ISO 27001
A lean ISMS is still a real ISMS. Here is where the fat comes off.
A twenty-person company can certify. What it cannot do is run the same paperwork as a bank. The standard asks you to be proportionate, and that word is your best tool: small scope, short documents, controls sized to real risk. Some things, though, no auditor will waive, whatever your headcount.
Back to ISO 27001 services01 · Scope small
Draw the boundary around what customers buy
The smallest honest scope is the one that covers the product under review.
Most startups are asked for ISO 27001 because a buyer wants assurance about one product. Scope the ISMS to that product, the people who build and run it, and the cloud accounts it lives in. Leave out what customers never touch only if you can explain the interfaces between inside and outside.
Illustrative: a 20-person SaaS company
Scope: the customer platform, its production cloud account, the engineering and support teams, and the laptops they use. Out of scope: a marketing site on a separate host with no customer data. The scope statement names that site and says why it is excluded.
02 · Skip, shrink, keep
Lean but legitimate: what to skip, shrink and keep
Cut volume, never the mandatory elements.
| Item | Decision | How it looks in a small company |
|---|---|---|
| Physical controls for offices you do not own | Shrink | Mark controls not applicable in the SoA with a reason; keep the ones that cover laptops and home working |
| Separate policy per Annex A control | Skip | A short top-level policy plus a handful of topic policies grouped by subject |
| Risk methodology | Shrink | Two pages: scales, how risks are scored, who accepts them |
| Risk register | Keep | Every material risk, owner, treatment and status, kept current |
| Statement of Applicability | Keep | All 93 controls, applicability and a reason for each exclusion |
| Internal audit | Keep | An independent person, possibly external, covering the whole ISMS |
| Management review | Keep | A short meeting with the inputs the standard lists, minuted |
| Committees and steering groups | Skip | The founders' weekly meeting can carry security items, if minuted |
| Bespoke security platform | Skip at first | Shared drives and a ticket tracker are enough until volume grows |
03 · Documents
Documents sized to be read
If staff will not read a policy, the auditor will notice.
Clause 7.5 says the amount of documented information depends on the size of the organisation and the complexity of its work. A startup can rely on that. What auditors look for is control of documents: a version, an approver, a review date and evidence that people saw it. Short documents with all four beat long ones with none.
- Scope statement
- Security policy
- Risk method
- Risk register
- Risk treatment plan
- SoA
- Objectives
- Competence records
- Internal audit report
- Management review minutes
- Corrective actions
04 · Owner and tools
Who owns it, and what tools you need
One named owner with time set aside, and tools you already have.
- ISMS owner
- Often the CTO or a senior engineer, with a few hours each week reserved for it. The role must be written down and backed by a founder.
- Top management
- The founders. They approve the policy, attend the management review and accept residual risk.
- Control owners
- The people who already do the work: whoever manages the cloud accounts owns access and logging; whoever hires owns people controls.
- Tooling
- A document store with version history, a ticket tracker for risks and findings, your identity provider's reports and your cloud provider's logs. A compliance platform can help with evidence later; it is not a requirement.
05 · Free first steps
Work you can do before spending anything
Most of the foundation is decisions, not purchases.
- Turn on multi-factor sign-in everywhere. Identity provider, cloud console, code host, email.
- List your assets. Systems, data stores, laptops and the suppliers that touch customer data.
- Write the scope statement. One page. It shapes every later decision.
- Run a first risk session. Two hours with the founders and engineering leads, recorded in a spreadsheet.
- Start an access review. Who has production access, and should they? Record the answer and the date.
- Collect supplier assurance. Download your main providers' certificates or reports and note what they cover.
06 · Never waived
What no auditor will waive for a small team
Clauses 4 to 10 apply in full. Size changes the scale, not the list.
- No independent internal audit. The ISMS owner cannot audit their own work. Bring in an outside person if nobody internal is independent.
- Management review never held. A Stage 2 without one is a likely major nonconformity.
- Risk register written once. It must change when the business does: new product, new supplier, new office.
- Controls on paper only. A policy saying access is reviewed quarterly needs four dated reviews over a year.
- SoA exclusions without reasons. Every not-applicable control needs a justification an auditor can test.
Sources: ISO/IEC 27001:2022 clause titles 4 to 10, including 7.5 on documented information, and the count and names of Annex A controls (titles only; the standard's text is not reproduced). The scenario is illustrative.
Questions from small teams
Is ISO 27001 overkill for a company our size?
Not if a buyer is asking for it. Size the ISMS to you.
The standard is written for organisations of any size. The work becomes overkill only when a startup copies an enterprise template. Keep the scope tight and the documents short, and the effort tracks your real risk.
Do we need a full-time security hire?
Usually not at first. You need a named owner with time.
Many small companies run the ISMS with a part-time internal owner and outside help for the internal audit and testing. The auditor checks that responsibilities are assigned and competent, not that a job title exists.
Can we exclude most of Annex A because we are small?
No. Exclusions follow risk and context, not headcount.
Controls are excluded only when they do not apply, such as physical controls for premises you do not have. Access, logging, backup and supplier controls almost always apply to a software company of any size.
Does a compliance platform make us certifiable?
No. It organises evidence; people run the controls.
Tools can collect evidence and send reminders. The certification body still audits whether your people make risk decisions, review access and act on findings. A tool with stale data is a liability at audit.
Start lean, pass the audit.
An ISO 27001 gap analysis from Auditify sizes the ISMS to your team and shows which mandatory pieces are missing.