ISO 27001 is not something that a startup should be thinking about for a number of years. An email from a business customer requests your ISO 27001 certification as part our security review of vendors.
The certification issue is no longer a topic that will be discussed this year. It’s tied to a deal that the company is looking to end.
ISO 27001 can be a great starting point, especially for businesses that are growing. It’s an uphill task to decide what needs to be done without turning an easily manageable project into a compliance program for larger companies.
This week, focus on Scope and not on Shopping
It’s commonplace to look at compliance platforms and consultants. A better starting point is to figure out what the Information Security Management System, or ISMS is required to cover.
The scope of the project is important, as adding unnecessary processes, systems, or locations to the documentation may result in additional evidence and documentation requirements.
A small SaaS business, for instance could have a focused environment built around cloud infrastructure, employee devices, customer information, and a few of critical vendors. Understanding the specific environment could help you decide what your certification project should address.
List the security that you have already
Many businesses that are researching ISO 27001 to start ups are assuming that they must start a new security system.
This could not be true.
Modern startups may already be using established cloud providers and need multi-factor authentication, restricted employee access as well as system logs to track the process of onboarding and offboarding. Current practices need to be assessed against ISO 27001 requirements, but beginning with what is working can prevent unnecessary duplication.
Writing policies, conducting a risk assessment, determining the relevant Annex A Controls, completing the Statement for Applicability and gathering evidence are all the remaining tasks.
Be aware of which invoices are paid for What
The ISO 27001 cost becomes much easier to understand when expenses aren’t lumped into a single number.
When you look at the cost of an audit by an independent certifier, tools for compliance, and time spent by staff, a small company’s first-year cost could be anything from $10,000 to $30,000. A consulting fee can be a part of the equation, but it isn’t considered a necessary expense.
The ISO 27001 certification cost charged by an accredited certification agency is important to distinguish from the fees for software. The compliance platform functions as a device that can organize work however it cannot issue the certificate. The independent auditing process is the process that validates the certificate.
Following the evidence, is the accusation
In the event of a written policy stating that access to employees is restricted after leaving isn’t enough. A auditor must be able to demonstrate that the procedure actually works.
That distinction between demonstrating and saying is the most important aspect of ISO 27001.
CertAssist was created to assist to manage this process without having to connect to the systems that live in an organization. It lists all ISO 27001:2022 Annex A controls on one screen it provides editable policies and evidence templates and supports the Statement of Applicability and provides auditor access that is read-only.
Templates can be used by a small group to eliminate the time-consuming process of creating every policy from scratch.
Certification Day isn’t the End Line
Based on the company’s current security procedures and capabilities, it may take a brand new business between three and six months to prepare for certification. The certification body conducts Stage 1 and Stage 2 audits.
After you have passed the audits, it isn’t enough to go away from your ISMS. After certification, controls and evidence must be maintained. Surveillance audits will follow.
This is an important factor to take into consideration when developing the program. Small companies don’t just need to have an ISMS they can afford. It needs one its team can realistically operate after the initial project has ended.
It is rare that the biggest company is the one with the best ISO 27001 program. It is one that meets ISO 27001 standards, reflects real security practices, withstands independent scrutiny, and is manageable once everyone returns to normal duties.