You build an ISO 27001 management system from scratch by identifying the scope of your information security, assessing risks, implementing controls, documenting your processes, and completing a two-stage certification audit. For small businesses and digital companies, the process is more straightforward than it sounds, especially when you approach it step by step. The questions below walk you through everything you need to know.<\/p>\n
An ISO 27001 management system, formally called an Information Security Management System, or ISMS, is the complete framework your organisation uses to protect sensitive information. It covers policies, processes, people, and technology, all working together to identify security risks and keep them under control.<\/p>\n
The ISMS is not just a folder of documents. It is a living system that defines how your organisation handles information assets, who is responsible for what, and how you respond when something goes wrong. The core components include:<\/p>\n
For digital companies, the scope often centres on cloud infrastructure, software systems, client data, and remote work environments, all of which ISO 27001 addresses directly.<\/p>\n
ISO 27001 requires a specific set of documented information as evidence that your ISMS is properly implemented. Without these documents, your certification audit cannot be completed. The standard distinguishes between documents you must maintain (policies and procedures) and records you must retain (evidence of activities carried out).<\/p>\n
The most important mandatory documents include:<\/p>\n
The Statement of Applicability is particularly important. It documents every control in Annex A, states whether you have implemented it, and explains why, or why not. Auditors pay close attention to this document, so it should be thorough and honest.<\/p>\n
For most small businesses, building an ISO 27001 management system takes anywhere from a few weeks to several months, depending on the complexity of your operations and how much is already in place. Digital companies with lean, well-documented processes can often move significantly faster than traditional organisations.<\/p>\n
The main factors that affect the timeline are:<\/p>\n
Modern AI-supported platforms can compress the documentation and preparation phase dramatically. What traditionally required months of consultant work can now be completed in days when you use the right tools and have a clear scope defined from the start. For a small digital company, a realistic target is to have your ISMS ready for audit within two to four weeks if you are focused and well organised.<\/p>\n
Risk assessment and risk treatment are two separate but connected steps in the ISO 27001 process. Risk assessment is the process of identifying and evaluating your information security risks. Risk treatment is what you decide to do about those risks once you understand them.<\/p>\n
During risk assessment, you identify your information assets, consider the threats and vulnerabilities that could affect them, and evaluate the likelihood and potential impact of each risk. The output is a risk register, a structured list of risks with their assessed severity. ISO 27001 does not prescribe a specific methodology, so you can choose an approach that suits your business, as long as it produces consistent and comparable results.<\/p>\n
Once you know your risks, risk treatment is the decision-making stage. For each risk, you choose one of four responses: apply controls to reduce the risk, accept the risk if it falls within your tolerance, avoid the risk by stopping the activity that creates it, or transfer the risk through insurance or contracts. Your risk treatment plan documents these decisions, and your Statement of Applicability ties the chosen controls back to the risks they address.<\/p>\n
The two processes are iterative. After implementing controls, you reassess residual risk to confirm it has been reduced to an acceptable level.<\/p>\n
No single Annex A control is universally mandatory for every organisation. What is mandatory is that you go through all 93 controls in Annex A (updated in ISO 27001:2022), decide which ones apply to your situation, implement the relevant ones, and justify any you exclude in your Statement of Applicability.<\/p>\n
That said, certain controls are almost always applicable for small digital businesses because they address fundamental security risks:<\/p>\n
The controls you implement should be driven by your risk assessment results, not by a generic checklist. A small SaaS company will have a very different control profile from a consultancy or an e-commerce business. This is one reason why the risk assessment step matters so much, it tells you where to focus your effort.<\/p>\n
If you are also exploring quality management alongside information security, you might find it useful to look at ISO 9001 certification<\/a> as a complementary framework.<\/p>\n The ISO 27001 certification audit is carried out in two stages. Stage 1 is a documentation review, and Stage 2 is the main audit where the certification body verifies that your ISMS is actually implemented and working. Both stages are conducted by an accredited certification body.<\/p>\n In Stage 1, the auditor reviews your key documents, your scope, policies, risk assessment, Statement of Applicability, and risk treatment plan. The goal is to confirm that your ISMS is sufficiently developed and ready for the full audit. You will receive feedback on any gaps that need to be addressed before Stage 2. For digital companies, this stage can often be conducted entirely online.<\/p>\n Stage 2 is where the auditor verifies that your controls are actually in place and operating effectively. This involves reviewing evidence, interviewing staff, and testing processes. If the auditor finds nonconformities, you will need to address them before the certificate is issued. Minor nonconformities can sometimes be resolved with a corrective action plan rather than a full re-audit.<\/p>\n Once you are certified, you maintain the certificate through annual surveillance audits and a full recertification audit every three years. This ongoing process keeps your ISMS current and ensures continual improvement, which is a core requirement of the standard, not just a nice-to-have.<\/p>\nHow does the ISO 27001 certification audit process work?<\/h2>\n
Stage 1 – Documentation review<\/h3>\n
Stage 2 – Main audit<\/h3>\n