Most small business owners assume ISO 27001 is built for large corporations with dedicated security teams and six-figure budgets. That assumption costs them contracts. We’ve seen it firsthand, companies losing deals because a prospective client or supply chain partner asked for proof of ISO 27001 for small businesses, and they had nothing to show. The truth is, the standard was designed to scale. A 15-person company can achieve certification just as legitimately as one with 1,500 employees, and often faster than they expect.
At TrustedIA, we’ve spent over 30 years helping organisations build and maintain strong security postures, and ISO 27001 implementation is one of our core specialisms. We’ve guided small businesses through every stage of the process, from initial gap analysis to successful certification, so we know exactly where teams get stuck, what it actually costs, and how long the timeline realistically takes.
This guide breaks it all down. You’ll learn whether certification makes sense for your organisation, what steps are involved, how to budget for it, and what kind of timeline to plan around. No jargon, no fluff, just the practical detail you need to make an informed decision and move forward with confidence.
What ISO 27001 requires from small businesses
ISO 27001 requires you to build, operate, monitor, and continually improve an Information Security Management System (ISMS). An ISMS is a documented set of policies, processes, and controls that governs how your organisation handles information security. The standard does not prescribe a fixed list of technology tools or a minimum headcount. What it demands is evidence that you’ve identified your risks, made deliberate decisions about how to treat them, and can demonstrate that your controls are working.
The three things the standard actually measures
The auditor who visits your site is looking for three things: documented intent (your policies and procedures), evidence of operation (records showing the processes actually run), and a cycle of improvement (internal audits, management reviews, and corrective actions). A small business can satisfy all three without a full-time security team. What you need is a clear owner, consistent record-keeping, and a realistic scope that reflects your actual operations.
The standard rewards structure and evidence, not size. A well-run 10-person company with clean documentation will pass where a disorganised 200-person company fails.
The Annex A controls: applicability, not completeness
ISO 27001:2022 includes 93 controls across four themes: organisational, people, physical, and technological. You do not need to implement all of them. The standard requires you to produce a Statement of Applicability (SoA), which lists each control, states whether it applies to your organisation, and justifies that decision. If a control is not relevant to your scope, you exclude it with a written reason and move on.
For a small business, a typical SoA might apply 60 to 75 of the 93 controls. A software company with no physical product line, for example, would likely exclude controls related to physical goods logistics. The SoA is one of the most important documents in your ISMS because it becomes the basis for everything your auditor checks during the certification audit.
What your ISMS documentation needs to include
The standard specifies a set of mandatory documented information that every certified organisation must maintain, regardless of size. The list below covers the core required documents:
- Information security policy – your top-level statement of intent signed off by leadership
- Risk assessment and risk treatment process – how you identify, score, and handle threats
- Statement of Applicability – which Annex A controls you’ve included or excluded and why
- Risk treatment plan – the specific actions you’ve committed to take
- Information security objectives – measurable targets tied directly to your policy
- Evidence of competence – training records, qualifications, and role descriptions for relevant staff
- Internal audit programme and results – scheduled reviews of whether your ISMS is functioning
- Management review records – documented leadership sign-off on ISMS performance
- Corrective action records – how you’ve identified and resolved non-conformities
You don’t need a dedicated document management platform to hold all of this. Many small businesses pursuing ISO 27001 for small businesses certification start with a well-structured folder in SharePoint or Google Drive. What matters is that documents are version-controlled, accessible to the right people, and reviewed on a defined schedule.
Costs and timeline for UK SMEs
The total investment for ISO 27001 for small businesses depends on three variables: your current security baseline, whether you use a consultant, and which certification body you choose. A business starting from scratch will spend more than one that already has documented policies and basic controls in place. Smaller organisations typically spend significantly less than the figures quoted for enterprise-level implementations, and scoping the project tightly is one of the most effective ways to keep costs under control.
What you’ll spend
For a UK SME with between 10 and 50 staff, the realistic cost breakdown looks like this:
| Item | Estimated cost (GBP) |
|---|---|
| Gap analysis and readiness assessment | £1,500 – £4,000 |
| Consultant support (if used) | £5,000 – £20,000 |
| Internal staff time | Variable |
| Certification body fees (Stage 1 + Stage 2 audit) | £3,000 – £8,000 |
| Annual surveillance audits | £1,500 – £3,500 per year |
| Total first-year estimate | £10,000 – £35,000 |
These figures assume you’re not rebuilding your IT infrastructure from scratch or deploying enterprise security tooling across the board. Many SMEs land at the lower end of the range by assigning a dedicated internal project owner, using existing platforms they already pay for such as Microsoft 365 for document management, and bringing in a consultant selectively for the areas where specialist input adds the most value rather than outsourcing the entire project.
