ISO 27001 for small businesses - a detailed guide

Information security has become a key challenge for small business owners to overcome. With new technologies enabling small businesses to collect large volumes of valuable information quickly, small businesses are finding it difficult to:

• Process and store the information securely,
• Set up a system to manage information security risks,
• Allocate dedicated resources to focus on information security (since there’s already so much to do!)

If you are a small business owner facing similar challenges, there is no need to worry. The good news is that there is a solution: ISO 27001, an international standard for information security.

We’ve put together this guide to help you learn what ISO 27001 standard is, how it can help your small business, what your options are to get ISO 27001 certification, what the requirements are, how long it takes, and more.

What is ISO 27001 and ISO 27001 certification: A brief explanation

 Let’s first briefly discuss what ISO 27001 standard is and how it is connected to ISO 27001 certification.

• ISO 27001 is an international standard on information security that is recognised around the world. The main goal of ISO 27001 is to ensure that only authorised individuals can access the information, can only change the information, and is easily accessible when required.
  
• ISO 27001 provides a framework for businesses of any size or industry to set up an effective and reliable system to manage their information (Information Security Management System). This involves clauses that outline the requirements and a set of rules referred to as “controls” that your ISMS should follow.

• Businesses that set up an ISMS according to the requirements outlined in ISO 27001 standard can obtain ISO 27001 certification. (In short, this means that your ISMS has been given the stamp of approval by an independent certifying body.)

The key takeaway is that ISO 27001 can be used by any business to set up an information security system that is in line with international standards. So, this means that your systems and the data you collect are organised, secure from all types of threats, and also protected from future threats.

Now that you know what ISO 27001 is, let’s take a look at why complying with ISO 27001 can benefit your small business. 

What are the benefits of complying with ISO 27001, and how does it help small businesses?

1. Increases credibility
   ISO 27001 is an internationally recognised standard that boosts consumer trust and validates a business’ credibility in the eyes of consumers all around the world. They'll notice that you're using industry standards to protect their data, demonstrating that you value their privacy.
2. Gain a competitive advantage
   By complying with ISO 27001, you communicate to your stakeholders that you take privacy and information security seriously. Some companies may only choose to do business if your small business is ISO 27001-compliant or ISO 27001-certified.
3. Stay compliant with other regulations
   Information security and data privacy regulations vary across regions and sectors. International laws and regulations such as the GDPR must be adhered to, and ISO 27001 helps small businesses comply with these regulations efficiently and avoid fines.
4. Streamline processes and increase efficiency
   Growth can happen quickly in a small business, and when you experience quick growth, you may find it challenging to keep track of current processes, and information you have collected.

ISO 27001 ensures that you have a central place to manage your information and allows you to document all your processes.

To leverage these benefits for your small business, it’s essential to understand what ISO 27001 requirements are.

What are the ISO 27001 requirements?

To ensure that your ISMS, or information security management system, is ISO 27001-compliant, you must first understand the requirements. As mentioned earlier, ISO 27001 is made up of clauses. The requirements for ISO 27001 are listed in clauses 4-10.

• Clause 4: Context of the organisation
  This is a straightforward step. You have to define what you want to achieve with your ISMS. It includes outlining what information you want to protect.

• Clause 5: Leadership
  Management participation is a must to ensure the success of information security management systems. This means you need to allocate specific people who can take ownership of driving ISO 27001 compliance efforts.

• Clause 6: Planning
  A thorough plan is required when preparing your policies and setting up your ISMS. This includes understanding what the information security risks are, and what security policies you need to develop to mitigate them. A crucial component is ensuring that any security policy you create is always tied to your overall information security goals.  

• Clause 7: Support
  It is essential to ensure that your employees are always supporting your compliance efforts. To do so, all information related to compliance should be created, recorded, updated, and kept secure.

• Clause 8: Operation
  You are expected to prepare several plans to handle any risks, including reducing the likelihood of the risk and creating risk controls. It would help if you also addressed any previously identified risks in your business.

• Clause 9: Performance evaluation
  To ensure the controls you implement are performing effectively, it is important to regularly conduct internal audits that monitor, measure, analyse and evaluate your policies and ISMS.
• Clause 10: Improvement
  To make sure your process is consistently kept up to date and in compliance with ISO 27001 standards, your controls and policies should be regularly improved to keep up with evolving privacy laws and locate outdated processes.

To meet the clauses listed above, ISO 27001 standard lists several controls (a set of rules) that your small business can follow. These focus on 6 (six) key security areas:

• Company security policy
• Asset management
• Physical and environmental security
• Access control
• Incident management
• Regulatory compliance

This information is listed in the Annex A section of ISO 27001 standard, and you can learn more about it in our guide. For a more comprehensive guide on how to implement ISO 27001 in your small business, check out our ISO 27001 checklist.

