ISO 27001 without a security team: what a small company has to decide, build and run

Yes, a company with no security team can get ISO 27001 certified. The standard certifies a working management system, not a security score, and scales to your size and risk. What you cannot outsource is a named owner and five decisions. From an unmanaged start, a company of 20 to 250 people should plan for nine to twelve months.

This guide covers who does what, the five decisions only you can make, what to build, the 93 controls, recent changes, the timeline, where small companies get stuck and what the certificate leaves open.

Work	Who does it
Deciding scope, what you protect and what you will not do	You. Consultants and platforms cannot make these calls.
Owning security	One named person, with the authority to say no and the time to do the work
Accepting risk	Someone at the right level of seniority, explicitly and with a reason
Producing policies and other documents	Consultants or platforms can, but staff must acknowledge the policies
Internal audit	You, checking yourself before the auditor does
Management review	Leadership, formally looking at the results
Certification audit	The auditor, testing whether the system exists and runs

What does ISO 27001 actually certify?

If you are the CTO who also owns the roadmap, the infrastructure and half of support, this is the thing to understand before you spend any money.

ISO 27001 does not certify that your company is secure. It certifies that you have a working system for deciding what needs protecting, choosing what to do about it, doing it, checking that it happened, and fixing it when it did not. An auditor is not testing your firewall. They are testing whether the machine that is supposed to look after your firewall exists and runs.

That has two consequences. The good one: a small company can pass, because the standard scales to your size and risk. The uncomfortable one: you can pass while leaving real weaknesses in place, as long as you decided about them deliberately and wrote the decision down. The last section comes back to that.

What decisions can’t a consultant make for you?

Consultants and platforms can produce documents. They cannot make these five calls, and every project that drifts is one where they were left open.

What is in scope. Which parts of the company, which systems, which locations and which services the certificate covers. This decision drives cost more than anything else. It also decides whether the certificate answers the question your customer is actually asking.

What you are protecting, and from whom. Not a generic threat list. What would genuinely hurt this business: your source code leaking, a four-day production outage, a customer data breach, a payment fraud, a key person leaving with the only copy of something.

Who owns security. A named person, with the authority to say no and the time to do the work. The standard requires top management commitment, and it is the requirement companies fake most often.

What risk you accept. Every organisation accepts risk. ISO 27001 only asks that you do it explicitly, at the right level of seniority, with a reason.

What you will not do. The unglamorous half. If you are not going to run a formal secure development lifecycle this year, say so and say why, rather than writing a policy that describes a company you are not.

If you want a structured version of these five before committing budget, that is what an independent vCISO Security Audit is for. It produces the decisions, the ranked gaps and the roadmap, and it is useful whether or not you ever certify.

What documents and records does ISO 27001 require?

Strip away the jargon and the standard requires a fairly short list of things to exist and stay alive:

• A defined scope. One or two paragraphs, plus a boundary you can defend.
• A risk method and a risk register. A repeatable way to identify, rate and treat risks, and the record of having done it. Not a spreadsheet written once in March.
• A Statement of Applicability. Every control from Annex A, marked applicable or not, with a justification. It is the document auditors read first, which is why we wrote scope and Statement of Applicability without the jargon.
• Policies that people have actually accepted. Written, approved, versioned and acknowledged by staff. An unread policy is a finding waiting to happen.
• Evidence that controls operate. Access reviews with dates, backup restore tests with results, joiner and leaver records, patch records, supplier reviews.
• Internal audit and management review. You check yourself before the auditor does, and leadership formally looks at the results.
• Corrective action. When something fails, there is a record of what you did about it.

Most of that is record keeping rather than technology. That is the honest shape of the work.

How many controls does ISO 27001 have, and do they all apply?

The 2022 edition lists 93 controls in Annex A, grouped into four themes: organisational, people, physical and technological. The 2013 edition had 114, so the standard got shorter, not longer, mostly by merging overlapping items.

Two things make the number less alarming:

1. A meaningful share will not apply to you, and saying so in writing is a legitimate answer.
2. Many are things you already do informally. You already onboard people, keep backups and restrict who can reach production. The work is usually formalising and evidencing what exists, not building from nothing.

Eleven controls were new in 2022. They catch small companies out because they were never part of the old muscle memory: threat intelligence, information security for cloud services, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering and secure coding. If you are a software company, configuration management, secure coding and monitoring are where you will spend real effort.

What has changed in ISO 27001 recently?

Four points matter in practice.

