It is possible for a start-up to remain in business for years without having a serious look at ISO 27001. An email from a business customer solicits your ISO 27001 certification as part our security inspection of the vendor.
Certification is no longer something you should be thinking about the year ahead. The company wants to finish the specific contract.
ISO 27001 is a good base for small-scale firms. The trick is to determine what’s necessary without transforming a simple compliance program into a massive security initiative.
This Week, affixed to Scope and not on Shopping
First instincts may make you start looking at the platforms and consultants for compliance. The better place to begin is determining what the Information Security Management System, or ISMS, needs to cover.
Scope is crucial because trying to include unnecessary systems, locations, or processes can create more documentation and require additional evidence.
A small SaaS company, for example, may have a relatively focused environment built around cloud infrastructure employees’ devices, customer information, and a few of essential vendors. Knowing the specifics of the environment will aid in determining what your certification project should address.
Review the Security You Already Have
Companies researching ISO 27001 for startups sometimes assume they need to build an entirely new security operation.
This could not be true.
Modern startups are likely to use cloud providers, require multi-factor authentication, and limit access to employees. They might also maintain records of system activity and maintain backups. These practices should be evaluated against ISO 27001 requirements. However by starting with the practices which are working already will help avoid unnecessary duplicates.
The remaining tasks include establishing policies, performing the risk assessment, finding the applicable Annex A controls, completing the Statement of Applicability and obtaining proof.
It is now possible to identify which invoices are paid for by what
It’s easier to understand ISO 27001 costs when they aren’t summarized into one number.
If you think about the expense of an audit by an independent certifier, tools for compliance, and time for staff the first-year cost could be anything from $10,000 and $30,000. A consulting fee can be a part of the equation, but it isn’t an essential expense.
The ISO 27001 certification cost charged by a certified certification body is crucial to distinguish from the fees for software. A compliance platform can assist with the task, but it cannot award the certificate. Certification is granted by an independent audit.
Then is presented, the accusation
A policy that stipulates that employees’ access to corporate resources is suspended after their departure isn’t enough. Auditors will have to examine evidence to prove that the procedure is put in place.
ISO 27001 is concerned with the distinction between saying that something, and proving it.
CertAssist was created to assist organize this process without connecting to the live systems of a company. It offers all 93 ISO 27001 Annex A controls all in one place. It also includes editable templates for policy and proof, along with a Statement of Applicability.
For a small team, templates can also eliminate the inefficient process of writing every policy on a blank sheet.
Certification Day is Not the Final Line
A company starting from scratch could take anywhere from three to six months preparing for certification based on its current security practices and available resources. The certification body conducts Stage 1 and Stage 2 audits.
The ISMS is not forgotten just because you have passed the audits. The ISMS must continue to maintain controls and evidence. Following certification, surveillance audits are performed.
It is important to take this into consideration when designing the program. It’s not enough for a small business to simply use an ISMS that it can afford. It needs an ISMS so that its team can be able to operate in a realistic manner following the initial project concluded.
It’s not often that the biggest organization has the best ISO 27001 program. It must meet the ISO 27001 requirements, is based on real security practices, withstands independent audits and is able to be maintained once everyone has returned to normal duties.