Do I need ISO 27001 as a small business?

Almost certainly not. ISO 27001 is an enterprise-grade certification you pursue only when a customer or a tender contractually requires it — and the actual security it represents can be achieved far more cheaply for a 1–30 staff business through SMB1001 certification, tier by tier or the Essential Eight ideas. If nobody is contractually demanding the certificate, paying for one is buying a filing cabinet to store a single sheet of paper.

This page covers what ISO 27001 actually is, what it costs in money and months, the narrow cases where a small business genuinely needs it, the cheaper alternatives that cover the same risk, and how to answer a customer who asks for it without panicking into a costly audit.

What ISO 27001 actually is

ISO/IEC 27001 is an international standard for an information security management system — an ISMS. The word "management system" is the part people miss. The certificate does not say "this company is secure". It says "this company has a documented, governed, repeating process for managing information-security risk, and an independent auditor checked that the process exists and is being followed."

That distinction matters. ISO 27001 is about governance and evidence, not about whether your website has the right Essential Eight controls in place. You build a risk register, write policies, assign owners, define how you measure and review controls, and then prove to an external auditor that the whole machine runs on a schedule. It is audited at certification, surveilled annually, and recertified every 3 years. It is ongoing by design — there is no "pass it once and you're done."

For an organisation with hundreds of staff, a compliance team, and regulators or enterprise customers asking hard questions, that machine is genuinely useful. For a 6-person business whose entire technology footprint is a website, cloud email and some laptops, it is a governance framework wrapped around a problem you can solve in an afternoon. The international standard for why you'd want NIST CSF instead sits in the same enterprise tier — both are built for organisations that need to demonstrate a program, not just have working controls. If you want the one-line version, do I need ISO 27001 answers it in a sentence.

What it costs and takes

ISO 27001 is not a fee you pay. It is a project you run, and the project is the expensive part.

Expect months of work before an auditor ever arrives — typically 6 to 12 for a small organisation doing it properly, because you are building documentation and processes that did not exist. You write the ISMS scope, a risk assessment methodology, a Statement of Applicability covering the Annex A controls, and policies for access, incident response, supplier management, business continuity and more. Most small businesses cannot do this from internal knowledge alone, so a consultant gets engaged, and consultant time is the largest line item.

Then there is the certification body itself — an accredited auditor, separate from your consultant, who runs a 2-stage audit (documentation review, then implementation audit) and returns annually for surveillance. Their fees scale with your headcount and scope, but they are real money on top of the consulting, and they recur. The total for a genuinely small business runs into tens of thousands of dollars in the first year and keeps costing every year after.

None of that buys you a more secure website. It buys you a defensible, audited record that you manage security on purpose. If no one is asking to see that record, you have spent a year's worth of a part-time salary documenting a thing nobody will read.

When a small business genuinely needs it

There is a clean test for whether ISO 27001 is the right call, and it has nothing to do with how secure you want to be. The test is: is someone contractually requiring it? If yes, you need it. If no, you almost certainly don't. The genuine cases:

An enterprise customer's contract demands it. A large corporate or government buyer runs a vendor risk programme, and their procurement rules say suppliers handling their data must hold ISO 27001. This is non-negotiable from their side — it is written into the contract you want to sign. Here the certificate is not overkill; it is the price of the deal, and you weigh its cost against the revenue.

Certain tenders score or mandate it. Some public-sector and large-private tenders either require ISO 27001 to bid at all, or award scoring points for it. If you are chasing that specific work and the certificate is a gate, the maths is simple: no certificate, no contract.

A regulated supply chain passes the obligation down. If you sit inside a supply chain where the prime contractor is regulated — financial services, critical infrastructure, sometimes defence — they may flow an ISO 27001 requirement down to you. Note that defence has its own Australian pathway: many defence-supply obligations point at the ISM and DISP membership for small business rather than ISO 27001, so check what your contract actually names before assuming.

Outside those cases — where the motivation is "we should be more secure" or "it looks professional" — ISO 27001 is the wrong tool. The security goal is real and worth pursuing. The certificate is just an expensive way to reach it.

The cheaper alternatives that cover the same risk

The good news is that the actual risk ISO 27001 manages — at small-business scale — is covered far more cheaply by tools built for your size.

SMB1001 is the certification standard designed specifically for Australian small businesses. It has 5 tiers, entry pricing closer to a software subscription than an audit, and the lower tiers are self-attested by a director rather than externally audited. When a customer wants evidence that you take security seriously, SMB1001 is usually the proportionate answer — and many buyers who reflexively ask for ISO 27001 will accept it once they understand your size. We cover what SMB1001 is and walk through each tier in our SMB1001 guide.

The Essential Eight is the Australian Cyber Security Centre's set of eight practical mitigations — patching, multi-factor authentication, application control, backups and the rest. It is not a certification; it is a checklist of the controls that actually stop the attacks small businesses face. You can adopt the ideas without any audit, at maturity level one, for the cost of configuring things you already own.

ACSC guidance is free, written for your size, and authoritative. The ACSC Small Business Cyber Security Hub and its 12-page guide cover backups, updates, multi-factor authentication and phishing in plain English — the controls behind most real incidents, with none of the governance overhead.

Between them, these 3 cover the genuine risk that ISO 27001's Annex A controls address, at a fraction of the cost, with no auditor and no annual surveillance. For the full picture of what cybersecurity a small business actually needs, the short version is: working basics, evidence only when asked, certification only when contracted.

How to answer a customer asking for it

When a customer's questionnaire asks "are you ISO 27001 certified?", the wrong move is to silently start a costly audit project. The right move is to find out what they actually need.

Ask what the requirement is for. Often it is a default line copied from an enterprise vendor template, and the buyer's real concern is "can we trust you with our data?" — a question SMB1001, a completed security questionnaire, or evidence of Essential Eight controls answers just as well. Many large customers maintain an exceptions process for small suppliers precisely because they know ISO 27001 is disproportionate at your scale.

So respond with specifics rather than a yes or no: describe the controls you do have (multi-factor authentication, tested backups, a configured website and email, an incident process), offer your SMB1001 tier or commit to one, and ask whether that satisfies their requirement. Get the answer in writing. If they genuinely require the full certificate — because their own contract or regulator forces it — then you are in one of the legitimate cases above, and the cost becomes a line item in pricing that deal.

If you want the side-by-side of where outside help is and isn't worth it, Red Bridge Cyber vs cybersecurity consultancies is honest about where a scan stops and an engagement letter starts. The one rule worth keeping: let the contract decide, never the brochure.