It’s possible for startups to go for years without having a serious look at ISO 27001. Then an email arrives from a promising enterprise customer: “Please provide your ISO 27001 certification as part of our vendor security audit.”
Suddenly, certification isn’t something to be considered the next time. It’s connected to a contract that the company would like to terminate.
ISO 27001 can be a excellent starting point, particularly for companies that are growing. The trick is to identify what’s necessary without transforming a simple compliance program into an enterprise-sized security plan.
This Week, Focus on Scope and not on Shopping
It may be instinctive to look at compliance platforms and consultants. The ideal place to begin is to define the requirements that an ISMS or Information Security Management System needs to include.
It is important to look at the scope, because adding systems, locations, and processes that aren’t necessary can result in further documentation or requirements for evidence.
For example, a small SaaS company may have an environment heavily focused on cloud infrastructure such as employee devices and customer data. It could be also controlled by a few key vendors. Knowing the context will help determine what certification project is required.
Take Inventory of Security You Already Have
Companies who are looking at ISO 27001 for startups sometimes believe that they require an entirely new security program.
It could be that it isn’t.
A modern business may require multi-factor authentication, restrict employee permissions, maintain records of system activity, control backups as well as document onboarding and offboarding procedures, and make use of established cloud providers. The current practices must be assessed against ISO 27001 requirements, but starting with what is already in place can help avoid unnecessary duplicates.
The remainder of the job involves the preparation of policies, completing risk assessments as well as finding Annex A controls applicable, making Statements of Applicability (SOA), and gathering evidence.
Be aware of which invoices are paid for What?
The ISO 27001 cost becomes much easier to understand when expenses aren’t lumped into a single number.
The initial costs for a small-sized business can be anywhere between $10,000 and $30,000 depending on the amount of time spent by staff, the software used to guarantee compliance, and independent audits of certification. The cost of consulting can be added, however it isn’t an essential expense.
The ISO 27001 certification cost charged by a certified certification body is important to distinguish from the fees for software. A compliance platform can help manage the process, but it is not able to award the certification. Certification is awarded by an independent audit.
Then follows the accusations
It’s not enough to write a policy that says employees can’t access the system after they have left. Auditors will have to see evidence that the system is put in place.
ISO 27001 is based on the distinction between saying and showing.
CertAssist facilitates this process without having to connect directly to a live system. It shows all the 93 ISO 27001-2022 Annex A control templates on one single board. An editable policy as well as an evidence template are also provided.
A template for a small team will eliminate the inefficient process of writing every policy on one blank page.
Certification Day Isn’t the Finish Line
A business that is launching from scratch may have to invest between three and six months to get ready to be certified. This will depend on their existing security practices, as well as available resources. The certification body conducts Stage 1 and Stage 2 audits.
After passing the audits you can’t just put aside your ISMS. The controls and evidence should be maintained and surveillance audits are conducted following certification.
It’s important to think about this while designing the program. It’s not enough for a small company to have an ISMS that is affordable. It should have an ISMS that its team will be able to use once the project has been completed.
The most intelligent ISO 27001 program for a smaller business isn’t necessarily the largest. The best ISO 27001 system is one that adheres to the standard, incorporates real security practices, can endure scrutiny from outsiders and be manageable after everyone returns to work.