ISO 27001 certification for SMBs: a realistic path at your size.
Customers or tenders asking for ISO 27001? Get certified without enterprise-sized paperwork.
Does it apply to you?
Do your customers or contracts ask for it?
ISO 27001 is voluntary. Companies get it because the people they sell to ask for it. Yes to any of these: it is worth a closer look.
- A tender or a large customer requires itMany enterprise and public buyers list it as a minimum supplier requirement, sometimes before they read your offer.
- You supply banks, insurers or healthcareThey must check their suppliers’ security, and a certificate answers most of their questions at once.
- You answer long security questionnairesA certificate answers many of those questions in one go, and makes renewals faster.
- Your insurer asks about security governanceCertification is a clear way to answer at renewal.
What changes for you
A security management system, not a technical checklist.
ISO 27001 certifies how you manage security. You assess your risks, choose measures to match, write down who does what, and check that it works. An accredited certification body audits you; the certificate lasts three years, with a check every year.
For a small company it is mostly a matter of method, not of buying tools. The paperwork stays proportionate: a 15-person firm does not need the policies of a 500-person manufacturer.
The real cost of not having it is commercial: lost tenders and slower sales to larger customers. The same work also gives you a strong base for NIS2, DORA and the security side of GDPR.
What to do first
Start with where you stand, then build only what you need.
What we deliver
- A review of where you stand against the standard, with a costed plan to certification
- Your risk assessment and the security measures chosen to match it
- Policies people will actually read and follow
- An internal audit before the certification body arrives
- Help choosing the certification body, and support through both audit stages
Who does what
We lead the certification work. Your IT provider keeps the technical side.
What we lead
- Set the scope and lead the risk assessment
- Write the policies and the list of chosen measures
- Train your staff and management
- Lead the internal audit
- Prepare you for the certification audits
What stays with your IT provider
- Set up the technical measures: access rights, backups, logging, updates
- Keep the records the auditor will ask for
- Fix the technical findings
Your consultant holds the ISO 27001 Lead Auditor (PECB) and Lead Implementer (Advisera) certifications.
How it starts
Your first step: a review of where you stand.
You learn what the standard asks of a company your size, what is missing, and what certification would cost in time and money. Not sure you are ready? Start with the Cyber Maturity Check-Up (from €1,900): its fee is deducted if you continue within 60 days.
For your IT manager, DPO or CFO
What every ISMS must demonstrate.
- 01Clause 4
Context of the organisation
Understanding your business environment, interested parties, and the ISMS scope.
- 02Clause 5
Leadership
Management commitment, the security policy, and assignment of roles and responsibilities.
- 03Clause 6
Planning
Risk assessment, risk treatment plan, and information security objectives.
- 04Clause 7
Support
Resources, competence, awareness training, communication, and documented information.
- 05Clause 8
Operation
Implementing the risk treatment plan, managing operational security processes and changes.
- 06Clause 9
Performance evaluation
Monitoring, measurement, internal audit (mandatory), and management review.
- 07Clause 10
Improvement
Addressing non-conformities, corrective actions, and continual improvement of the ISMS.
- 08Annex A
93 controls across 4 domains
Organisational (37), people (8), physical (14), technological (34). Selected and justified in your Statement of Applicability.
No statutory penalties — but commercial cost compounds.
ISO 27001 is voluntary, so there are no statutory fines for non-certification. The cost of lacking certification, however, compounds: disqualification from procurement tenders, inability to meet client security requirements, loss of enterprise clients in regulated sectors, higher cyber-insurance premiums and reduced coverage, and inability to supply regulated financial institutions or public sector buyers.
Certified organisations also reuse ISO 27001 as the foundation for NIS2, GDPR Article 32, DORA and PCI DSS work — controls built once, evidence reused — which makes it the most cost-effective single foundation for a multi-framework programme.
NIS2
Much of Art. 21
met by a well-scoped ISMS; NIS2-specific duties remain.
GDPR Art. 32
Supports
the technical and organisational security measures GDPR requires.
DORA
Foundation
for ICT risk management; register, TLPT and 4-hour reporting are extra.
Typical timeline
6–12 months for most SMBs starting from a low baseline. Existing controls or prior compliance work make this faster.
Weeks 1–4
Gap analysis
Current state vs ISO 27001 requirements, ISMS scope definition, prioritised costed action plan.
Months 2–5
ISMS build
Risk assessment, treatment, policies, controls, Statement of Applicability, training program rollout.
Month 6
Internal audit
Independent internal audit against all clauses and selected Annex A controls. Corrective actions resolved.
Months 7–9
Certification audit
Stage 1 (document review) then Stage 2 (on-site assessment) with your chosen accredited certification body.
FAQ