It is possible for a start-up to go for years without taking seriously the idea of ISO 27001. An email comes in from an enterprise client who is promising: “Please provide your ISO 27001 certification as part of our security review for vendors.”
It’s not something you should be thinking about for the next year. The company would like to close an agreement.
ISO 27001 is a good base for small-scale businesses. The problem is to figure out the actual requirements without turning a manageable security project into an enterprise-sized compliance plan.
Week One Should Be About Scope, Not Shopping
It is common to evaluate compliance platforms and consultants. The better place to begin is to figure out what Information Security Management System, or ISMS must cover.
The project’s scope is crucial to consider, since adding unnecessary systems, locations or processes to the documentation could result in additional evidence and the need for documentation.
For instance, a small SaaS company may have an environment heavily focused on cloud infrastructure such as employee devices and information about customers. It may be also controlled by a small number of major vendors. Knowing the context will assist in determining which certification is needed.
Make a list of the security you already have
Companies researching ISO 27001 for startups sometimes assume they need to build an entirely new security operation.
That may not be true.
Modern startups could already have established cloud providers, and may require multi-factor authentication, a restricted set of employee permissions as well as system logs to track the onboarding process and documentation for offboarding. It’s important to evaluate current practices against ISO 27001, but if you start with what works now, it can save unnecessary duplicate work.
The documentation of policies, the risk assessment, determining the applicable Annex A Controls, completing the Statement for Applicability and gathering evidence are all the remaining tasks.
You can now identify which invoices are paid for by what
The ISO 27001 cost becomes much easier to understand when expenses aren’t lumped into a single number.
When you look at the cost of an independent certification audit, compliance tools, and time for staff The first year of a small-sized business’s expenses could range from $10,000 and $30,000. Consulting may be an additional expense but it’s not mandatory instead of an automatic requirement.
The ISO 27001 certification cost charged by a certified certification body is important to distinguish from the software costs. A compliance platform may help with the task, but it cannot award the certificate. The independent auditing process is what validates the certification.
Then comes the evidence
A policy that stipulates that the employee’s access to company resources is suspended after their departure does not suffice. An auditor requires evidence that the system actually functions.
ISO 27001 is concerned with the difference between stating something and then demonstrating it.
CertAssist manages this task without the need to connect directly to a live system. It offers all the 93 ISO 27001 Annex A controls on one screen. It also provides customizable templates for policies and evidence, as well as a Declaration of Applicability.
A small team can benefit from templates. template templates can be a great way to avoid the inefficient task of writing each policy from a blank document.
Certification Day Isn’t a Finish Line
An organization that is starting from scratch could take anywhere from three to six months preparing for certification, depending on its existing security practices and resources. The certification body conducts its audits at the stages 1 and 2.
After passing the audits you should not just forget about your ISMS. The ISMS has to continue to keep track of controls and records. After certification, surveillance audits must be conducted.
That’s an important consideration when making the program. Small businesses don’t only need to have an ISMS they can afford. It needs one its team can realistically operate after the initial phase is over.
It’s rare to find that an organization with the most employees is the one with the best ISO 27001 program. It is one that meets ISO 27001 standards and reflects real security practices, withstands independent inspection and is able to be maintained once everyone gets back to their normal jobs.