A start-up can be a long time without thinking seriously about ISO 27001. An email from a customer of an enterprise asks for your ISO 27001 certification as part our security audit of the vendor.
It’s not something you need to be thinking about the year ahead. It’s related to a contract the company is trying to end.
ISO 27001 is a good starting point for many small businesses. The trick is to understand what’s required, without turning a scalable compliance program into an enterprise-sized security plan.
The first week of the week should be focused on Scope, not Shopping
It’s natural to assess compliance platforms as well as consultants. The best place to start is by defining what ISMS or Information Security Management System needs to include.
The project’s scope is crucial since adding unneeded procedures, processes, or locations to the documentation may cause additional evidence or documentation requirements.
A small SaaS company, like might have a concentrated environment based around cloud infrastructure as well as employee devices, customers information, and a few of critical vendors. Knowing the specifics of your environment will help you determine what your certification program should focus on.
List the security that you have already
A few companies who are studying ISO 27001 as a startup suppose that they have to establish an entirely new security program.
This may not be accurate.
A modern startup might already require multi-factor authentication, limit the access of employees, keep systems logs, maintain backups, document onboarding and offboarding, and use existing cloud services. It’s still important to test current practices against ISO 27001, but if you begin with the best practices now, it can save unnecessary duplicates.
Documenting policies, performing a risk assessment, determining the applicable Annex A Controls, completing the Statement for Applicability and gathering evidence are the other tasks.
Be aware of which invoices are paid for What?
The ISO 27001 cost becomes much easier to understand when expenses aren’t lumped into a single number.
Initial expenses for a small business can range from $10,000 to $30,000. This is when the independent certification audit, compliance software and time spent by internal staff are considered. The consulting fee could be a part of the equation, but it is not an essential expense.
It is important to differentiate between ISO 27001 certification costs charged by a certified certification agency as well as software-related fees. A compliance platform may help with the task, but it’s not able to issue the certificate. Certification is granted through an independent audit process.
Then, the proof
In the event of a written policy stating that employee access is removed after the departure of an employee isn’t enough. The auditor needs to be able to verify that the system is implemented.
This difference between proving and saying is central to ISO 27001.
CertAssist manages this task without having to connect directly to an actual system. It shows all the 93 ISO 27001-2022 Annex A control templates on a single board. An editable policy as well as an templates for evidence are also available.
Templates can be employed by an enclave of people to cut out the lengthy process of creating every policy by hand.
Certification Day isn’t the Final Line
A business that is beginning from the ground up may need to take between three and six months getting prepared to be certified. It all depends on their security policies and procedures, as well as the resources they have available. The certification body will then conduct the Stage 1 and Stage 2 audits.
The ISMS will not be lost just because you passed the audits. The ISMS should continue to ensure that it has adequate controls and proof. Following certification, surveillance audits must be conducted.
This is an important aspect to take into consideration when making the program. It’s not enough for a small business to just have an ISMS that they can afford. It’s in need of one that is able to operate once the initial project is completed.
The most efficient ISO 27001 program for a smaller business isn’t necessarily the largest. It is one that meets ISO 27001 standards and reflects authentic security practices, passes independent inspection and can be managed once everyone is back to their regular jobs.