Skip to Content
ISO 27001ISO 27001 for small businesses

ISO 27001 for a small business

ISO 27001 is quite feasible for a small business, even with a handful of employees. Expect to pay €11,000 to €30,000 in the first year and a lead time of 4 to 6 months. The international standard for information security  scales with your organisation: a small business has a smaller scope, fewer measures and a shorter audit than a multinational. In the Netherlands, the standard is available from NEN . Want the full picture? Start with what ISO 27001 is and the costs and timeline.

Many small and medium-sized business (SME) owners are put off by stories about thick handbooks and years-long projects. That picture no longer holds for the 2022 version of the standard. A small, workable management system is enough, as long as it fits your risks.

Is ISO 27001 feasible for a small business?

Yes. The standard does not require a full-time security team. What it does require is that you look at your risks systematically and demonstrably take measures. For a business of 5 to 25 people, that is manageable.

The ISMS of a small business often fits in a wiki and a few spreadsheets. One person (for example the director or CTO) is the owner and spends a few hours a week on it. The auditor checks this against the same standard, but in proportion to your size.

A small business does not have to implement all 93 Annex A controls. You select based on your risk assessment and record your choices in the statement of applicability.

What does ISO 27001 cost for a small business?

The figures below apply to a small business (1 to 25 employees) and come from the full cost overview. They are indications; always request quotes.

Cost itemSmall business (1 to 25)
Guidance and advice€5,000 - €15,000
Purchasing the standard€250
Tooling and adjustments€1,000 - €5,000
Certification audit€4,000 - €8,000
Internal audit€1,000 - €2,000
Total first year€11,000 - €30,000
Annual maintenance€4,000 - €8,000

How long does it take for a small business?

A small business is usually ready in 4 to 6 months, provided there is enough focus. The baseline measurement and gap analysis and the risk assessment take the first few weeks. After that, you build your ISMS and run it for at least three months before the auditor comes. The full route is set out in the step-by-step plan.

What can a small business simplify?

You do not need to make it harder for yourself. Three choices make the difference:

  • Limit your scope. Certify only your core activity, for example your SaaS platform, instead of the whole organisation. This lowers costs and complexity. Keep the scope logical and credible.
  • Outsource what you cannot do yourself. An adviser for the risk assessment, or an external party for the mandatory internal audit, saves time and mistakes.
  • Use what you already have. If you work in Microsoft 365 or Google Workspace, a lot of security is already built in. You only need to configure it and document it.

A common mistake at small businesses: downloading a template from the internet and putting your name on it. The auditor will see through this, and it does not match your risks. Always start with your own risk assessment.

When is ISO 27001 worth the investment?

For a small business, the investment mainly pays off when customers or public tenders ask for it. An ISO 27001 certificate then opens doors that would otherwise stay closed. If you supply software or IT services, or work with sensitive data, it is often a requirement to take part.

Torn between ISO 27001 and an alternative? If you supply to healthcare, look at NEN 7510. If you work for the American market or provide a SaaS service, SOC 2 is a frequently requested alternative.

More information

Costs and timelineISO 27001 for SaaS companies