The 2013 edition is gone. The transition window closed on 31 October 2025. Every audit now runs against the 2022 controls, so any template, policy pack or consultant deliverable that references the old numbering is out of date. Check this before you pay for anything.

Climate now sits in the context clauses. Amendment 1 to the standard added climate considerations to the clauses about your context and your interested parties. You have to consider whether environmental conditions are relevant to your information security, and record the conclusion either way. For most software companies the honest answer is a short paragraph about the physical resilience of the facilities you depend on. It is a documentation requirement, not a green transformation.

Changes have to be planned. Clause 6.3 requires you to plan changes to the management system rather than letting it drift. It is the clause that stops your ISMS from being accurate in month one and fiction in month fourteen.

Auditors want records, not snapshots. The emphasis has moved from whether a policy exists to whether a control demonstrably ran. The evidence expected is typically several months of operational records, not a snapshot assembled the week before the audit. Plan for that from the start, because retrofitting six months of evidence is impossible.

How long does ISO 27001 take without a security team?

For a company of 20 to 250 people with no security team, working steadily rather than heroically:

Phase	Duration
Scoping, risk assessment and Statement of Applicability	4 to 8 weeks
Closing the gaps that matter	2 to 5 months
Running the system long enough to have evidence	3 months minimum, 6 is more comfortable
Internal audit and management review	2 to 4 weeks
Stage 1 and Stage 2 audits	A few weeks apart, plus time to clear findings

Closing the gaps varies most, because it depends on how much real work the assessment turns up. Nine to twelve months is a realistic first certification for a company starting from a normal, unmanaged position. Anyone promising three months is either selling you a very narrow scope or planning to assemble evidence rather than generate it. On what this costs and where the money actually goes, see whether €50k for ISO 27001 is worth it.

Where do small companies get stuck with ISO 27001?

Four patterns, in the order we see them.

The scope was drawn to make the audit easy, not to answer the customer. The certificate arrives, the customer reads the scope statement and asks why their service is not in it. Now you are doing it twice.

Nobody owns it after the kick-off. The project has energy for six weeks, then the CTO gets a product deadline. The single strongest predictor of a project that stalls is that security ownership was never anybody’s actual job.

Evidence was never a habit. Controls were designed, but nothing records them running, so the month before the audit becomes an archaeology exercise.

Suppliers were left to the end. Your vendor list is longer than you think, and the standard expects you to have assessed and monitored the ones that matter. The same problem shows up under other regimes, as covered in supply chain security and vendor risk.

If NIS2 is landing at the same time, do the work once. The overlap is large, as set out in certification standards and ISO 27001 under NIS2. What regulation asks of smaller companies more broadly is in NIS2 for SMEs. The whole ISO 27001 route is on our ISO 27001 solutions page.

What does an ISO 27001 certificate not cover?

ISO 27001 verifies that your controls were selected deliberately and operate as described. It does not verify that they are sufficient against a competent attacker. Those are different tests, and the gap between them is where breaches at certified companies happen.

A company can hold a valid certificate while:

• multi-factor authentication is enabled but not enforced on the legacy path everyone actually uses,
• backups run and are tested by confirming the job succeeded, never by restoring a system end to end under time pressure,
• logs are collected but nobody looks at them, because the control said collect, not detect,
• a dependency with a known critical vulnerability sits in production because the patch window was documented as quarterly and that was the accepted decision,
• an offboarding checklist is signed while the person’s tokens and shared credentials remain valid.

Every one of those passes an audit. Every one of those is exploitable.

Closing them is a different kind of work: enforcing rather than enabling, restoring rather than checking the job status, alerting on the log rather than storing it, and shortening the patch window for the things actually exposed. It is not more paperwork. It is the operational half that the certificate does not ask for and an attacker does not skip.

So treat certification as the deadline that gets budget approved, and the gap list underneath it as the thing you are actually buying. Get the certificate. Then keep going, because the certificate is the floor, not the ceiling.

ISO 27001 checklist for a company without a security team

• Name one owner, with the authority to say no and the time to do the work.
• Draw the scope around the question your customer is asking, not around an easy audit.
• Write down what you are protecting, what risk you accept and what you will not do this year.
• Check that any template or policy pack uses the 2022 controls, not the 2013 numbering.
• Record evidence from the start: access reviews, restore tests, joiner and leaver records, patch records.
• Assess the suppliers that matter early, not at the end.
• Keep working the gap list after the certificate arrives.

Frequently asked questions