A Guide to ISO 27001 for Small Businesses

 

Your small business is important. It is in fact essential for continued economic prosperity. About 90% of the world’s companies are small and medium-sized enterprises and they are innovating, stimulating growth and creating employment. According to the Federation of Small Business at the beginning of 2020 there were 5.94 million small businesses. SMEs account for 99.9% of the business population (6.0 million businesses). SMEs also account for three-fifths of the employment and around half of the turnover in the UK private sector.

With many SME’s competing with larger businesses for supplier contracts, especially in the public sector, resilience and differentiation are vital winning factors.   Being small and agile is great, but if you’re competing for tenders or trying to attract more customers, you will need an extra boost.

This is where the International Organization for Standardization (ISO) standards come in. Many believe they apply only to large organisations but ISO certification can provide just as many benefits for smaller businesses – such as helping to improve customer satisfaction, increase sales, assist with marketing, enhance competitive edge, save money and increase turnover.

 

What is ISO 27001?

ISO/IEC 27001:2013 is the international standard that describes best practice for an information security management system (ISMS).

An ISMS is a system of procedures, records, technology and people that helps control, track, audit and improve the information security of your company. Achieving ISO 27001 certification verifies that the information security of your organisation is handled in compliance with international best practice and it gives your customers the reassurance they need to work with you.

The ISO 27001 Information Security Management framework provides small business owners with a means of managing the threats to their business in order to protect processes, infrastructure, data and credibility.

This means that you keep your systems and data (held digitally, on paper and in the cloud) secure from all sorts of threats: external and internal, deliberate and unintentional. It also gives you the peace of mind to know that you have protected your information and that you can keep ahead of new and emerging threats.

 

Why do small businesses need to consider ISO 27001?

As a small business, you know that information security is important and that the implications of a data breach or cyber attack may result in some businesses being closed down. In today’s information-intensive climate, the costs of failure in this field can be substantial in terms of fines, fraud, lawsuits, harm to reputation, loss of trade secrets and intellectual property – the list goes on. This is without mentioning the potential for lost business in the future.

During 2020 we saw a lot of larger companies like BT and Marriot fighting hackers and trying desperately to manage the damage done to their business and reputation. Despite this, many SME IT directors do not see ISO 27001 as relevant to them.

The fact is-hackers and ransomware attacks hit companies of all sizes and as a small business owner, you need to act to reduce security risks.

 

How can ISO 27001 certification help small businesses?

ISO 27001 proves that you are taking information security seriously. As a small business, it is your duty, as it is for big business, to keep people’s information secure. Regardless of ISO 27001 certification, every company needs an ISMS to understand its overall corporate cyber risk, what can be done to manage that risk and how to maintain compliance with data security regulations while giving the company a competitive edge.

Smaller organisations can gain real competitive advantage through IS0 27001 implementation. The main benefits are

• The ability to protect information assets comprehensively and cost-effectively
• Establishes trust with customers, suppliers and stakeholders by providing assurance that data is adequately protected
• Meets the increasing contractual demand from customers to have an ISMS in place
• Reduces the need to be audited by customers – independent ISO 27001 certification is often accepted in place of a customer security audit
• Ensures compliance with many other regulations and legal frameworks like GDPR
• Drives real competitive advantage over other suppliers who aren’t certified – for example, many public sector departments now demand organisations are certified to ISO/IEC 27001 prior to becoming a supplier
• Allows executive management to demonstrate and prove its commitment to information security

 

 

How to implement ISO 27001 into your small business quickly and easily?

There are many do-it-yourself options out there for ISO 27001, promising certification in a matter of days, normally from non-UKAS accredited bodies – and this generally increases customer concerns. These options are limited, often not tailored to the needs of your specific business, or those of your customers. We believe each ISO implementation should be bespoke and developed to ensure maximum effect whilst working closely around the budget and resources available within the business.

We have helped many clients to implement an ISMS, providing training and assisting them to achieve systems certified to ISO 27001. What’s important here is a strong set of security policies which protect client data, managed by the ISMS that complies with ISO 27001.

The main steps to implementing ISO 27001 in a small business are as follows:

• Conduct a comprehensive Gap Analysis to assess the level of compliance of the information security management system (ISMS) against the requirements of ISO 27001.
• Provide an end-to-end plan and roadmap to achieve compliance and/or certification.
• Undertake Risk Management and Analysis to develop an asset register and the information security risk assessments needed, including the production of Statement of Applicability (SoA) – a key requirement of ISO 27001.
• Implement incident management processes to identify – and effectively react to – any cyber security issues that might occur.
• Develop a robust Governance and Compliance structure.
• Review (and if needed draft new) Policies and Procedures and measure their effectiveness and maturity.
• Provide security awareness materials and training for staff, as well as specific training for security roles.

 

 

If you are looking to implement an ISMS and achieve ISO 27001 certification, get in touch with us today and find out how we support small businesses.