A startup can go years without thinking about ISO 27001. A few days later, an email is sent from a potential enterprise client: “Please provide your ISO 27001 certificate as a part of our vendor security assessment.”
The certification issue isn’t one to look at next year. It’s tied to a deal which the company plans to end.
For many growing companies, that’s the practical starting point for ISO 27001 for small business. It’s a challenge to understand what’s necessary without transforming a simple compliance program into an enterprise-sized security project.
The first week of the week should be focused on Scope, not Shopping
The first thought is to begin comparing compliance systems and consultants. The best place to start is to define the requirements that an ISMS or Information Security Management System needs to be able to contain.
The scope of the document is important because trying to add unnecessary locations, systems, or processes can create additional documentation and evidence requirements.
A small SaaS company, like could have a specific environment that is built around cloud infrastructure as well as employee devices, customers information, and a handful of key vendors. Knowing the context will aid in determining what certification is required.
Look over the Security You Already Possess
Some companies researching ISO 27001 as a startup believe that they need to create a new security operations.
This could not be true.
Modern startups may already be using established cloud providers, and may require multi-factor authentication, a restricted set of access to employees and system logs that can be used to manage the onboarding process and documentation for offboarding. It’s important to review current practices in relation to ISO 27001, but if you start with what is working now, it can save unnecessary duplicate work.
The remaining work includes preparing policies, performing risk assessments and determining Annex A controls applicable, creating Statements of Applicability (SOA), and obtaining evidence.
It is now possible to identify which invoices pay for what
The ISO 27001 cost becomes much more understandable when expenses aren’t all lumped together into a single number.
First-year spending for a small business can range from $10,000 to $30,000 once the independent certification audit, compliance software and staff time at the internal level are taken into account. The cost of consulting can be included, but it isn’t an essential expense.
The ISO 27001 certification cost charged by an accredited certification body is crucial to distinguish from the fees for software. A compliance platform can help with the task, but it’s not able award the certificate. The independent auditing process is what validates the certificate.
Then comes the accusations
An employee policy that states that employees’ access to company resources is revoked after their departure isn’t enough. An auditor needs evidence that the process is actually working.
ISO 27001 is based on the distinction between showing and saying.
CertAssist is designed to facilitate this task without connecting directly to live systems in a company. It provides all the 93 ISO 27001 Annex A controls within one single board. It also has customizable templates for policies and evidence as well as a Declaration of Applicability.
If you have a small group, templates could also help to reduce the time-consuming process of drafting every policy from an unfinished document.
Certification Day is Not the Day to Cross the Finish Line
A business that is beginning from scratch may require between three and six months to get ready to be certified. This is contingent upon their security policies and procedures, as well as available resources. The certification body will then complete the Stage 1 and Stage 2 auditories.
After passing the audits you should not just ignore your ISMS. After certification, control and proofs must be maintained. Audits for surveillance will follow.
It is important to think about this when creating the program. It’s not enough for a small-sized business to just have an ISMS that it can afford. It must have an ISMS its staff can use after the project has been completed.
The most effective ISO 27001 program for a small-sized business isn’t always the most powerful. The most effective ISO 27001 program is the one that meets the requirements, has real security practices, can withstand independent scrutiny and still be manageable when everyone returns to work.