The three ISO 27001 mistakes we see SMBs make most often

Getting ISO 27001 certified is one thing. Staying certified, year after year, without it taking over your business is another.

Lucas Jansen, our Information Security GRC Lead, spends his days helping clients through certification and compliance, from ISO 27001 and SOC 2 to Cyber Essentials and the security questionnaires that land from customers and suppliers. We asked him what trips SMBs up most often. His answer came down to three habits, and the good news is that all of them are fixable.

1. Treating the audit as a fire drill

The most common pattern Lucas sees is the pre-audit scramble. A month out, someone realises there are a hundred-odd things to evidence, and people get pulled away from their day jobs to pull it all together.

“It’s this fire drill type before the audit that you need to scramble and prep everything,” he says. “It usually pulls people away from other work, which negatively affects the business in other ways.”

The alternative is to spread the work across the year. With our ongoing clients, we build a calendar of recurring maintenance tasks, so evidence is gathered as you go rather than all at once. By the time the audit comes round, the job is to catch the few things that slipped through the cracks or have gone a bit stale, not to rebuild the whole system.

It also makes each audit easier than the last. The first year involves more discovery and setup. After that, the rhythm does most of the work.

2. No leadership buy-in or internal owner

ISO 27001 is explicit that information security has to be led from the top. Without that direction from senior leadership, it quickly becomes nobody’s priority.

But leadership buy-in isn’t enough on its own. You also need someone inside the business who owns it day to day. That person doesn’t need to be a security expert, because that’s what a partner like LeftBrain is for. They just need to be able to do the work on the business side and act as the point of contact.

“We’re meant to augment and assist that one person, and that’s where our strengths really come in,” Lucas explains. “They don’t need to be a subject matter expert, but they need to be able to do the work on the business side that otherwise we wouldn’t be able to do.”

When that owner is missing, even the best external support struggles to keep things moving.

3. Treating ISO as a checkbox

For plenty of businesses, ISO 27001 starts life as a box to tick for a big client or an RFP. That’s understandable, but it means missing out on what the standard can actually do for you.

“I know that ISO for a lot of people is a bit of a checkbox, but it does have some real benefits,” says Lucas.

The biggest benefit is better decision-making. When security work is spread across the year, issues surface a few at a time. That gives leadership room to make considered choices, such as which security tooling to invest in, instead of being handed a long list of problems a month before the audit and only having time to patch them over.

In other words, the habits that make audits smoother are the same ones that make your business more secure.

What it looks like in practice

Silverbullet, a fast-scaling MarTech consultancy, has worked with us on ISO 27001 for three years. Our first engagement was their transition from the 2013 to the 2022 version of the standard, moving their documentation out of spreadsheets and SharePoint into a single Notion workspace.

“Thank you to the LeftBrain team for helping us pass our ISO 27001 recertification. Once again, Lucas has excelled at organising our documentation and processes in Notion, and at directing our efforts to make sure the business is aligned with its execution and infosec requirements. As always, I massively appreciate the LeftBrain team’s work with us.”

Since then, the year-round approach has made each audit smoother, and this year they passed their third recertification without any nonconformities. Just as important, they have a strong internal owner in Joe Goss, their Service & Support Manager.

“Once again, Lucas has excelled with the organisation of the documentation and process in Notion, and directing our efforts to ensure the business is aligned with its execution and infosec requirements,” says Joe.