A start-up can be a long time without considering ISO 27001. An email comes in from a promising enterprise customer: “Please provide your ISO 27001 certificate to us as part of our vendor security review.”
Suddenly, certification isn’t something to be considered the next time. It’s due to a contract that the company is trying to end.
For many growing companies, that’s the practical starting point for ISO 27001 for small business. The challenge is to figure out what’s actually necessary without transforming a simple compliance program into an enterprise-sized security initiative.
This Week, affixed to Scope, not Shopping
It’s commonplace to assess compliance platforms as well as consultants. A better starting point is to figure out what Information Security Management System, or ISMS should cover.
It is essential to take into consideration the extent of the project, since adding systems, locations, and processes that aren’t needed can create further documentation or requirements for evidence.
Small SaaS companies, for instance might have a system which is centered around cloud infrastructures including employee devices, customer information, and few key vendors. Knowing the specifics of the environment will help you determine what your certification plan should be addressing.
Look over the Security You Already Have
Companies that are researching ISO 27001 for startups sometimes believe they must build an entirely new security process.
This may not be accurate.
Modern startups could already utilize cloud providers, require multi-factor authentication and restrict access to employees. They might also maintain system logs and manage backups. The existing practices need to be evaluated against ISO 27001 requirements. However, starting with the things which are working already can avoid unnecessary duplicates.
The documentation of policies, the risk assessment, determining the appropriate Annex A Controls, completing the Statement for Applicability and gathering evidence are all the remaining tasks.
Know Which Invoice Pays for What
It’s simpler to comprehend ISO 27001 costs when they aren’t summed up in a single figure.
The initial costs for a small business may be between $10,000 and $30,000 depending on the time devoted by staff, software to make sure compliance is maintained, and independent certification audit. Consulting can add another expense however it’s an option instead of an automatic requirement.
The ISO 27001 certification cost charged by an accredited certification organization is important to distinguish from software-related fees. While a compliance platform may aid in the organization of process, it is not able to issue a certificate. Certification is granted by an independent audit.
Then Comes the Evidence
A policy that stipulates that employees’ access to company resources will be revoked following their departure does not suffice. Auditors need proof that the process actually operating.
This difference between proving and saying is the main point of ISO 27001.
CertAssist was created to assist in coordinating this process, but without connecting to the systems that live in a company. It displays all 93 ISO 27001-2022 Annex A control templates on one single board. A customizable policy and an templates for evidence are also available.
If you have a small group, template templates can remove the tedious task of drafting every policy from a blank document.
The End Line isn’t Certification Day.
Based on the company’s current security practices and resources, it may take between three and six month to be ready for certification. The certification body conducts its audits at Stage 1 and 2.
The ISMS isn’t forgotten because you pass the audits. The ISMS has to continue to maintain controls and evidence. After certification, surveillance audits must be conducted.
This is an important element to consider when creating the program. A small business doesn’t only need an ISMS it can afford to create. It needs one its team will be able to run after the initial phase is over.
The most intelligent ISO 27001 program for a smaller organization is rarely the largest. The most effective ISO 27001 program is the one that meets the standards, is based on real security practices, can endure scrutiny from outsiders and be able to be managed after everyone has returned to work.