Companies often arrive asking about ISO 27001 because a customer has requested it. Sometimes certification is genuinely required. Frequently the customer wants assurance, and there is a much shorter route to providing it — one that also happens to deliver most of the actual security.
Access control does the heavy lifting
The majority of incidents at small-company scale are not sophisticated. They involve someone having access they should not have, often a former employee.
Four habits address most of it: individual accounts rather than shared ones, access granted by role rather than by request, multi-factor authentication on email and anything reachable from the internet, and removal of access on the day someone leaves. That last one is the most commonly missed and the most frequently exploited.
Review who has administrative rights twice a year. The list is usually longer than anyone expects.
Backups you have actually restored
An untested backup is a belief, not a control. At minimum, keep a copy that ransomware on your network cannot reach, and perform a real restore of a real file on a schedule. Write down the date you did it.
The question to answer is not “do we have backups” but “how long would it take us to be operating again, and who has done it before”.
Suppliers are part of your perimeter
Your accountant, your IT provider and your cloud services hold your data. Know which suppliers hold what, what their obligations are in writing, and what happens to the data when the relationship ends. This overlaps directly with data protection requirements, so the work counts twice.
A plan that fits on one page
Who is called, in what order, when something goes wrong. Who can decide to take a system offline. Which regulator or customer must be notified, and within what period. What gets recorded while it is happening.
Do these four things and you will have addressed most of the real risk. If certification is still required afterwards, you will be starting from a genuine system rather than building one for the auditor.