ISO 27001 on an SME budget: the controls that win audits

Big-four consultancies have spent two decades selling ISO 27001 as a 12-month, €150k engagement. For a 50-person SME this is nonsense. The standard does not require a Big Four; it requires a documented Information Security Management System (ISMS), evidence that the 93 Annex A controls have been considered, and a successful Stage 1 + Stage 2 external audit. We routinely take SMEs to certification in 4–6 months for under €25k all-in.

The certifiable clauses are 4 to 10. Annex A controls (93 of them in the 2022 revision, down from 114) are inputs to your Statement of Applicability, not mandatory checklists.

• Clause 4: context of the organisation and interested parties
• Clause 5: leadership and policy
• Clause 6: planning — risk assessment and treatment
• Clause 7: support — resources, competence, awareness, communication, documented information
• Clause 8: operation — risk-treatment plan execution
• Clause 9: performance evaluation — monitoring, internal audit, management review
• Clause 10: improvement — non-conformities and corrective action

In the audits we have observed, certification bodies (BSI, AENOR, Bureau Veritas, TÜV) consistently sample these 14 of the 93 Annex A controls. Get these right and the audit is largely a formality.

• A.5.7 Threat intelligence
• A.5.15 Access control
• A.5.23 Information security for use of cloud services
• A.5.30 ICT readiness for business continuity
• A.6.3 Information security awareness, education and training
• A.6.6 Confidentiality or non-disclosure agreements
• A.7.4 Physical security monitoring
• A.8.1 User endpoint devices
• A.8.5 Secure authentication (MFA)
• A.8.7 Protection against malware (this is where Bitdefender goes in your SoA)
• A.8.9 Configuration management
• A.8.16 Monitoring activities (this is where EDR goes)
• A.8.23 Web filtering
• A.8.28 Secure coding (only if you build software)

You do not need a 200-page manual. You need 12 documents an inspector can read in two hours and verify in screenshots and tickets.

• Information Security Policy (signed by CEO, dated, version-controlled)
• Risk Assessment and Risk Treatment Plan (linked to your SoA)
• Statement of Applicability (justifies inclusion/exclusion of all 93 Annex A controls)
• Asset inventory (people, hardware, software, data, suppliers)
• Access Control Policy + access review log (quarterly)
• Incident Response Plan + runbook + at least one tabletop record
• Business Continuity Plan + backup test log
• Supplier Security Policy + DPA register
• Internal Audit Plan and report (independent reviewer)
• Management Review minutes (at least annual)
• Non-conformity log + corrective actions
• Awareness training records

Run with one internal owner (typically the IT lead or COO) and a part-time external consultant.

• Month 1: gap assessment, scope definition, ISMS kickoff, asset inventory, supplier register
• Month 2: risk assessment + risk treatment, draft SoA, write/adopt 12 documents above, implement missing technical controls (EDR, MFA, immutable backup)
• Month 3: awareness training rollout, internal audit, management review, evidence collection, remediation of internal-audit findings
• Month 4: Stage 1 audit (documentation review), correct any minor non-conformities, Stage 2 audit (operational verification), certification

For a 50-person Spanish SME with a typical M365 + cloud stack:

• External consultant (50–80 hours): €5k–€8k
• Stage 1 + Stage 2 audit (BSI/AENOR equivalent): €6k–€9k for first cycle
• Bitdefender GravityZone Enterprise tier annual licensing: €3k for 50 endpoints
• Email security (Hornetsecurity 365 Total Protection Business): €2k
• Immutable backup (Veeam + Wasabi or Object Lock): €2k
• Tooling subscriptions (vulnerability scan, ISMS platform if used): €2k
• Total typical first-year: €20k–€25k. Recertification cycle (year 4) typically €8k–€12k.

We provide the consultant + the technical stack + the document templates as a single fixed-price package. Most of our SME clients pass Stage 2 with zero major non-conformities on first attempt. Book a discovery call and we will quote within one business day, with a defensible timeline and total cost.