ISO 27001 is the international standard for information security management systems. For many small businesses, it starts with a customer questionnaire or a tender that asks for it. It shows customers you take their data seriously, and it gives you a structured way to protect your own.
The current version
The current version is ISO/IEC 27001:2022, amended in 2024 to add climate change to the context clauses. The transition from the 2013 version ended on 31 October 2025, so any certificate must now be to the 2022 version.
The two halves of the standard
- Clauses 4 to 10: the management system. Context, scope, leadership, risk assessment and treatment, objectives, competence, document control, internal audit, management review and improvement, structured like ISO 9001.
- Annex A: 93 controls in four themes. Organisational (37), People (8), Physical (14) and Technological (34). You decide which apply based on your risks.
Risk assessment and the Statement of Applicability
Identify the information you hold and the risks to its confidentiality, integrity and availability, then decide how to treat each risk. The Statement of Applicability lists all 93 Annex A controls, says whether each applies, why, and whether it is implemented. It is one of the first documents an auditor reads.
Excluding a control is fine if you can justify it. A fully remote business may exclude many physical controls, but not the ones covering equipment used at home.
Controls small businesses usually need to tighten
- Asset inventory: every laptop, phone, cloud service and data set, with an owner.
- Access control: joiners, movers and leavers, with access removed on the day someone leaves.
- Multi-factor authentication on email and every cloud service.
- Supplier security: knowing which suppliers hold your data, and checking their security.
- Backups that are tested, and a plan for ransomware.
- Security awareness training, with records.
- Incident management: how people report a suspected breach and what happens next, including the 72-hour notification to the ICO for reportable personal data breaches.
A realistic timeline
Most small businesses take four to nine months: a few months to put the controls and documents in place, then enough time running the system to show evidence, including an internal audit and a management review, before the Stage 1 and Stage 2 audits. Cyber Essentials is a useful first step and covers many of the technical controls.
Frequently asked questions
What is the difference between ISO 27001 and Cyber Essentials?
Cyber Essentials is a UK government scheme covering five technical controls. ISO 27001 is a full management system covering people, processes, suppliers and technology. Many businesses do Cyber Essentials first.
Do we need to implement all 93 controls?
No. You must consider all of them, and justify in the Statement of Applicability why any are excluded.
Can ISO 27001 be combined with ISO 9001?
Yes. The management system clauses share the same structure, so audits, document control, corrective action and management review can be run once.
This guide is general information for UK businesses, not legal advice. Check the current regulations and HSE guidance at hse.gov.uk, and take professional advice for your situation.