An entrepreneur can spend years without even thinking about ISO 27001. An email from an enterprise client wants to know your ISO 27001 certification as part our security audit of the vendor.
Suddenly, certification isn’t something to be considered next year. It’s tied into a contract which the company plans to end.
ISO 27001 can be a ideal starting point for companies that are growing. It’s a challenge to determine what’s required without turning a manageable compliance program into an enterprise-sized security project.
Week One is about Scope, Not Shopping
It’s commonplace to compare compliance platforms and consultants. A better starting point is to identify what the Information Security Management System, or ISMS, needs to cover.
The project’s scope is crucial, as adding unnecessary methods, locations or systems to the documentation may result in additional evidence and requirements for documentation.
A small SaaS company, like could have a focused environment built around cloud infrastructure employees’ devices, customer information, and a few of key vendors. Understanding the surroundings will help you determine which certification is needed.
Check out the Security You Already Possess
Companies researching ISO 27001 for startups sometimes assume they need to build an entirely new security operation.
It’s possible that this is not accurate.
Modern startups may already use cloud providers, and may require multi-factor authentication as well as restrict access for employees. They might also maintain the system logs and backups. The current procedures must be evaluated against ISO 27001 requirements. However, starting with the things that are already working can avoid unnecessary duplicates.
The remainder of the task involves preparing policies, conducting risk assessments, the determination of Annex A controls applicable, making Statements of Applicability (SOA) and gathering evidence.
What is the best way to determine which invoice pays for what?
If expenses aren’t bundled into a single number it becomes easier to understand the ISO 27001 cost.
If you take into account the costs of an audit by an independent certifier, tools for compliance, and the time of staff members the first-year expense could range from $10,000 to $30,000. A consulting fee can be a part of the equation, but it isn’t a major expense.
It is important to differentiate between the ISO 27001 certification costs charged by a certified body for certification and software fees. Although a compliance system can assist in coordinating the work, it cannot issue certification. The certification process is an independent audit process.
Then, the evidence
Writing a policy stating that access to employees is restricted after the departure of an employee isn’t enough. Auditors will have to see evidence that the system is working.
ISO 27001 is concerned with the distinction between stating something and actually demonstrating it.
CertAssist is designed to help you organize this process without connecting directly to the live systems of a business. It presents all ISO 27001:2022 Annex A controls on a single board, provides editable policy and evidence templates, supports the Statement of Applicability and provides auditor access that is read-only.
For small teams, template templates can be a great way to avoid the inefficient task of writing each policy from a blank document.
Certification Day Isn’t the Finish Line
Based on the existing security policies and resources It could take a brand new business between 3 and 6 month to get certified. The certification body will then conduct Stage 1 and Stage 2 audits.
After you have passed the audits, you should not just put aside your ISMS. After certification, control and evidence must be maintained. Audits for surveillance will follow.
It’s a key consideration when making the program. It’s not enough for a small business to just have an ISMS which it can afford. It needs one its team will be able to run after the initial project ends.
The most intelligent ISO 27001 program for a smaller organization is rarely the biggest. It’s the one that meets the requirements of the standard, incorporates real security practices, stands up to independent scrutiny, and remains manageable when everyone returns back to their work.