While you work on becoming ISO 27001-compliant, you can also consider obtaining the ISO 27001 certification. To become certified, you must meet the ISO 27001 clauses, which means you can qualify for your certification while already working on your compliance efforts; two birds, one stone!

What options do small businesses have for getting ISO 27001 certified?

There are three options open to small businesses when it comes to ISO 27001 certification:

Option 1: Do it yourself

Option 2: Hire a certification agency

Option 3: A combination of both

Although many do-it-yourself options exist for ISO 27001 certification, these options may not be tailored to individual companies. Ideally, ISO 27001 certification should be personalised experience as all businesses face unique challenges.

Now that you have considered your options for ISO 27001 certification let’s go over how long it takes to get certified.

How long does it take to get certified?

The process of certification for ISO 27001 is broken down into three main steps:

• A document review
  An auditor from an independent certification body reviews your documentation to check if it complies with the standard.
• The main audit
  An auditor determines if your business is ready for a full audit. If it is, your ISMS goes through a detailed inspection to check its compliance with ISO 27001 standards. If this audit is successful, you will receive your certification. 
• A surveillance audit
  An auditor checks one or more parts of your ISMS.

The time taken for each of these steps can vary depending on the auditor, the complexity of your ISMS, and the number of employees your business has:

• 1 to 20 employees - Up to 3 months
• 20 to 50 employees - 3 to 5 months
• 50 to 200 employees - 5 to 8 months
• More than 200 employees - 8 to 20 months

When you are awarded your ISO 27001 certification, it will be valid for 3 (three) years. Keep in mind that the certificate needs to be recertified every 3 (three) years to be kept active. There are surveillance audits that are required as a part of ISO 27001 compliance every year and DataGuard can assist with helping you organise and prepare for such audits.

Now that you know how long the process can take, here are some tips to keep in mind as you work towards certification.

What are some small business tips for ISO 27001 certification?

1. Keep things simple
   Your information security management system policies, processes, and procedures must be easily accessible as and when needed. It also applies to audit-related material, like management reviews and internal audits. The best way to ensure ease of access is to store this information securely in a single, centralised platform.
   

2. Assess potential auditors and ISO 27001 consultants
   Before signing any new contracts, it's essential to take the time to interview potential auditors and gauge whether they are the right fit for your company.

Consultants and auditors specialising in ISO 27001 will have different backgrounds and "empathy points" to offer. This is why it’s important to pick a consultant who has worked with various businesses and, ultimately, someone you can trust.

Once you've decided on the best way to manage your small business's ISO 27001 certification process, it's time to choose how to get certified.

How can DataGuard help small businesses get ISO 27001 certified?

 DataGuard helps companies in different industries implement and obtain ISO 27001 certification.

With our ISO 27001 certification solution, you can benefit from:

1. Free consultation
   Ask us anything about DataGuard and our services in a free, no-commitment consultation.
2. Customised solutions for your small business
   100% of our users pass certification for the first time. After an in-depth discussion with you, our team will develop a plan unique to your small business so you can find out what works best for your business.
3. Cost efficiency
   You will have access to user-friendly procedures, thorough explanations, and a devoted expert who will help you every step of the way.
4. Easy to use ISMS
   Our Info-Sec platform will become your living ISMS. You can track your assets, documents, risks and audits, all in one place.

Interested in getting ISO 27001 certified? Schedule a meeting now.

FAQs

Where do I start with ISO 27001?

There are six steps to ISO 27001 implementation, starting with assembling your team and finishing with certification. Check out our ISO 27001 implementation roadmap.

Do I need Cyber Essentials if I have ISO 27001?

It depends. Cyber Essentials and ISO 27001 are complementary standards. It would be beneficial to have both, but ISO 27001 is a more in-depth standard that covers more areas than Cyber Essentials. However, if your business is bidding for government contracts, it is very likely that you will need Cyber Essentials.

Does ISO 27001 certification expire?

Yes. ISO 27001 certification is valid for three years after the certification date. To maintain compliance, it is required that you conduct internal audits, continue to manage and monitor risks on changing aspects of the business as well as other ISO 27001 recertification processes.

What are the three pillars of ISO 27001?

Confidentiality, integrity and availability (CIA) are the three principles of information security. These principles ensure that your data is secure and protected from unwanted access.

What is the difference between GDPR and ISO 27001?

ISO 27001 is a voluntary certification that requires companies to manage confidential information in a risk-based manner. In contrast, the General Data Protection Regulation (GDPR) is designed to safeguard the personal information of EU and UK residents.

It must be followed by any business conducting business in the region or with EU and UK residents.

Which industries need ISO certification?

While ISO certification benefits any business dealing with personal data, some industries that find it particularly useful are the IT, telecommunication and finance industries.