A start-up can be a long time without considering ISO 27001. Then an email arrives from a promising enterprise customer: “Please provide your ISO 27001 certificate as a part of our security review for vendors.”
Then, it’s not something to look at the next time. It has to do with an agreement that the company is trying to terminate.
ISO 27001 is a good starting point for many small-scale enterprises. It’s difficult to figure out what must be done without turning a manageable project into a compliance program for large corporations.
Week One is supposed to be about Scope, not about shopping.
First instincts may prompt you to begin comparing compliance consultants and platforms. The better place to begin is determining what Information Security Management System, or ISMS is required to cover.
The scope of the document is important because trying to include unnecessary systems, locations or processes may result in further documentation requirements and proof requirements.
Small SaaS companies, for instance might have a system that’s centered around cloud infrastructures including employee devices, client data, and only few key vendors. Understanding that environment helps establish what the certification project needs to address.
Look over the Security You Already Have
A few companies who are studying ISO 27001 as a startup assume that they must build a new security operation.
However, this may not be the case.
Modern startups could already have established cloud providers, and may require multi-factor identification, restricted employee permissions, system logs to manage, documentation for onboarding and offboarding. Practices in place must be assessed against ISO 27001 requirements, but starting with what is already being used can stop unnecessary duplicates.
The documentation of policies, the risk analysis, determining which Annex A Controls, completing the Statement for Applicability and gathering evidence are all the remaining tasks.
You now know which invoices pay for what.
It’s much easier to comprehend ISO 27001 costs when they aren’t summarized into a single figure.
If you think about the expense of an independent certification audit, compliance tools and time spent by staff, a small company’s first-year expense could range from $10,000 to $30,000. The cost of consulting can be added, however it isn’t an essential expense.
The ISO 27001 certification cost charged by an accredited certification body is especially important to distinguish from software fees. While a compliance platform may assist in organizing the work, it cannot issue a certificate. Certification comes through the independent audit process.
Then, we will look at the evidence
The mere fact of a policy that says access to employees will be revoked after departure isn’t enough. Auditors need evidence to prove that the process actually operates.
ISO 27001 is based on the distinction between saying and showing.
CertAssist is designed to help you organize the work of CertAssist without directly connecting to the live systems of a business. It includes all the 93 ISO 27001 Annex A controls within one single board. It also has editable templates for policy and evidence as well as a Statement of Applicability.
Templates can be used by small groups to avoid the time-consuming process of creating every policy by hand.
The Finish Line isn’t Certification Day
A company starting from scratch can take between three and six months getting certified dependent on its current security policies and the resources available. The certification body conducts audits at both Stage 1 and Stage 2.
The ISMS isn’t forgotten since you’ve passed the audits. The ISMS must continue to maintain controls and evidence. Following certification, surveillance audits are conducted.
It’s crucial to think about this when creating the program. It’s not enough for a small business to simply use an ISMS that is affordable. It needs an ISMS that its team can utilize after the project has been completed.
It is rare that the largest organization is the one with the best ISO 27001 program. The best ISO 27001 system is one that conforms to the standard, reflects genuine security practices, and can withstand independent scrutiny and still remain manageable after everyone returns to work.