An entrepreneur can spend years without thinking seriously about ISO 27001. A promising enterprise customer sends an email “Please supply ISO 27001 as part of our vendor review.”
The certification issue isn’t one to think about the next time. It’s tied to a contract which the company plans to end.
ISO 27001 is a good base for small-scale businesses. The problem is to determine what’s necessary without transforming a simple compliance program into an enterprise-sized security initiative.
Week One Should Be About Scope, not Shopping
The first instincts can make you start looking at platforms and compliance consultants. The most effective place to start is by defining the requirements that an ISMS or Information Security Management System needs to include.
Scope is crucial because trying to add unnecessary locations, systems, or processes can create additional documentation and evidence requirements.
For instance, a smaller SaaS firm might have an environment that is mostly focused on cloud infrastructure including employee devices, customer information. The environment could be also dominated by a handful of key vendors. Understanding the surroundings will assist in determining which certification is required.
Take a list of the security you have
Companies researching ISO 27001 for startups sometimes assume they need to build an entirely new security operation.
This might not be correct.
A modern-day startup may require multi-factor authentication, deter the access of employees, keep records of system activity, control backups documents onboarding and offboarding, and utilize the most well-known cloud providers. Existing practices still need to be evaluated against ISO 27001 requirements, but using what’s already being used can stop unnecessary duplicates.
The rest of the work involves the preparation of policies, completing risk assessments, determining Annex A controls applicable, complete Statements of Applicability (SOA) and gathering evidence.
You will now be able to determine which invoices are paid for by what.
It’s easier to understand ISO 27001 costs when they aren’t summed up into one figure.
If you take into account the costs of an independent certification audit, compliance tools and the time of staff members, a small company’s first-year expenditure may be anywhere between $10,000 to $30,000. Consulting is a different expense, but it is optional instead of an automatic obligation.
It is essential to distinguish between ISO 27001 certification costs charged by a certified certification agency and software fees. A compliance platform can assist organize the work, but it is not able to award the certification. The independent auditing process is what validates the certificate.
After the evidence is the accusation
It’s not enough just to make a policy that says employees can’t access the system after they leave. Auditors need evidence to prove that the process is actually working.
ISO 27001 is concerned with the difference between stating that something, and proving it.
CertAssist manages this task without the need to directly connect to live systems. It includes all 93 ISO 27001 Annex A controls on one screen. It also provides customizable templates for policies and evidence and a statement of Applicability.
Templates can be used by small groups of people to reduce the time-consuming process of creating each policy by hand.
Certification Day Isn’t a Finish Line
A business that is beginning from scratch could take anywhere from three to six months working towards certification according to its current security procedures and resources. The certification body will then conduct Stage 1 and Stage 2 audits.
The ISMS isn’t forgotten since you’ve passed the audits. The ISMS should continue to monitor controls and provide evidence. After the certification, surveillance audits are conducted.
It’s important to keep this in mind while designing the program. It’s not enough for a small company to simply use an ISMS that is affordable. It should have an ISMS that the team can access after the project has ended.
The most efficient ISO 27001 program for a smaller organization is rarely the largest. The most effective ISO 27001 program is one that conforms to the standards, is based on real security practices, can stand up to scrutiny from an outsider and be manageable when everyone returns to work.