ISO/IEC 27001 for small businesses and start-ups: a right-sized ISMS that a ten-person team can run

What ISO/IEC 27001 requires of a small organisation

The same as it asks of a bank, applied to far fewer people, systems and suppliers. Clause 1 makes the requirements applicable to organisations of every type, size and nature, and no requirement in clauses 4 to 10 may be left out if you claim conformity.

What scales is the extent. A note to clause 7.5.1 ties documented information to the organisation's size, process complexity and people's competence, and the controls follow from your own risk assessment. Clause 5.3 asks top management, usually the founders, to assign responsibility for the ISMS, not to create a security department.

What a small team can keep simple

One risk register

Group assets the way the team thinks about them: customer data, the production platform, source code, laptops and the SaaS tools you depend on. Each risk carries an owner, a treatment, its controls and the accepted residual risk, so the treatment plan is a view of the register, not a second document. ISO/IEC 27001 risk assessment and treatment, step by step covers the method.

One combined policy set

Annex A 5.1 asks for an information security policy and topic-specific policies that management approves and people acknowledge, without fixing how many documents hold them. One handbook with a short page per topic stays truer than twenty separate files.

Cloud controls inherited, and evidenced

The provider runs the data centres, hardware and much of the platform. Those controls stay in your Statement of Applicability as supplier-operated, evidenced by your yearly review of the provider's certificate or assurance report against the services and regions you use. Annex A 5.23 adds your own processes for acquiring, using, managing and exiting cloud services.

Roles when one person wears three hats

In a small firm the CTO is often ISMS lead, production administrator and owner of most technical risks at once. That is allowed, within two limits. Annex A 5.3 asks for conflicting duties to be segregated, so whoever grants production access should not be its only reviewer; where a duty cannot be split, a second person checking the logs compensates. Clause 9.2.2 requires objective, impartial audits: nobody audits their own work.

The usual answer: a trained colleague from outside engineering audits the technical controls, and an external auditor, which Sterling provides within the engagement and under Sustain™, audits the ISMS lead's own areas. The certification body cannot fill that role: ISO/IEC 17021-1 treats internal audits by a certification body for its certified clients as a significant threat to impartiality.

These are typical ranges for a team with a working IT function, not promises. A small team writes faster, but the operating period before Stage 2 does not shrink; see ISO/IEC 27001 timeline: how long certification takes, stage by stage.

What the certification body samples in a small scope

A certification body accredited to ISO/IEC 17021-1 and ISO/IEC 27006-1 still runs Stage 1 (the readiness review) and Stage 2, then yearly surveillance and recertification. Its audit time starts from the people working within the scope and is adjusted for factors such as complexity and outsourcing; the 2024 edition of ISO/IEC 27006-1 was updated for remote audits and organisations with few or no physical sites. What changes is the sampling:

• Interviews: founders on policy, risk acceptance and review; the ISMS lead on the risk method and Statement of Applicability; a colleague or two on reporting a lost laptop.
• Demonstrations: multi-factor authentication enforced, laptops encrypted, alerts configured and the last restore test, shown on screen.
• Whole populations: with so few leavers, access reviews and incidents, auditors often check every one.
• Traces: risks followed through to controls and records, including how you assessed the cloud provider.

See ISO/IEC 27001 Stage 1 and Stage 2 audits: what auditors check.

Where small ISMS projects go wrong

• A template ISMS bought online. It assumes a data centre, a security team and a change board, and every page commits you to something the auditor will test. Keep the structure; write the content from how your team works.
• Treating the cloud provider's SOC report as the whole answer. It covers the provider's side. Access, configuration, encryption settings, your backups, logging and your code are yours, and such reports usually list the complementary user entity controls expected of customers: map them into your Statement of Applicability.
• A Statement of Applicability nobody understands. Ninety-three rows of "applicable, implemented" tell the auditor nothing. Each row needs a reason, an operator (you, the provider or both) and a pointer to evidence; The Statement of Applicability: how to write one that survives the audit shows how.
• One person owning everything. The ISMS stalls when that person is away, nobody else can answer at Stage 2, and nobody independent is left to audit. Give each control to whoever runs it, and name a deputy.

Worked example: a 15-person SaaS start-up

The company: two founders (chief executive and CTO), eight engineers including a platform engineer, a designer, two customer success managers, a sales lead and an operations manager covering people and finance. All remote, on one public cloud behind one identity provider; the operations manager leads the ISMS, about a day a week during the build.

Two documents, two registers, one Statement of Applicability; the tools hold the rest.

How Sterling's Design™ route fits a small team

In Design™, your team builds the ISMS with a Sterling consultant's structure, templates, workshops and coaching; in Drive™, Sterling's consultants take on agreed consulting and documentation work beside your control owners. Design™ usually suits a small team: the documents come out in your words, and the engineers who configured the controls explain them at Stage 2. Drive™ suits teams with no spare hours.

ISO/IEC 27001 for small businesses: questions buyers ask