How long it takes
Most small businesses achieve certification within six to twelve months of formally starting the project. The variation comes down to how quickly your team can produce and evidence the required documentation, and how many gaps your initial risk assessment uncovers. Resourcing is usually the limiting factor, not the complexity of the standard itself.
If you already have basic security policies in place, you can realistically target the six-month end of the range. Starting from nothing, plan for nine to twelve months.
A typical timeline for a UK SME breaks down as follows: spend one to two months scoping the ISMS and completing a gap analysis, two to four months building documentation and implementing controls, one to two months running the ISMS to generate operating evidence, then book your Stage 1 and Stage 2 audits. Always choose a certification body accredited by UKAS (the United Kingdom Accreditation Service), as UKAS-accredited certificates carry the most weight with clients, insurers, and procurement teams.
Step 1. Define your ISMS scope
Scope defines the boundaries of your ISMS, and getting it right at the start saves you significant time and money later. A scope that is too broad pulls in systems, processes, and locations that don’t need to be certified, which inflates your documentation workload and makes audits more complex. For ISO 27001 for small businesses, the most practical approach is to start with the part of your business that handles the most sensitive information, or the function your clients care most about, and build outward only if you need to.
How to write your scope statement
Your scope statement is a formal documented declaration that tells your auditor exactly what your ISMS covers. It must reference the organisational context, the physical and virtual locations involved, and the information assets included. A vague statement like "all IT systems" will not satisfy an auditor. Your scope needs to be specific enough that someone unfamiliar with your business could read it and understand precisely what is and is not included.
Here is a practical scope statement template you can adapt directly:
"The ISMS covers the [department or function] of [Company Name], operating from [location(s)], and includes all systems, processes, and personnel involved in [specific activity, e.g., the development and delivery of cloud-hosted software to external clients]."
What to include and exclude
When you define what falls inside your scope, focus on the assets that process, store, or transmit information your clients or regulators care about. Think customer data, financial records, intellectual property, and any systems that connect to third-party networks or supplier environments.
Exclusions matter just as much. If your finance function runs on a completely separate system with no connection to your core service delivery, you can reasonably exclude it, but you must document the justification clearly in your scope definition. Auditors will challenge any exclusion that appears to reduce your obligations without a logical reason behind it.
Before you write the final statement, map your key information flows through the business. List where data enters your organisation, where it is processed, where it is stored, and where it exits. Anything that touches that flow belongs inside your scope.
Step 2. Assess risk and write the SoA
Risk assessment is the engine that drives every decision inside your ISMS. Once your scope is defined, you identify the information assets within that scope, determine what threats they face, score those threats by likelihood and impact, and then decide what to do about each one. The output of this process directly shapes which Annex A controls appear in your Statement of Applicability, so getting the methodology right matters from the start.
How to run your risk assessment
Your risk assessment needs a consistent, repeatable scoring methodology that you document and apply the same way every time. A spreadsheet works well for most small businesses at this stage. For each asset, record the threat, the existing controls already in place, and then assign a likelihood score and an impact score on a scale of one to five. Multiply them together to get a risk score, then set a threshold above which you must take action.
Use this template as your starting structure:
| Asset | Threat | Existing Control | Likelihood (1-5) | Impact (1-5) | Risk Score | Treatment |
|---|---|---|---|---|---|---|
| Customer database | Unauthorised access | Password policy | 3 | 5 | 15 | Mitigate |
| Staff laptops | Theft or loss | Full-disk encryption | 2 | 4 | 8 | Accept |
| Email system | Phishing attack | Spam filtering | 4 | 4 | 16 | Mitigate |
The four treatment options are accept, mitigate, transfer (such as through cyber insurance), or avoid. Every risk above your threshold needs a documented treatment decision.
Writing your Statement of Applicability
The SoA connects your risk treatment decisions to the 93 Annex A controls in ISO 27001:2022. For each control, you state whether it applies, why you have included or excluded it, and whether it has been implemented or is planned for implementation. For iso 27001 for small businesses, this document is one your auditor will scrutinise closely at both Stage 1 and Stage 2, so treat it as a live record rather than a one-time exercise.
Work through the controls systematically and in order. Where a control addresses a risk identified in your treatment plan, include it. Where it genuinely falls outside your scope, exclude it with a specific written justification that references your operations, not a vague phrase like "not applicable." Auditors expect a reasoned explanation, and a single clear sentence is enough to satisfy that requirement.
