A start-up can be a long time without even thinking about ISO 27001. Then an email arrives from an enterprise client who is promising: “Please provide your ISO 27001 certificate as a part of our vendor security audit.”
The certification issue has been resolved and is going to be discussed in the coming year. It’s connected to a contract which the company plans to end.
ISO 27001 can be a excellent starting point, particularly for growing businesses. The challenge is figuring out the actual requirements without changing a simple security program into a massive compliance program.
This week, focus on Scope, not Shopping
The initial reaction is to compare compliance platforms and consultants. A better starting point is determining what the Information Security Management System, or ISMS should cover.
The scope of the project is crucial to consider, since adding unnecessary methods, locations or systems to the documentation could result in additional evidence and documentation requirements.
For instance, a small SaaS company may be operating in an environment predominantly concentrated on cloud infrastructure employees’ devices, as well as customer data. It may also be dominated by a few key vendors. Understanding the surroundings will aid in determining what certification is required.
Check out the Security You Already Possess
Certain companies that are researching ISO 27001 as a startup assume that they must build a new security operations.
It might not be the case.
Modern startups could already have established cloud providers that require multi-factor identification, restricted employee permissions and system logs for managing, documentation for onboarding and offboarding. These practices should be assessed against ISO 27001 requirements. However starting with things that work can avoid unnecessary duplicates.
The remaining work includes documenting policies, performing a risk assessment, determining the appropriate Annex A controls, completing the Statement of Applicability and obtaining evidence.
Find out which invoice pays for What?
It’s easier to understand ISO 27001 costs when they aren’t summed up into one figure.
When you look at the cost of an independent certification audit, compliance tools, and time spent by staff, a small company’s first-year cost could be anything from $10,000 to $30,000. Consulting costs are an additional cost, but it is not a requirement.
The ISO 27001 certification cost charged by an accredited certification body is especially important to distinguish from software fees. The compliance platform functions as a device which can manage work, but it is not able to issue the certification. The certification is awarded through an independent audit process.
Following the evidence, is presented, the accusation
The mere fact of a policy that says access to employees is terminated upon leaving isn’t enough. The auditor needs evidence that the procedure is effective.
That distinction between demonstrating and saying is the main point of ISO 27001.
CertAssist was created to assist in coordinating this process, but without connecting to the live systems of the business. It includes all the 93 ISO 27001 Annex A controls on one screen. It also includes editable templates for policy and proof, as well as a Statement of Applicability.
For a small team, templates can also remove the tedious task of writing every policy on the beginning of a blank document.
Certification Day isn’t the Final Line
Based on the existing security procedures and capabilities depending on the company’s security practices and resources, it could take between 3 and 6 months to get certified. The certification body conducts the Stage 1 and Stage 2 audits.
Passing those audits isn’t permission to completely forget about the ISMS. After certification, control and evidence must be maintained. Surveillance audits are to follow.
This is an important aspect to take into consideration when creating the program. It’s not enough for a small company to simply have an ISMS that it can afford. It requires an ISMS its team will be able to function realistically following the initial project concluded.
The most effective ISO 27001 program for a smaller organization is rarely the largest. The most reliable ISO 27001 programme is one that adheres to the standard, incorporates actual security practices, and is able to stand up to scrutiny from an outsider and be manageable after everyone returns to work.
