ISO 27001 checklist for small businesses

A useful ISO 27001 checklist for a small business is shorter than most people expect. The standard has two parts: clauses 4 to 10, which every certified organisation must meet, and Annex A, a list of 93 security controls you choose from according to your risks. A small team needs a clear scope, a handful of required documents, controls that match how it really works, and records that prove it.

This checklist follows ISO/IEC 27001:2022; the transition from the 2013 edition ended on 31 October 2025. Its 2024 amendment adds one question to clause 4: whether climate change is a relevant issue for you. At the end we compare the tools, with prices checked on 25 October 2026. This is general guidance, not legal advice: read the standard itself or work with a qualified adviser.

The checklist, clause by clause

These are not optional. For each line ask: do we do this, is it written where required, and can we show a record?

Context and scope (clause 4)

• List the internal and external issues that affect your information security, climate change included if relevant.
• List interested parties (customers, staff, suppliers, regulators) and what they require, including laws and contracts.
• Write the scope: which services, locations, teams and systems are in, and how you depend on what is outside it.

Leadership (clause 5)

• An information security policy, approved by top management and known to staff (5.2).
• Security roles and who holds them (5.3), even if one person holds several.

Planning (clause 6)

• A risk assessment method: how you rate likelihood and impact, and which level of risk you accept (6.1.2).
• The results of the risk assessment, usually kept in a risk register.
• A risk treatment plan, approved by the risk owners, who also accept the risk that remains (6.1.3).
• The Statement of Applicability (6.1.3 d), explained below.
• Security objectives you can measure, with who does what by when (6.2).

Support (clause 7)

• Proof that people with security roles are competent (7.2): training, qualifications or experience.
• Awareness: everyone knows the policy, their part in it and how to report an incident (7.3).
• Document control: versions, approval and one place for the current copy (7.5).

Operation, evaluation and improvement (clauses 8 to 10)

• Run what you planned, keep records that it ran and control what you outsource (8.1).
• Repeat the risk assessment at planned intervals and after big changes (8.2).
• Decide what you measure, how often and who looks at the results (9.1).
• An internal audit programme and its results (9.2). See your first internal audit.
• A management review with its decisions (9.3). See preparing a management review.
• Nonconformities, what you did about them and whether the fix worked (10.2), as in corrective actions that fix the cause.

Annex A: choose controls by risk

The 93 controls sit in four themes: organisational (5.1 to 5.37), people (6.1 to 6.8), physical (7.1 to 7.14) and technological (8.1 to 8.34). Check your risk treatment against the whole list, then record every control in the Statement of Applicability: included or not, why, and whether it is in place.

For a small company working in cloud services, these weigh most:

• Assets and access: an inventory of information and devices (5.9), access control and access rights (5.15, 5.18), and secure sign-in such as a second factor (8.5).
• Suppliers and cloud services (5.19 to 5.23): who holds your data and what the contract says. See supplier audits.
• Incidents (5.24 to 5.28): reporting, deciding, responding and learning.
• Law and privacy (5.31, 5.34): the data protection rules that apply where you and your customers are.
• People: screening, confidentiality agreements, awareness training and remote working (6.1, 6.6, 6.3, 6.7).
• Devices and systems: laptops and phones (8.1), malware protection (8.7), vulnerabilities (8.8), backup (8.13) and logging (8.15).
• If you build software: secure development, testing and change control (8.25 to 8.32).

Remote teams still need equipment off the premises (7.9) and the disposal of old devices (7.14).

The evidence an auditor will sample

Stage 1 of certification reviews your documents and readiness. Stage 2 checks that the system works, through interviews and samples of records. Surveillance audits follow yearly, and the certificate is renewed after three years. Have these ready and dated:

• The signed policy and the current scope.
• The risk register, the treatment plan and the Statement of Applicability, each with its review date.
• Access reviews, training records, and what happened when people joined and left.
• The supplier list with reviews and data processing agreements.
• The incident log, even with only small events, and backup restore tests.
• Internal audit reports, management review minutes and closed corrective actions.

A record made at the time beats a document written the week before the audit.

Spreadsheet, open source or a platform

A spreadsheet works for many small companies; software helps when evidence is spread across many tools. Prices were checked on each vendor's own pricing page on 25 October 2026 and change often: CISO Assistant, ISMS.online, Vanta, Drata, Secureframe, nerix. The certification audit is always a separate cost, quoted by the certification body and driven mostly by how many people are in scope.

CISO Assistant by intuitem is an open-source risk and compliance tool; Community is self-hosted, with unlimited users under the AGPLv3 licence. ISMS.online says its pricing is bespoke.

Vanta, Drata and Secureframe show plans without prices. All three connect to the tools you already use (Vanta says more than 400), monitor controls continuously and collect much of the evidence automatically. Vanta also lists audit firms you can contact, and Secureframe says it has more than 30 in-house compliance experts and former auditors.

nerix works differently. In Checks, which is in early access, "Get ready for a check" lets you pick ISO 27001 from a library of about 90 frameworks, including ISO 9001, ISO 14001, ISO 45001, GDPR, NIS2, the EU AI Act and sector packs. It adds the laws ISO 27001 needs when they apply, such as the GDPR for personal data in or for the EU, and says why. nerix reads the policies and records in your library and marks each requirement Evidence found, Partly found, Not found or Can't tell, and a person confirms each one. ISO 27001 has 118 requirements there (clauses 4 to 10 and the 93 controls), so checking them all costs 141,600 credits, about 14 euros, plus each document read for the first time. The price is shown before you start. It shows ISO clause numbers with its own short topic labels, not ISO's text, so keep your copy of the standard.

Where it falls short: nerix is not a certification body, and its result is readiness information, not an audit or legal advice. It does not connect to cloud accounts to test settings, does not monitor controls continuously and has no directory of auditors. If most of your evidence lives in cloud systems, a platform built for that saves more time. If it lives in documents and records, nerix shows the gaps before an auditor does.

Mistakes that cost small teams time

• Signing a bought policy pack unread. Auditors ask people how things work, and the answers must match the paper.
• A scope wider than you can run. Start with what customers ask about.
• Booking stage 2 before the first internal audit and management review.
• Claiming too early. "Certified" is only true with a certificate in hand, within its scope; see getting ready for an ISO 9001 or 27001 check.

The short version

Work through clauses 4 to 10 first: scope, policy, roles, risk assessment and treatment, Statement of Applicability, objectives, competence, document control, internal audit, management review and corrective action. Choose Annex A controls from your risks and give every exclusion a reason. Keep dated records as you go, because auditors sample evidence. A spreadsheet is enough for a small scope, platforms help when evidence is spread across many tools, and only a certification body can certify you.