SME: articles and guides.
Every CloudSoul article on SME, newest first.
vCISO first 90 days: the plan for a part-time security owner
A vCISO or part-time security owner's first 90 days should produce four things you can prove, not forty policies. The six fifteen-day phases, what to refuse, and the four yes-or-no tests that tell you at day 90 whether it worked.
ISO 27001 and ISO 9001: what you can reuse, what is new, and how to run one integrated system
ISO 9001 and ISO 27001 share the Harmonized Structure, so a quality system already runs most of what ISO 27001 needs. What transfers, what is new (risk treatment, the SoA, 93 controls), how integrated audits and audit time work, and what ISO 9001:2026 changes.
Who is responsible for cybersecurity in an SME? (and when a vCISO makes sense)
Management is accountable, and one named person has to own the decisions. NIS2 puts approval and oversight on the management body, ISO 27001 requires the roles to be assigned, and neither requires a CISO. Where the job lands by default, what it involves, and when a vCISO fits.
How to answer a customer security questionnaire: CAIQ, SIG, VSA and the three questions behind them
Answer the three questions behind every row once, from a library keyed to your controls. A CAIQ of around 260 questions then takes 2 to 4 days, not 2 to 3 weeks. The formats, why inconsistent answers lose deals, what ISO 27001 pre-answers and what to ask back.
ISO 27001 certification cost for SMEs (2026): audit fees, consultants and the costs nobody quotes
For a company of 26 to 125 people, ISO 27001 costs roughly €50,000 to €150,000 in year one, all in. The certification audit is the smallest line. Every cost, the three-year view, and where the money is wasted.
ISO 27001 without a security team: what a small company has to decide, build and run
A small company with no security team can pass ISO 27001, because it certifies a management system, not a security score. Who does what, the decisions only you can make, the documents and 93 controls, a nine-to-twelve-month timeline, and what the certificate leaves open.
Does NIS2 apply to SMEs? Who is in scope, and what smaller suppliers still have to do
NIS2 applies to medium-sized and large companies in the sectors it lists: 50 or more employees, or more than EUR 10 million in both turnover and balance sheet. Small companies are mostly out of scope, but their NIS2-regulated customers pass the requirements on.
NIS2 for the food sector: which food businesses are in scope (wholesale, processing, production)
NIS2 covers food businesses engaged in wholesale distribution and industrial production and processing, if medium-sized or larger. Who is in and out, from dairies and drinks makers to retailers, restaurants and farms, essential or important, and what applies.
Is ISO 27001 worth it? When the certificate pays for itself, and when it does not
ISO 27001 is worth it when a tender or a customer already asks for it, or when NIS2 applies to you: the certificate is then a cost of revenue. What it buys, how to weigh the €50,000 to €150,000 first year, when it is not worth it yet, and how to get the same result for less.