ISO 27001 for startups and small businesses: a lean ISMS that still passes the audit
A startup or small business can implement ISO/IEC 27001:2022 with a lean ISMS: the requirements are the same for any size, but how you meet them scales. Clauses 4 to 10 cannot be excluded (context, leadership, risks, support, operation, evaluation and improvement); Annex A controls are selected by your risk assessment and any you exclude must be justified in the Statement of Applicability. In a company of 5 to 50 people the keys are a narrow, clear scope (often the product and the cloud platform), one ISMS owner with real time and management backing, compensating measures where there are too few people to separate duties, and good use of your cloud providers' controls. Audit time also scales: certification bodies set it mainly by the number of people in scope.
What does not change with company size
- All of clauses 4 to 10: context and scope, leadership and policy, risk assessment and treatment, competence and awareness, operation, monitoring, internal audit, management review and continual improvement.
- The mandatory documented information (scope, policy, risk methodology, Statement of Applicability, risk treatment plan, objectives, records of competence, monitoring, internal audit and management review).
- Evidence that controls operate for a while before the certification audit, not only approved documents.
What does scale down
| Area | How a small company usually solves it |
|---|---|
| Scope (clause 4.3) | Limit it to what customers ask about, for example the product, its cloud platform and the people who operate it |
| Roles (5.3 and control 5.2) | One ISMS owner (often the CTO or COO) and a small committee with the founders; responsibilities in one RACI table |
| Segregation of duties (control 5.3) | When there are not enough people, compensate with logging, alerts, peer review of changes and periodic review by management, and record that decision in the risk assessment |
| Cloud (control 5.23) | Use the provider's shared responsibility model and its reports; your part is configuration, access, backups and monitoring |
| Physical security (controls 7.1 to 7.14) | With remote work or co-working, many apply to the provider's data centres and to laptops; justify exclusions in the Statement of Applicability |
| Remote working (control 6.7) | Short rules for devices, disk encryption, screen lock and home networks |
| Internal audit (9.2) | Can be done by a trained person who does not audit their own work, or by an external auditor for a few days |
ISO 27001 ISMS documentation toolkit
84 files to document your ISMS based on ISO/IEC 27001:2022.
See the ISO 27001 documentation toolkitCommon mistakes in small companies
- Copying the scope and controls of a large company and ending up with policies nobody follows.
- Excluding Annex A controls without a justification linked to the risk assessment.
- Leaving the ISMS to one person without time or authority: the plan stalls at the first deadline.
- Writing documents and starting the audit without months of records (access reviews, tested backups, incidents, indicators).
- Assuming the cloud provider's certificate covers your company: it covers their part, not your configuration or your people.
A realistic plan for 5 to 50 people
- Run a gap analysis against the clauses and the 93 Annex A controls to see where you really stand.
- Agree a narrow scope with the founders and name the ISMS owner.
- Do the risk assessment with the people who know the product and the infrastructure, and decide treatment and the Statement of Applicability from it.
- Implement the priority technical controls first: MFA, access reviews, tested backups, logging and alerts, secure configuration of the cloud.
- Operate and record evidence for a few months, run the internal audit and the management review, then book stage 1 and stage 2.
The NexoDocs reference plan reaches stage 2 in about 30 weeks for 20 to 100 people; a very small team with a narrow scope can move faster in documentation, but not in the time controls need to run.
Template: the ISO 27001 toolkit for a lean ISMS
The NexoDocs ISO 27001 toolkit gives a small team the documents already structured in editable Word and Excel, with a worked example: gap self-assessment (ISMS-GAP-01), project plan with Gantt (ISMS-PRJ-01), risk methodology and matrix, treatment plan (ISMS-RSK-03), Statement of Applicability with the 93 controls, Annex A policies and the internal audit programme. You adapt them to your scope instead of writing from zero; the toolkit does not replace operating the controls or the certification body's audit, and no toolkit can guarantee the result.
Next step
Try it free or go straight to the complete solution.
ISO 27001 ISMS documentation toolkit
84 files to document your ISMS based on ISO/IEC 27001:2022.
See the ISO 27001 documentation toolkit
Free sample
Download a reduced version of the toolkit's risk matrix for free (Excel, 10 scenarios, heat map). See how it calculates risk level and category before you decide.
Get the free sampleFrequently asked questions
Is ISO 27001 worth it for a startup?
It is when customers or tenders ask for it, or when security questionnaires are slowing down sales. If nobody asks yet, building the basics (risks, access, backups, incidents) already prepares you for when they do.
Can a company of 5 people be certified?
Yes. The standard has no minimum size. The same clauses apply, and the audit is shorter because it depends mainly on the number of people in scope.
Which Annex A controls can a small company exclude?
Any control can be excluded if the risk assessment shows it is not needed and the exclusion is justified in the Statement of Applicability. Clauses 4 to 10 cannot be excluded.
Do I need a full-time security person?
Not usually. You need one owner with dedicated hours every week and management backing; specific tasks such as the internal audit can be outsourced.
Related guides
How much does ISO 27001 cost? Toolkit, consultant or software
Real costs to implement and certify ISO 27001 in a small business: audit, consultant, compliance software or a template toolkit, compared in one table.
Read the guide →How long does ISO 27001 take? A phase-by-phase plan for small businesses
How long it takes to implement and certify ISO/IEC 27001:2022 in a small business: the 8 phases week by week, what makes it longer and how to shorten it safely.
Read the guide →ISO 27001 gap analysis: how to find out how far your ISMS is from the standard
How to run an ISO/IEC 27001:2022 gap analysis: the requirements of clauses 4 to 10, the 93 Annex A controls, how to score them and what to do next.
Read the guide →Updated: 2026-10-29