ISO 27001 implementation for small and medium businesses

ISO/IEC 27001 is the international standard that sets the requirements for establishing, maintaining and continually improving an information security management system (ISMS). It protects the confidentiality, integrity and availability of a company's data and requires risks to be managed in an organised way. The current edition is ISO/IEC 27001:2022.

No. The certificate is issued by an accredited certification body that audits your company. Our job is to get the company ready for that audit and stay with you through it. We say this up front, because anyone who promises to certify you without being an accredited body is not being straight with you.

It is usually voluntary. In practice more and more customers, tenders and contracts ask for it, especially of companies that handle other businesses' data: software, IT services, consulting, health, finance. If nobody is asking you and you don't see that coming, we'll tell you it isn't worth it yet.

It doesn't guarantee it, but it helps a lot. GDPR is a law about personal data; ISO 27001 is a standard for the security of all your information. Having the system in place shows you took appropriate security measures, and much of the work serves both.

Our work is a fixed price, agreed in writing after the free call, and depends on the size of the company, the number of people and systems, and where you start. The certification audit is charged separately by the certification body; we help you compare proposals before you choose.

For a small company it usually takes three to six months to reach the certification audit. It depends on where you start and how quickly the team closes the open points. We agree a realistic timeline in writing before we begin.

We start with the gap analysis and risk assessment, then write the policies, switch on the controls and train the team, and run an internal audit. After that comes the certification body's audit in two stages: a review of your documents and a review of the implementation. The certificate lasts three years, with yearly surveillance audits.

Annex A now has 93 controls, grouped into four themes: organisational, people, physical and technological. New controls arrived, for example for cloud services, data leakage prevention and secure configuration. The deadline for companies certified to the 2013 edition to move to 2022 ended in October 2025.

There is documentation, but only what the standard requires and what your team will actually use. We keep policies short, build on what the company already does well and don't write procedures to fill pages. A system nobody reads won't pass a good audit either.

Book a free 30-minute call. We ask what the company does, who is asking for the certification and how you handle data today, then tell you whether it's worth it, how long it takes and what we'd do first, at a fixed price.