ISO27001 – Are you ready for it?

It’s a fair question, and one I get asked a lot. Small business owners tend to picture ISO 27001 as something built for large enterprises; companies with dedicated IT teams, compliance officers, and deep pockets. So the instinct is to assume readiness is about size. Do we have enough people? Enough budget? Enough of an IT department to cope?

In my experience, none of that is the real test.

The businesses that are genuinely ready for ISO 27001 aren’t necessarily the biggest or the best resourced. They’re the ones who understand the value of the standard and the why behind it. They have a clear grasp of the benefits and know what they’re trying to achieve. The businesses that struggle are the ones who see it as a paper exercise and see it as something to get through rather than something to get value from.

That distinction matters more than anything else in this post, so let’s unpack what it actually looks like in practice.

What it looks like when a business isn’t ready

I’ve worked with small businesses who came into ISO 27001 purely because a client demanded it, or because a competitor had it, without ever really engaging with why it mattered.

On the surface, this doesn’t sound like a problem because plenty of good decisions start with external pressure. But when the underlying mindset is “we just need to tick this box,” it shows up almost immediately.

These businesses struggle to get buy-in internally. Leadership might have signed off on the project, but the rest of the organisation was never brought along with it. That lack of engagement causes friction at every stage because people don’t understand why they’re being asked to change how they work, so they resist it, sometimes vocally, sometimes simply by ignoring the changes you’re bringing in.

The result is a project that drags. Timelines slip. Costs start to mount because work has to be redone or chased repeatedly. And perhaps most tellingly, everyone involved, including the client who originally asked for the certification, ends up feeling jaded by the whole experience.

Nobody comes out of it enthusiastic. It becomes something the business survived, not something it gained from. So it is any wonder people often see ISO standards as a burden.

What it looks like when a business is ready

Contrast this with businesses who come in already understanding the why.

They’ve thought about what they want to get out of the process; stronger client trust, better internal processes, and a genuine desire for reduction in risk.

All of this is understood before they’ve even started.

These are the businesses who embrace the way an Information Security Management System (ISMS) is built rather than resisting it.

And what I’ve consistently seen is that this engagement pays off in very practical ways. Their internal processes improve, not just their paperwork. Everything runs more smoothly because teams actually know what they’re supposed to do and why they’re doing it. And critically, their clients notice.

Clients feel more confident in a business that clearly knows what it’s doing with its own security, rather than one that’s just produced a certificate to satisfy a tender requirement.

The difference isn’t really about how hard the work is. Both groups do broadly the same work. The difference is whether that work is met with understanding or resistance, and that comes entirely down to mindset going in.

The practical markers of readiness

Mindset is the foundation, but it’s not the only thing worth checking before you commit. Alongside genuine buy-in, there are a handful of practical markers I look for early in any conversation with a small business considering ISO 27001.

Some consultants will tell you the most important aspect of ISO27001 to get right first is the ‘scope’ of the ISMS (i.e. what you’re going to consider), but in a small business this is often everything. So while setting the scope is important, it’s not the FIRST thing you need.

Here is the advice I give to all business owners… Get these in place first;