Can a small business get ISO 27001 certified?
Yes. ISO 27001 applies to organisations of any size, from a five-person consultancy to a multinational. The requirements are the same, but a small business can meet them with a proportionate information security management system (ISMS): fewer documents, simpler processes and a tightly defined scope.
Is ISO 27001 worth it for a small business?
It usually is if you sell to larger organisations, the public sector or regulated industries, or if security questionnaires are slowing down your sales. A certificate is independent proof that you manage information security properly, and it often decides whether a smaller supplier gets through due diligence.
How much does ISO 27001 cost for a small business?
Costs have three parts: preparation, the certification body's audit fees and your own team's time. Published market guidance puts the accredited certification audit for a small organisation at roughly £6,000 to £12,000, with preparation ranging from a few thousand pounds for a well prepared business upwards. Cybergen gives you a fixed quote after a gap analysis.
How long does ISO 27001 take for a small business?
A well prepared small business with a clear scope can be ready for certification in three to four months. Five to eight months is more typical, and a business starting from scratch should plan for nine to twelve months. Your ISMS must run long enough to complete an internal audit and a management review before the Stage 2 audit.
Do we need a dedicated information security manager?
No. Most small businesses give the role to an existing person, such as an operations lead, the head of IT or a director, with expert support. Cybergen can also run your ISMS for you as a managed service, so the day-to-day work does not fall on your team.
Can a fully remote business get ISO 27001 certified?
Yes. Remote and hybrid businesses certify regularly. Your scope covers how people work from home, how laptops and cloud services are secured and how you manage suppliers. Physical controls that do not apply, such as a server room you do not have, are justified as excluded in your Statement of Applicability.
Should a small business do Cyber Essentials or ISO 27001 first?
Cyber Essentials is a good first step because it fixes five core technical controls quickly. ISO 27001 goes much further, covering governance, risk, people, suppliers and continual improvement. Many small businesses hold Cyber Essentials Plus first, then build on it for ISO 27001.
How many documents does a small business need for ISO 27001?
Fewer than most people expect. The standard requires a defined set of documented information, such as the ISMS scope, information security policy, risk assessment and treatment results, the Statement of Applicability and evidence that controls operate. A small business can often cover the policy set in a handful of concise documents.
Do we need compliance software to get ISO 27001?
No. Compliance automation platforms such as Vanta or Drata can save time by collecting evidence automatically, and they suit cloud-first technology companies. They are optional. Many small businesses certify with well organised documents and records.
Does Cybergen issue the ISO 27001 certificate?
No. We prepare you for certification and support you through the audits. An independent, accredited certification body carries out the Stage 1 and Stage 2 audits and issues your certificate.
