ISO 27001 is not something that startups need to think about for many years. A prospective enterprise client sends an email to “Please supply ISO 27001 as part of our review of the vendor.”
The issue of certification is no longer a subject that will be discussed this year. The company is looking to complete a particular contract.
For many growing companies, that’s the practical starting point for ISO 27001 for small business. The issue is understanding what needs to be done without changing a simple security program into a large-scale compliance program.
Week One is about Scope, Not Shopping
It is common to look at compliance platforms and consultants. A better starting point is to figure out what Information Security Management System, or ISMS, needs to cover.
It is important to know the scope because trying include unnecessary systems, locations or procedures can result in additional documentation and requirements for evidence.
A small SaaS company may have an environment that is heavily focused on cloud infrastructure including employee devices, customer data. It could also be dominated by couple of key vendors. Understanding the context helps determine what the certification project actually needs to address.
Take Inventory of Security You Already Have
Many companies researching ISO 27001 to start ups believe they’ll need to start a new security operation.
That may not be true.
Modern startups may already use cloud providers, which require multi-factor authentication as well as restrict employee access. They may also keep the system logs and backups. The current practices must be evaluated against ISO 27001 requirements. However by starting with the practices that work already will avoid duplicate work.
The remaining work involves the preparation of policies, completing risk assessments as well as finding Annex A controls applicable, creating Statements of Applicability (SOA) and gathering evidence.
How do you know which invoice pays for what?
If expenses aren’t bundled in one figure it becomes simpler to grasp the ISO 27001 cost.
The initial cost for a small business may be between $10,000 and $30,000, depending on the amount of time spent by employees, the use of software to ensure compliance, and independent audits of certification. Consulting can be a cost in addition but it’s not mandatory rather than a mandatory obligation.
It is important to distinguish between the ISO 27001 certification costs charged by a certified certification body and software fees. The compliance platform is a tool that allows for the organization of work but is unable to issue a certification. Certification is awarded by an independent audit.
Then Comes the Evidence
A policy that says employees’ access rights to company resources is terminated upon the employee’s departure is not enough. Auditors require proof that the process actually effective.
ISO 27001 is based on the distinction between showing and saying.
CertAssist was designed to help in coordinating this process, but without connecting to the systems that live in an organization. It provides all 93 ISO 27001 Annex A controls in one board. It also provides editable templates for policy and proof, as well as a Statement of Applicability.
A small team can benefit from templates. templates can also remove the tedious task of writing every policy on the beginning of a blank document.
Certification Day isn’t the End Line
A business that is beginning from scratch can spend anywhere from three to six months preparing for certification, depending on its existing security procedures and resources. The certification body will carry out Stage 1 and Stage 2 auditories.
The ISMS isn’t forgotten because you pass the audits. Controls and evidence have to be maintained as well as surveillance audits that follow following certification.
It’s important to think about this while designing the program. Small-sized businesses don’t need an ISMS it can afford to build. It should have an ISMS that the team will be able to use once the project is over.
It’s not often that even an organization with the most employees is the one with the best ISO 27001 program. It’s one that is in line with the requirements of the standard, incorporates genuine security practices, survives independent scrutiny, and remains in control when people return to their regular jobs.
