to find the ISO 27001 programme for smaller organizations the smartest. It’s the one that conforms to the requirements, is based on the true security standards, is able to withstand independent scrutiny and is feasible when employees return back to their work.