ISO 27001 for SMBs: a practical guide to certifying without an endless project

By Kike Gandia · Co-Founder & CEO, OSCP

More and more SMBs run into the same requirement: an enterprise client demands ISO 27001 as a contract condition, or a public tender requires it outright. The good news is ISO 27001 doesn't demand the same documentation structure for a 15-person company as for a 5,000-person corporation: the standard scales to the organization's real size and complexity. This guide explains what certifying actually involves as an SMB and how to avoid it becoming a two-year project.

Why your client demands it (and it isn't negotiable)

ISO 27001 certifies that you have an Information Security Management System (ISMS) in place: policies, risk analysis, technical and organizational controls, and a continuous improvement process. When a large company subcontracts to you a service that touches its data, its own procurement or legal department demands this certification as assurance you're not the weak link in its supply chain. It's not a whim: in many tenders and contracts it's already a standard clause.

What it actually involves for an SMB

The ISMS documents what you should already be doing: who has access to what, how incidents are handled, how backups are done, how staff are trained. For a 10-50 employee SMB, the Statement of Applicability (which Annex A controls apply) is usually far shorter than a large company's, precisely because there's less surface to cover.

Process phases and realistic timelines

Initial gap analysis (2-3 weeks): what you already have and what is missing. ISMS design and security policy (4-6 weeks). Implementing pending controls (variable, typically 2-4 months depending on starting point). Internal audit and management review (2-3 weeks). External certification audit by an accredited body. For an organized SMB, the full process usually completes in 4-6 months, not two years.

The costliest mistake: over-engineering the ISMS

The most common SMB mistake is copying a large company's documentation structure: 40-page procedures for processes run by a single person. An ISMS sized to the organization's actual scale is not only faster to implement, it's the one that actually gets followed day to day, which is what the certification audit evaluates.

The decision that moves the most money: scope

Before discussing controls you have to decide what gets certified. The ISMS scope does not have to be "the whole company": it can be narrowed to one service and the people, systems and locations that support it. For a product SMB, a scope like "development, operation and support of platform X, at the Y offices and the associated cloud infrastructure" is perfectly certifiable and leaves out areas such as admin or sales, which add nothing to the assurance the client is after. This matters because audit days are calculated from the number of people inside scope and their complexity: a tightly drawn scope directly reduces certification cost and the volume of evidence you have to maintain each year. The limit is that the scope must make sense: you cannot exclude a system the certified service depends on, because the auditor catches it in Stage 1 and makes you redo it.

The documents the auditor will ask for without fail

This is the minimum folder an SMB needs in place before the certification audit, and who has to approve each item:

Document	What it is for	Who approves it
ISMS scope	Defines what is certified and what is left out	Leadership
Information security policy	Statement of intent and leadership commitment	Leadership
Risk assessment methodology and results	Justifies why some controls apply and others do not	ISMS owner
Statement of Applicability (SoA)	Walks through all 93 Annex A controls one by one	Leadership
Risk treatment plan	What happens to each risk, with owner and deadline	Leadership
Asset and supplier inventory	Basis of the risk assessment and supply chain control	ISMS owner
Incident management procedure	What is done, who decides, who gets notified	ISMS owner
Training and awareness records	Evidence that people know what they signed	HR or leadership
Internal audit report and management review minutes	Requirements of clauses 9.2 and 9.3	Leadership

What separates an ISMS that passes the audit from one that does not is rarely the number of documents: it is whether the dates on the records show the system has been running for months, rather than everything being generated the week before.

FAQ

How much does ISO 27001 certification cost for an SMB?

Implementation consulting typically runs €3,000 to €12,000 depending on the starting point, plus the cost of the external certification audit (varies by certifying body and company size).

Can I reuse ISO 27001 work to also comply with NIS2 or ENS?

Largely yes. The three frameworks share fundamental controls (access management, incident management, business continuity), so implementing one significantly reduces the effort for the others.

Does the certification expire?

Yes, it lasts three years with annual surveillance audits to keep it active.

How much of the internal team's time does the project consume?

This is the most underestimated question. Consultants draft and structure, but nobody external can answer on your behalf who has access to what, which suppliers process your data, or how the last incident was resolved. In an SMB, the norm is one person acting as main point of contact spending several hours a week during the project, plus occasional input from IT, HR and leadership. If nobody internally has that availability, the project does not go faster by paying more: it stalls.

Do I need a pentest to certify under ISO 27001?

The standard does not require one by that name. It does require managing technical vulnerabilities (Annex A control 8.8) and verifying security in development (8.29), and in a company whose product is an internet-facing application, a pentest or recurring vulnerability assessment is the most direct way to demonstrate it. If the certified scope excludes software development, a periodic vulnerability assessment is usually enough.

Can we certify only part of the company?

Yes, and it is usually advisable. Scope can be limited to one service, one team and specific locations, as long as the perimeter is coherent and does not exclude systems the certified service depends on. The certificate states the scope explicitly, so check that the wording covers what your client wants to see: a certificate whose scope does not mention the service you sell them is of no use to them.

What happens if the audit raises a major nonconformity?

The certificate is not issued until it is closed. A corrective action plan is opened with an owner and a deadline, and the body verifies the fix — sometimes on documentation, sometimes with a follow-up visit — before certifying. That is why the prior internal audit is not a formality: it is the chance to find exactly that while it does not yet put at risk a delivery date you have committed to with a client.

Related service

ISO 27001 consulting for businesses

Sources

Start my ISO 27001 project