A start-up can be a long time without thinking seriously about ISO 27001. When an email arrives from a promising enterprise customer: “Please provide your ISO 27001 certificate as part of our security review for vendors.”

The certification issue isn’t one to look at next year. The company is looking to complete the contract.

For a lot of growing businesses, that’s the practical starting point for ISO 27001 for small business. It’s an uphill task to decide what’s required without turning an easily managed project into a compliance plan for large corporations.

This week, concentrate on Scope, not Shopping

It is common to assess compliance platforms as well as consultants. An alternative is to identify what Information Security Management System, or ISMS should cover.

Scope matters because trying to include unneeded systems, locations, or processes can create further documentation requirements and proof requirements.

For instance, a small SaaS firm may have an environment heavily concentrated on cloud infrastructure including employee devices, information about customers. It could also be dominated by few key vendors. Understanding this environment will help establish the issues that the certification program will need to focus on.

Take Inventory of Security You Already Have

Companies researching ISO 27001 for startups sometimes assume they need to build an entirely new security operation.

This might not be correct.

Modern startups are likely to use cloud providers, require multi-factor authentication and restrict access for employees. They may also keep the system logs and backups. It’s important to test current practices against ISO 27001, but if you start with what is working now, it will help avoid unnecessary duplicates.

The remainder of the task involves the preparation of policies, completing risk assessments and making decisions about Annex A controls applicable, completing Statements of Applicability (SOA) and collecting evidence.

How to Know which invoice pays for what?

The ISO 27001 cost becomes much simpler to understand if expenses aren’t combined into a single number.

A small organization may total roughly $10,000 to $30,000 when the independent certification audit, compliance software and staff time at the internal level are taken into consideration. The cost of consulting can be added, however it isn’t a major expense.

The ISO 27001 Certification Cost charged by a certification organization that is accredited is crucial to differentiate from software charges. While a compliance platform may help in the process of organizing work, it cannot issue the certificate. The process of independent auditing is what validates the certification.

Then comes the proof

A policy that says employees’ access rights to company resources is terminated upon the employee’s departure is not enough. Auditors need proof that the process actually working.

ISO 27001 is concerned with the distinction between saying something and demonstrating it.

CertAssist was designed to help in coordinating this process, but without connecting to the systems that live in a company. It contains all 93 ISO 27001 Annex A controls within one single board. It also offers editable templates for policy and evidence, and a statement of Applicability.

Templates can be used by small groups to avoid the tedious task of creating each policy by hand.

The End Line isn’t Certification Day.

A business that is launching from scratch might need to take between three to six months getting ready for certification. This will depend on their current security practices and the available resources. The body that certifies will carry out Stage 1 and Stage 2 auditories.

The ISMS isn’t forgotten since you’ve passed the audits. After certification, the controls and evidence must be maintained. Surveillance audits will follow.

This is a crucial aspect to consider when developing the program. It’s not enough for a small-sized business to have an ISMS which it can afford. It must have an ISMS that the team can utilize after the project is over.

It’s not often that even the biggest company is the one with the best ISO 27001 program. The best ISO 27001 program is one that conforms to the standards, is based on the best practices in security, and can withstand independent scrutiny and still be able to be managed after everyone has returned to work.