ISO 27001 is not something that startups need to be thinking about for years. A promising enterprise customer is contacted via email “Please give us ISO 27001 as part of our review of the vendor.”
The issue of certification is no longer something that is going to be discussed in the coming year. It’s due to a contract the company is trying to close.
ISO 27001 is a good starting point for many small-scale companies. The problem is to determine what’s needed without turning a manageable compliance program into an enterprise-sized security project.
This Week, affixed to Scope and Not Shopping
First instincts may prompt you to begin comparing platforms and compliance consultants. The best place to start is to define what ISMS or Information Security Management System needs to include.
It is crucial to think about the extent of the project, since the addition of systems, locations and procedures that aren’t necessary can result in additional documentation or evidence requirements.
A small SaaS business, for instance it may have a focused environment built around cloud infrastructure including employee devices, customer data, and a couple of key vendors. Understanding that environment helps establish the issues that the certification program will need to focus on.
Make a list of the security that you have already
Companies researching ISO 27001 for startups sometimes assume they need to build an entirely new security operation.
This may not be accurate.
A modern startup might already require multi-factor authentication, deter the access of employees, keep the system logs, handle backups, document onboarding and offboarding procedures, and make use of the most well-known cloud providers. It’s still important to review current practices in relation to ISO 27001, but if you start with what works now, it can save unnecessary duplication.
The remainder of the job involves the preparation of policies, completing risk assessments in making decisions about Annex A controls applicable, creating Statements of Applicability (SOA) and obtaining evidence.
You will now be able to determine which invoices you pay for and what
The ISO 27001 cost becomes much easier to understand when expenses aren’t all lumped together into a single number.
First-year spending for a small organization may total roughly $10,000 to $30,000 once the independent certification audit, compliance software and internal staff time are considered. Consulting is an additional cost, but it is not required.
The ISO 27001 certification cost charged by a certified certification body is particularly important to differentiate from the software costs. While a compliance platform may help in the process of organizing work, it’s not able to issue certification. Certification is awarded by an independent audit.
Then, the evidence
A policy that stipulates that the employee’s access to company resources is terminated upon the employee’s departure is not enough. Auditors need evidence to prove that the system actually functions.
ISO 27001 is based on the distinction between saying and showing.
CertAssist is designed to organize this work without connecting directly to the live systems of a business. It lists all ISO 27001:2022 Annex A controls on one board, provides editable policy and evidence templates and supports the Statement of Applicability and provides read-only auditor access.
Templates can be employed by small groups of people to reduce the laborious process of drafting every policy from scratch.
Certification Day Isn’t a Finish Line
Based on the company’s current security policies and resources depending on the company’s security practices and resources, it could take between three and six month to get certified. The certification body will then conduct Stage 1 and Stage 2 audits.
The ISMS isn’t forgotten because you have passed the audits. The ISMS must be able to keep track of controls and records. Following certification, surveillance audits are performed.
It’s crucial to keep this in mind when developing the program. Small companies don’t just need to possess an ISMS they can afford. It needs an ISMS its staff can use after the project is completed.
It is rare that the biggest company is the one with the best ISO 27001 program. It’s one that complies with ISO 27001 standards, shows the best practices in security, is subject to independent scrutiny and is manageable after everyone is back to normal duties.