ISO 27001 is not something that startups need to be thinking about for many years. When an email arrives from a promising enterprise customer: “Please provide your ISO 27001 certification as part of our vendor security audit.”
The issue of certification has been resolved and will be debated next year. The company wants to finish an agreement.
ISO 27001 is a good start for many small-scale businesses. The challenge is to understand what’s required without turning a manageable compliance program into an enterprise-sized security initiative.
Week One should be about Scope, Not Shopping
Initial instincts might make you start looking at platforms and compliance experts. It is more beneficial to know the requirements that ISMS (Information Security Management System) should provide.
The scope of the project is crucial to consider, since adding unnecessary procedures, processes, or locations to the documentation can cause additional evidence or the need for documentation.
A small SaaS company, like could have a specific environment that is built around cloud infrastructure including employee devices, customer data, and a couple of key vendors. Understanding this environment will help establish what the certification project actually must address.
Create a list of all the security features you already have
Companies researching ISO 27001 for startups sometimes assume they need to build an entirely new security operation.
It could be that it isn’t.
Modern startups may already have established cloud providers and need multi-factor authentication, a restricted set of access to employees and system logs for managing documents for onboarding and offboarding. It’s still important to review current practices in relation to ISO 27001, but if you start with what is working now, it can save unnecessary duplication.
The remaining work includes preparing policies, performing risk assessments and the determination of Annex A controls applicable, making Statements of Applicability (SOA), and collecting evidence.
How to Know which invoice is credited for what?
It’s easier to understand ISO 27001 costs when they don’t have to be summed into one number.
The first year costs for a small-sized business can be as low as $10,000-$30,000 according to the amount of time required by employees, the use of software to monitor compliance, and an independent certification audit. The consulting fee could be included, but it isn’t a major expense.
It is crucial to distinguish between ISO 27001 certification costs charged by a certified body for certification as well as software-related fees. The compliance platform is a device which can manage work, however it cannot issue the certificate. Certification comes through the independent audit procedure.
Then comes the accusations
It’s not enough simply to draft a policy that stipulates that employees are not allowed access after they have left. An auditor needs evidence that the procedure actually works.
That distinction between demonstrating and saying is the main point of ISO 27001.
CertAssist is designed to help you organize this task without connecting directly to live systems in a company. It presents all 93 ISO 27001:2022 Annex A controls on one screen allows for editing of policy and evidence templates as well as the Statement of Applicability and also allows auditor access that is read-only.
Templates are a great tool for a small group to eliminate the laborious process of drafting every policy from scratch.
Certification Day isn’t the Final Line
Depending on the company’s existing security practices and resources depending on their security policies and resources, it can take a company that is new between 3 and 6 month to be ready for certification. The certification body will conduct Stage 1 and Stage 2 auditories.
It isn’t enough to forget about the ISMS. The ISMS must be able to maintain controls and evidence. Following certification, surveillance audits are conducted.
This is a crucial aspect to consider when designing the program. A small business doesn’t only need an ISMS it can afford to build. It requires an ISMS that ensures its team can work effectively after the initial project has ended.
It’s rare to find the ISO 27001 programme for smaller businesses the most efficient. The most reliable ISO 27001 programme is one that adheres to the standard, reflects actual security practices, and is able to endure scrutiny from outsiders and remain manageable after everyone returns to work.
