The question about ISO 27001 in a small company usually comes from outside, not from inside. A large customer sends a supplier questionnaire with the line “Do you have an ISO 27001 certificate?”. Or a requirement appears in public tender conditions, and a bid that does not meet it is not even evaluated. Then the CEO starts calculating: is it worth it, how much time will it take and is there an easier way?
The answer depends on who needs the certificate and what the customer actually expects. For some companies, the certificate opens markets that would otherwise stay closed. For others, it is enough to put security in order according to the standard and demonstrate that without a certification body’s stamp.
In this article we explain what ISO 27001 really is, when a certificate is necessary, what stages lie ahead and how long they realistically take for a company of 20 to 100 employees.
What ISO 27001 is and what an ISMS means
ISO 27001 is the international standard for information security management. It does not require a specific technology or software. It requires the company to have a working information security management system (ISMS).
An ISMS is not a program and not a folder of policies. It is the way a company continuously answers four questions: what information do we protect, what threatens it, what do we do so that the threats do not materialise, and how do we know it works. The standard defines how this cycle must be organised, and the annex with a list of controls (organisational, people, physical and technological) gives a menu of concrete measures from which the company selects according to its risks.
What matters for a small company: the standard is proportional. The ISMS of a ten-person software developer can fit into a dozen documents and one risk register. Nobody requires a separate security department.
When a certificate is really needed
A certificate is confirmation by an independent certification body that your ISMS meets the standard. It is needed when somebody outside demands exactly that, rather than your word.
- Customer requirements. Large companies, especially in finance, telecommunications and international groups, increasingly require a certificate from suppliers that handle their data or connect to their systems. Without one, the supplier assessment takes months or never happens at all.
- Tenders. In public and private tenders, a certificate is often a qualification requirement. Without it, the bid is rejected without being evaluated.
- Export. When selling IT services or software to Scandinavia, Germany or the UK, a certificate is often the first question the buyer’s security team asks.
- Regulated customers. If your customers fall under NIS2 or DORA, they must assess their suppliers’ security, and a certificate makes that assessment much simpler.
If none of these cases applies to you, a certificate can be an expensive badge that nobody asks for.
When working “to the requirements” is enough
A good share of companies choose the middle path: they implement an ISMS according to the standard but do not certify it. This makes sense when customers ask not for a certificate but for evidence that security is managed: policies, a risk assessment, an incident procedure, backup tests.
This path is cheaper and faster because the certification audit and the annual surveillance audits drop out. The company gets almost all of the benefit: order, clear responsibilities, fewer incidents, and readiness to certify later if needed. MDP CLOUD itself delivers its services in line with ISO 27001 requirements, so we fill in customer questionnaires from existing documents rather than writing answers from scratch.
It is important not to fool yourself: “to the requirements” means that the ISMS genuinely works. If it is only a set of policies nobody follows, the first serious customer audit will reveal it.
A good compromise is to implement the ISMS in a way that keeps certification possible within a few months, should a customer appear who needs it. Then the decision to certify becomes a commercial project rather than an urgent one.
Stages and realistic timeline
For a small company starting from zero, the path to a certificate usually takes from six to twelve months. Here are the stages and their approximate duration in our experience.
Scoping and gap analysis (2 to 4 weeks)
You define what falls within the ISMS: the whole company or only one service, which offices, systems and suppliers. Then the current state is compared with the requirements of the standard. The result is a clear list of what is missing.
Risk assessment and control selection (4 to 6 weeks)
An asset register is built, risks are assessed, controls are selected and a statement of applicability is prepared. This is the most important stage, because it determines how many documents and technical measures will be needed. We often carry out the risk assessment as a separate piece of work, even if the company has not yet decided on certification.
Documentation and implementing measures (2 to 4 months)
Policies and procedures are written and technical measures are implemented: multi-factor authentication, endpoint protection, backup separation, access reviews, log collection. Most of the work here falls to the IT provider.
Operating period (at least 2 to 3 months)
The certification auditor will check records: the incident log, access reviews, training records, management review results. The records have to accumulate, so the ISMS must run for some time before the audit. This stage cannot be shortened.
Internal audit, management review and certification audit (1 to 2 months)
An internal audit is carried out, management reviews the system and makes decisions, and then the two-stage certification audit takes place: documentation and operation. After a successful audit, the certificate is issued for three years with annual surveillance audits.
The most common mistakes
First, document templates are bought and simply renamed. Within half an hour the auditor sees that the policy mentions departments the company does not have. Second, the scope is chosen too wide. If the certificate is needed for one service, there is no need to include the whole company in the ISMS. Third, management takes part only by signing. The standard requires a management review with real decisions, and the auditor will question the CEO in particular. Fourth, the technical part is left for the last month, although separating backups or sorting out access can take longer than the documents.
What the IT provider does and what the company does
A clear division of work saves the most time.
The IT provider: implementing technical controls and their evidence, backup and restore tests, vulnerability management, access administration, log collection, technical policies and procedures, preparation for the technical part of the audit. If IT support is already outsourced, most of these should be part of the IT support service.
The company itself: decisions on scope and risk appetite, appointing information owners, employee training and its records, HR procedures (hiring, offboarding, confidentiality), supplier contracts, management review. The provider cannot do these for you, because the auditor will check that the company manages its own security.
Where to start
- Ask yourself who needs the certificate. If there is a specific customer or tender, note its deadline: you will count backward from it.
- Set the scope as narrow as possible while still being meaningful to the customer.
- Order a gap analysis and a risk assessment. This will give you a real list of tasks and a duration instead of guesses.
- Fix the technical foundations right away, without waiting for documents: authentication, protection, backups.
- Appoint a responsible person inside the company. If there is no one, a CISO as a Service makes sure the ISMS has an owner without an additional hire.
Our team, which holds current ISACA certifications, helps both with certification and with simply putting security in order to the requirements. In the first conversation we will honestly tell you which path makes more sense in your case.
