ISO 27001 readiness for a 20-person company

A 20-person company can get ISO 27001 certified. The standard asks you to define the scope of your information security management system, assess your own risks, choose controls to treat them, run them, and prove it with records. Readiness means doing that work before an accredited certification body audits you. This is not legal advice. TechSum prepares companies for the audit and works with accredited partners for the certification itself.

What is ISO 27001, in plain words?

ISO/IEC 27001 is an international standard for running information security as a management system, not as a one-off project. The current edition is ISO/IEC 27001:2022. It has two parts. The main clauses (4 to 10) cover how you run the system: context, leadership, planning, support, operation, evaluation and improvement. Annex A lists 93 controls in four groups: organisational, people, physical and technological.

You do not have to apply all 93. You assess your risks and choose the controls that treat them. A Statement of Applicability records which controls you chose, which you left out and why.

When is a small company ready to consider it?

Certification makes sense when someone is asking for it. The usual triggers:

• Enterprise customers send long security questionnaires and ask whether you hold a certificate.
• A tender or a Gulf or European client requires it.
• Investors want evidence that customer data is handled with care.
• The company builds software or handles data for others, and its own processes hold up the sales cycle.

If none of these applies yet, a lighter route is often smarter: put basic controls in place, document them, and decide on certification when demand appears. The work you do now counts towards the certificate later.

What does the work involve?

The steps below follow the standard. The effort goes mostly into evidence and habit, not into buying tools.

1. Set the scope: which products, offices, teams and systems are inside the system. A smaller scope is easier and quicker. It must still be honest about what customers rely on.
2. List your assets: laptops, servers, cloud accounts, SaaS tools, repositories, data stores and the people who own each.
3. Run a risk assessment: for each asset, ask what could go wrong, how likely it is, how bad it would be, and what you will do about it. Keep the method simple enough that you will repeat it every year.
4. Choose controls and write the Statement of Applicability.
5. Write the policies you will follow: access control, acceptable use, backup, incident response, supplier management, secure development, change management, onboarding and offboarding. Short and accurate beats long and ignored.
6. Implement the controls: MFA on every account that supports it, disk encryption on laptops, role-based access, patching, logging, tested backups, a device inventory, an incident process.
7. Train people and keep records: everyone should know the rules and be able to show they have heard them.
8. Audit yourself: an internal audit and a management review are required before the external audit.
9. Go through certification: a Stage 1 audit reviews your documentation. A Stage 2 audit tests whether you follow it. After certification, surveillance audits happen each year and a full recertification audit at the end of the three-year cycle.

Which controls take the most effort in a small company?

Most small companies already do some of this informally. The gaps tend to be:

• Access reviews: who has admin rights to what, and when did anyone last check?
• Offboarding: accounts and devices of leavers need to be closed on the day.
• Supplier review: a list of vendors that handle your data, with a basic security check on each.
• Secure development: code review, dependency updates, secrets kept out of repositories.
• Evidence: controls that work but leave no trace will not satisfy an auditor. Screenshots, tickets, logs and signed records matter.

How long does it take and what does it cost?

It depends on where you start, how many systems are in scope and how much time the team can give it. A company with good habits and a small scope moves faster than one that has never written a policy. Be wary of anyone who quotes a fixed number of weeks before looking at your setup. The certification body charges its own audit fees, separate from any preparation support.

What are the trade-offs?

The certificate is a recurring commitment. Surveillance audits come every year, and the habits must continue between them. A company that treats it as a one-time hurdle will struggle at the first surveillance audit.

There is a risk of paper compliance, with beautiful documents and weak practice. Auditors look for evidence that people actually follow the rules. Keep the system small enough to be followed.

There is also an opportunity cost. A team of 20 spending weeks on documents is not building product. Time the project around a real commercial need and assign one person to own it.

How does ISO 27001 relate to SOC 2 and the DPDP Act?

SOC 2 is an attestation from a CPA firm against the AICPA Trust Services Criteria, popular with US customers. ISO 27001 is a certificate, more often asked for in India, Europe and the Gulf. Many controls overlap, so a company that does one has done much of the other.

The Digital Personal Data Protection Act, 2023 asks for reasonable security safeguards (section 8(5)) and the DPDP Rules, 2025 (rule 6) list minimum measures. ISO 27001 is one structured way to build and show them, but it covers security and not the wider privacy duties of consent, notice and rights. See the first steps under DPDP.

Where does TechSum fit?

We handle the technical side of readiness: access control, hardening, logging, backups, secure development practice and evidence collection. Certification itself goes through accredited audit partners. See ISO 27001 and SOC 2 readiness for how we work, or start with the free health check or a Digital Health Check to see where your basics stand. The wider work sits under Trust, Security and Compliance.