Step 3. Implement controls and run the ISMS
With your SoA finalised, you move from planning into active implementation. This is where most small businesses stall, not because the work is technically difficult, but because it spreads across multiple people and competes with day-to-day operations. The practical answer is to sequence your implementation by risk score, starting with the highest-scoring risks from your treatment plan and working down, rather than trying to implement every selected control simultaneously.
Prioritise by risk score
Build a simple implementation tracker that maps each control to the risk it addresses, assigns an owner, sets a target completion date, and records the current status. Review it in a short weekly check-in with whoever owns the ISMS project. This keeps momentum visible and surfaces blockers early, before they delay your audit booking.
Use this tracker format as your starting template:
| Control Ref | Control Description | Risk Addressed | Owner | Target Date | Status |
|---|---|---|---|---|---|
| A.8.2 | Privileged access rights | Unauthorised system access | IT Lead | Month 2 | In progress |
| A.6.3 | Information security awareness | Phishing | HR | Month 3 | Not started |
| A.8.12 | Data leakage prevention | Data exfiltration | IT Lead | Month 4 | Not started |
For iso 27001 for small businesses, a tracker like this in a shared spreadsheet is enough at this stage. You do not need dedicated project management software to run a credible implementation.
Keep your operating records clean
Once a control is implemented, your job is to generate evidence that it is running consistently. This is the part most small businesses underestimate. An auditor does not take your word that a process exists. They ask to see records: access review logs, training completion records, patch management reports, incident logs, and internal audit results. Build the habit of saving these records as you go, not retrospectively before the audit.
Your internal audit must run at least once before your Stage 2 certification audit. Schedule it roughly four to six weeks before your audit date so you have time to address any non-conformities it surfaces. Treat the internal audit as a genuine test, not a box-ticking exercise. Corrective actions raised and closed before the external auditor arrives demonstrate exactly the kind of continual improvement cycle the standard is designed to verify.
Step 4. Pass the certification audit
The certification audit runs in two distinct stages, and understanding what each covers takes most of the uncertainty out of it. Stage 1 is a documentation review. Stage 2 is a live assessment of whether your ISMS is actually operating as described. Both stages are conducted by an auditor from your UKAS-accredited certification body, and both can be delivered on site or remotely depending on your preference and the body you choose.
What to expect at Stage 1
Stage 1 is a desk-based review of your core ISMS documentation. Your auditor will examine your scope statement, risk assessment, SoA, policies, and management review records to check that the system is designed correctly before they assess whether it is running. This stage typically takes half a day to a full day for a small business and is often conducted remotely via video call with screen sharing.
Your auditor will produce a Stage 1 report that flags any areas needing attention before Stage 2. Treat every point in that report as mandatory, even the minor observations, because unresolved issues from Stage 1 carry forward and will be checked again during the on-site visit.
What to expect at Stage 2
Stage 2 is where the auditor tests whether your controls are actually working in practice. They will interview staff, request evidence records, and walk through your key processes. For iso 27001 for small businesses, this stage usually runs between one and two days, either on site or via a structured remote session.
Prepare a short briefing for any staff the auditor is likely to speak with. They do not need to memorise the standard, but they should understand their role in the ISMS and be able to point to the records they produce.
Before Stage 2, run a final check against your SoA and implementation tracker to confirm every included control has at least one piece of supporting evidence ready to present.
How to handle non-conformities
Non-conformities fall into two categories: major and minor. A major non-conformity means a required element of the standard is missing or completely ineffective, and your certificate cannot be issued until it is resolved. A minor non-conformity is a gap in implementation that you address within an agreed timeframe, typically 90 days, after which the auditor reviews your corrective action and closes it out.
Most small businesses who have followed the earlier steps arrive at Stage 2 with minor non-conformities at most. The key is treating your internal audit seriously enough to surface those gaps yourself before the external auditor does.
Where to go from here
You now have the full picture on ISO 27001 for small businesses: what the standard demands, what it costs, and the four steps that take you from a blank scope document to a UKAS-accredited certificate. The process is structured and achievable for a small team, provided you commit a named owner, keep your records clean, and treat the internal audit as a genuine test rather than a formality.
Getting started is the part most businesses delay longest. Pick a defined scope, run a gap analysis against your current documentation, and set a realistic target date for your Stage 1 audit. If you want expert support at any stage, from your initial readiness assessment through to certification and beyond, TrustedIA’s ISO 27001 managed services give you access to over 30 years of hands-on implementation experience, without the overhead of building that expertise entirely in-house.
