ISO 27001 readiness: a practical first 90 days for small teams

ISO/IEC 27001 is the international standard for an information security management system, or ISMS. It does not tell you to buy particular tools. It asks you to understand your risks, choose controls to treat them, and prove the system is run and improved over time. For a small team, the hard part is not the controls. It is getting the management system started without drowning in documents. Here is a realistic 90-day plan.

Before you start: what certification involves

Certification is done by an accredited certification body in two stages. Stage 1 reviews your documentation and readiness. Stage 2 tests whether the ISMS is actually operating. After certification there are surveillance audits, typically annually, and recertification every three years. You will need some operating history, usually a few months of records, before a Stage 2 audit makes sense.

Days 1 to 30: scope, context and risk method

• Get an executive sponsor who can approve policy, resources and risk acceptance.
• Define the scope: which products, locations, teams and systems are in the ISMS. Narrow and honest beats broad and vague.
• Document the context: internal and external issues, interested parties and their requirements (clauses 4.1 to 4.3).
• Write a short information security policy and assign roles and responsibilities.
• Choose a risk assessment method: how you identify risks, how you rate likelihood and impact, and your acceptance criteria.
• Build an asset and information inventory for the scope.

Days 31 to 60: risk assessment and Statement of Applicability

Run the risk assessment with the people who know the systems. For each significant risk, decide whether to treat, accept, avoid or transfer it. Then compare your chosen controls against the 93 controls in Annex A of ISO/IEC 27001:2022, which are grouped into organisational, people, physical and technological themes.

• Produce a risk register with owners and treatment decisions.
• Write the Statement of Applicability: each Annex A control, whether it applies, why, and whether it is implemented.
• Create a risk treatment plan with owners and dates for the gaps.
• Get risk owners to formally accept residual risk.

Days 61 to 90: operate the system

Now produce evidence that the ISMS runs. Auditors look for records, not just procedures.

• Write the procedures you really need: access management, change management, incident management, supplier security, backup and secure development if relevant.
• Run security awareness training and keep attendance records.
• Start regular activities: access reviews, vulnerability management, supplier reviews.
• Define security objectives and how you measure them.
• Plan and perform an internal audit by someone independent of the work being audited.
• Hold a management review covering the inputs listed in clause 9.3, and minute the decisions.

Mistakes that slow teams down

• Buying a template pack and adopting 40 policies nobody follows. Auditors test what you say you do.
• Treating Annex A as the starting point instead of the risk assessment.
• Leaving internal audit and management review until the week before Stage 1.
• Not involving engineering, so documented controls don't match how systems really work.

Choosing a certification body

Use a certification body accredited by a recognised accreditation body. In Australia and New Zealand, JAS-ANZ maintains a register. Ask about auditor experience with organisations like yours, their audit day estimates, and their availability for Stage 1 and Stage 2. Your readiness plan should finish with a short period of steady operation before the Stage 2 audit.