It is possible for a startup to remain in business for years without having a serious look at ISO 27001. A promising enterprise customer is contacted via email “Please give us ISO 27001 as part of our vendor evaluation.”
Certification is suddenly not something you need to be thinking about next year. The company wants to finish the contract.
For a lot of growing businesses it’s the best starting point for ISO 27001 for small business. The problem is to figure out what’s actually required without turning a manageable compliance program into a massive security initiative.
Week One is about Scope, not Shopping
The first thought is to start comparing compliance platforms and consultants. The best place to start is determining what Information Security Management System, or ISMS is required to cover.
The project’s scope is vital to consider, since adding unnecessary methods, locations or systems to the documentation can create additional evidence and requirements for documentation.
Small SaaS businesses, for example might have a system that is focused on cloud infrastructures including employee devices, customer information, and one or two key vendors. Understanding the context helps determine the specific issues that the certification process requires to tackle.
Take Inventory of Security You Already Have
Companies researching ISO 27001 for startups sometimes believe that they require an entirely new security system.
This could not be true.
Modern startups may already be using established cloud providers, and may require multi-factor authentication, restricted employee permissions and system logs that can be used to manage the process of onboarding and offboarding. It’s still important to test current practices against ISO 27001, but if you start with what is working today, you can avoid unnecessary duplicates.
The remaining work involves the preparation of policies, completing risk assessments as well as finding Annex A controls applicable, making Statements of Applicability (SOA), and gathering evidence.
What is the best way to determine which invoice is credited for what?
The ISO 27001 cost becomes much easier to understand when expenses aren’t lumped into a single number.
If you think about the expense of an audit by an independent certifier, tools for compliance, and staff time The first year of a small-sized business’s cost could be anything from $10,000 to $30,000. A consulting fee can be a part of the equation, but it is not an essential expense.
The ISO 27001 certification cost charged by an accredited certification agency is crucial to distinguish from software-related fees. Although a compliance system can assist in coordinating the task, it’s not capable of granting the certificate. Certification comes through the independent audit procedure.
Then comes the evidence
Writing a policy stating that access to employees is restricted after leaving isn’t enough. Auditor needs proof that the process actually operating.
ISO 27001 is concerned with the difference between stating something and demonstrating it.
CertAssist was created to assist organize this process without connecting to live systems of the business. It contains all 93 ISO 27001 Annex A controls in one board. It also includes customizable templates for policies and evidence, as well as a Declaration of Applicability.
A small team can benefit from templates. template templates can be a great way to avoid the inefficient task of writing every policy on an unfinished document.
Certification Day isn’t the Final Line
Based on the current security procedures and capabilities depending on their security policies and resources, it can take a new company between 3 and 6 month to be ready for certification. The certification body then conducts Stage 1 and Stage 2 audits.
After passing the audits, you shouldn’t simply ignore your ISMS. Controls and evidence need to be maintained and surveillance audits must be conducted after the certification.
It’s important to take this into consideration when developing the program. It’s not enough for small businesses to simply have an ISMS which it can afford. It needs an ISMS to ensure that the team can work effectively after the initial project has ended.
The most efficient ISO 27001 program for a small-sized business isn’t always the most comprehensive. It is one that meets ISO 27001 standards, reflects authentic security practices, passes independent audits and is able to be maintained once everyone returns to their normal jobs.
