ISO 27001 Compliance for Small Business: A Practical Roadmap

What Is ISO 27001?

ISO/IEC 27001 is an international standard that specifies the requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). It defines a risk-based framework for managing information security — covering people, processes, and technology.

ISO 27001:2022 (the current version) contains 93 controls across 4 themes:

Why Small Businesses Need ISO 27001

Three drivers are pushing ISO 27001 compliance into the small business mainstream:

The ISO 27001 Implementation Roadmap for Small Business

1. Define Scope (Week 1)

   Determine which systems, locations, and processes are in scope for your ISMS. For most SMBs, this is the entire organization. Document your scope statement — this becomes the foundation of your ISMS.

2. Perform Risk Assessment (Weeks 2-3)

   Identify information assets, assess threats and vulnerabilities for each, and rate the risk. For SMBs, a simple likelihood and impact matrix is a common starting point; agree the method with your certification body early.

3. Create Asset Inventory (Week 2)

   Document every information asset: hardware, software, data, and cloud services. Use automated IT asset management software (like Sentrivox) to build this inventory rather than creating it manually.

4. Implement Priority Controls (Weeks 3-8)

   Implement the controls that address your highest risks first. Focus on the controls behind asset inventory (A.5.9), vulnerability management (A.8.8) and access (A.5.15, A.8.5) as these typically cover the most critical SMB risks.

5. Write Required Documentation (Weeks 4-10)

   ISO 27001 requires documented policies and procedures for: Information Security Policy, Access Control Policy, Risk Assessment Methodology, Statement of Applicability, and Incident Response Procedure.

6. Conduct Internal Audit (Week 11)

   Perform an internal audit to verify your controls are working as documented. Identify gaps and address them before the certification audit. The internal auditor must be objective and impartial, so use someone outside the work being audited or an external auditor.

7. Management Review (Week 12)

   Senior management must formally review the ISMS performance, risk treatment decisions, and resource allocation. Document this review meeting — the auditor will ask for evidence of management involvement.

8. Certification Audit (Week 13-14)

   Engage an accredited certification body for a Stage 1 (documentation review) and Stage 2 (implementation audit). Be prepared to demonstrate evidence for each control in your Statement of Applicability.

Key ISO 27001 Controls and How to Meet Them

Audit Evidence Checklist for a 50-Endpoint Company

Auditors ask to see that controls run, not just that policies exist. For a company with around 50 endpoints, have these ready before Stage 2:

• Asset register with an owner, location, classification and status for every device, plus the date it was last reviewed (A.5.9). Our free asset register template has these columns.
• Patch reports for recent months showing missing updates per machine and approved exceptions (A.8.8). See the patch compliance report template.
• Hardening results for firewall, antivirus, guest accounts, RDP and SMBv1 settings, and what you did about failures.
• Access reviews: a dated list of who has admin rights and who approved it (A.5.15).
• Vulnerability records: findings, their priority, and when each was fixed or accepted.
• Incident log, even if it only records minor events, and the incident response plan it follows (A.5.24).