ISO 27001 is not something that startups need to be thinking about for years. Then an email arrives from an enterprise client who is promising: “Please provide your ISO 27001 certificate as part of our vendor security audit.”
The certification process isn’t something to think about next year. It’s tied to a deal that the company is looking to end.
ISO 27001 is a good base for small companies. The challenge is to determine what’s needed without turning a manageable compliance program into a massive security project.
Week One is supposed to be about Scope, not Shopping
It’s commonplace to assess compliance platforms as well as consultants. The most effective place to start is to define what ISMS or Information Security Management System needs to be able to contain.
The project’s scope is crucial, as adding unnecessary procedures, processes, or locations to the documentation may cause additional evidence or documentation requirements.
Small SaaS companies, for instance could have an environment that is focused on cloud infrastructures including employee devices, client data, and only one or two key vendors. Understanding the current environment can help determine what certification project is needed.
Check out the Security You Already Have
Many companies that are researching ISO 27001 to start ups are assuming that they must develop a completely new security system.
This could not be the case.
Modern startups may already have established cloud providers that require multi-factor authentication, a restricted set of access to employees and system logs for managing, documentation for onboarding and offboarding. It’s not enough to assess existing practices against ISO 27001, but if you start with the practices that work now, it will help avoid unnecessary duplicate work.
The remainder of the work involves establishing guidelines, conducting the risk assessment, determining the appropriate Annex A controls, completing the Statement of Applicability and obtaining proof.
Find out which invoice pays for What?
It’s easier to understand ISO 27001 costs when they don’t have to be summed in a single figure.
The first year costs for a small company could be as low as $10,000-$30,000, depending on the time devoted by staff, software to ensure compliance, and independent certification audit. Consulting can be a cost in addition, but it is optional rather than an automatic requirement.
The ISO 27001 certification cost charged by an accredited certification body is especially important to distinguish from software fees. While a compliance platform may assist in coordinating the work, it cannot issue certification. The independent auditing process is the process that validates the certificate.
Then comes the accusations
In the event of a written policy stating that access to employees is terminated upon departure isn’t enough. Auditor needs proof that the system is effective.
ISO 27001 is based on the distinction between showing and saying.
CertAssist facilitates this process without the need to directly connect to an actual system. It displays all ISO 27001:2022 Annex A controls on one board it provides editable policies and evidence templates as well as the Statement of Applicability, and allows auditor access that is read-only.
Templates can be used by small groups of people to reduce the laborious process of drafting each policy from scratch.
Certification Day is Not the End Line
A new company can take between three and six months preparing for certification dependent on its current security practices and available resources. The body that certifies will complete the Stage 1 and Stage 2 auditories.
The ISMS is not forgotten just because you passed the audits. After certification, control and evidence have to be maintained. Surveillance audits will follow.
It is important to think about this when designing the program. A small business doesn’t only require an ISMS it is able to afford to develop. It should have an ISMS that its team will be able to use once the project is over.
Rarely is the ISO 27001 programme for smaller organizations the smartest. The best ISO 27001 program is one that adheres to the standards, is based on genuine security practices, and can stand up to scrutiny from an outsider and remain manageable after everyone returns to work.