A startup can go years without thinking seriously about ISO 27001. An email comes in from a potential enterprise client: “Please provide your ISO 27001 certificate to us as part of our vendor security assessment.”
It’s not something you’re supposed to think about in the coming year. The company would like to close an agreement.
ISO 27001 can be a ideal starting point for businesses that are growing. The trick is figuring out what actually needs to happen without making a small security project into a massive compliance program.
Week One Should Be About Scope, Not Shopping
The initial reaction is to compare compliance platforms and consultants. It is best to establish what ISMS (Information Security Management System) will need to cover.
The project’s scope is important because adding inefficient methods, locations or systems to the documentation may cause additional evidence or the need for documentation.
A small SaaS company, like might have a targeted environment based on cloud infrastructure including employee devices, customer data, and a couple of critical vendors. Knowing the specifics of the environment will assist you in determining the areas your certification plan should be addressing.
Make a list of the security features you already have
Companies researching ISO 27001 for startups sometimes assume they need to build an entirely new security operation.
This could not be the scenario.
A modern business may require multi-factor authentication, limit employee permissions, maintain systems logs, maintain backups in the document onboarding process and offboarding procedures, and make use of existing cloud services. The current practices must be evaluated against ISO 27001 requirements, but starting with what is already effective can avoid unnecessary duplicates.
The remainder of the work involves establishing policies, performing a risk assessment, determining the applicable Annex A controls, completing the Statement of Applicability, and gathering evidence.
You can now identify which invoices you pay for and what
The ISO 27001 cost becomes much simpler to comprehend when costs aren’t all lumped together into a single number.
The first year’s expenses for a small company could be between $10,000 to $30,000. This is when the independent certification audit, compliance software and staff time at the internal level are taken into account. The cost of consulting can be included, but it isn’t considered a necessary expense.
The ISO 27001 certification cost charged by an accredited certification agency is important to distinguish from the fees for software. While compliance platforms can assist in coordinating the task, it’s not capable of granting an official certificate. Certification is awarded by an independent audit.
After the evidence is presented, the accusation
An employee policy that states that employees’ access to corporate resources is suspended after their departure is not sufficient. An auditor requires evidence that the process is actually working.
ISO 27001 is concerned with the distinction between saying something and then demonstrating it.
CertAssist was created to assist to manage this process without having to connect to the live systems of the company. It displays all 93 ISO 27001:2022 Annex A controls on one screen It also provides editable policy and evidence templates, supports the Statement of Applicability and also allows auditors to access the system in a read-only mode.
Templates can be employed by a small group to eliminate the tedious task of creating each policy by hand.
The Final Line isn’t Certification Day.
A company that is starting from scratch might need to take between three and six month getting prepared to be certified. This is contingent upon their existing security practices, as well as available resources. The body that certifies conducts its audits at both Stage 1 and 2.
The fact that these audits are passed isn’t a reason to completely forget about the ISMS. After certification, the controls and evidence have to be maintained. Surveillance audits are to follow.
That’s an important consideration when developing the program. Small businesses don’t just need an ISMS it can afford to create. It must have an ISMS that the team can utilize after the project is over.
It’s rare to find the ISO 27001 programme for smaller organizations the smartest. The best ISO 27001 system is one that adheres to the standard, incorporates actual security practices, and is able to withstand independent scrutiny and still be manageable after everyone returns to work.