ISO 27001 is not something that startups need to be thinking about for a number of years. An email from a customer of an enterprise asks for your ISO 27001 certification as part our vendor security review.
Certification is suddenly not something you’re supposed to think about next year. It’s due to a contract that the company is trying to close.
ISO 27001 is a good starting point for many small companies. It’s not easy to identify what must be done in order to turn a simple project into an invasive compliance programme for large corporations.
Week One is supposed to be about Scope, not about shopping.
Your first instincts could lead you to start comparing compliance consultants and platforms. The best way to begin is to define the requirements that an ISMS or Information Security Management System needs to incorporate.
Scope matters because trying to include ineffective systems, locations or processes could result in additional documentation and requirements for evidence.
A small SaaS company, for example could have a concentrated environment based around cloud infrastructure as well as employee devices, customers information, and a handful of key vendors. Understanding this environment will help establish the specific issues that the certification process will need to focus on.
Review the Security You Already Possess
A few companies who are studying ISO 27001 as a startup suppose that they have to establish an entirely new security system.
This may not be the case.
Modern startups may already be using established cloud providers that require multi-factor authentication, a restricted set of employee access and system logs that can be used to manage the onboarding process and documentation for offboarding. It’s not enough to test current practices against ISO 27001, but if you start with the practices that work currently, it could save unnecessary duplication.
The remainder of the job involves preparing policies, conducting risk assessments in finding Annex A controls applicable, making Statements of Applicability (SOA) and gathering evidence.
You now know which invoices you pay for and what.
The ISO 27001 cost becomes much easier to understand when expenses aren’t lumped into a single number.
Initial expenses for a small company could be between $10,000 to $30,000 once the independent certification audit, compliance software, and internal staff time are considered. Consulting can be a cost in addition, but it is optional rather than a mandatory obligation.
The ISO 27001 certification cost charged by an accredited certification organization is important to distinguish from software fees. While compliance platforms can assist in coordinating the process, it is not able to issue an official certificate. The independent auditing process is what certifies the certificate.
Then, the evidence
A policy that says employees’ access to corporate resources will be revoked following their departure isn’t enough. Auditors require proof that the process is actually functioning.
ISO 27001 is based on the distinction between saying and showing.
CertAssist helps to manage this work without needing to directly connect to a live system. It displays all the 93 ISO 27001-2022 Annex A control templates on one screen. An editable policy as well as an evidence template are also provided.
A small-sized team template can eliminate the inefficient formulating of every policy in the blank page.
Certification Day isn’t the Final Line
A business that is beginning from scratch can take between three and six months working towards certification according to its current security policies and the resources available. The body that certifies will perform Stage 1 and Stage 2 auditories.
It isn’t enough to forget about the ISMS. The controls and evidence should be maintained and surveillance audits are conducted following the certification.
It is important to take this into consideration while designing the program. It’s not enough for a small-sized business to have an ISMS that it can afford. It needs an ISMS that its team can use after the project has ended.
It’s rare to find the ISO 27001 programme for smaller businesses the most efficient. The best ISO 27001 system is one that conforms to the standard, reflects actual security practices, and is able to stand up to scrutiny from an outsider and be manageable after everyone returns to work.