ISO 27001 checklist: a readiness guide for SMEs

Picture a large client sending a long security questionnaire. Your sales lead forwards it to IT, IT forwards half of it to finance, and three weeks later someone fills in the last answers from memory. Then the client asks if you are ISO 27001 certified, and the honest answer is "not yet".

That's usually how ISO 27001 enters a mid-sized company: not as a project, but as a deal at risk. The good news is that most of the standard describes things a well-run company should do anyway. The hard part is proving you do them, every time, with records.

Most SMEs fail on evidence, not on policy

Writing policies is the easy part. There are templates for all of them. What auditors test is whether the policies are followed: who approved this access, when this change went live, what happened after that incident. In a small team, those answers live in chat threads and people's heads.

So the real readiness work is making your processes leave records as a side effect, so evidence isn't a separate job someone does before each audit.

What it costs to gather evidence by hand

The cost isn't only hours. It's the questionnaire that sat for three weeks while a deal waited, and the finding that came from a spreadsheet nobody updated.

The ISO 27001 readiness checklist

Use this as a working list. Each item is a question an auditor will ask, in plainer words.

1. Scope. Which parts of the business, locations, systems and data are inside the management system? A narrow, honest scope is easier to run and to certify than everything at once.

2. Asset inventory. A list of the information, systems, devices and accounts in scope, each with an owner. If an asset has no owner, nobody is responsible for protecting it.

3. Risk assessment. A documented method for identifying risks to those assets, scoring them, and deciding what to do about each. Repeatable, not a one-off spreadsheet.

4. Risk treatment and Statement of Applicability. For each control in Annex A, whether it applies, why, and how it's implemented. This document ties the risk assessment to what you actually do.

5. Access control. Joiners, movers and leavers. Who requested access, who approved it, when it was removed. Regular reviews of who has access to what.

6. Change management. Changes to systems are requested, approved, tested where needed and recorded. Emergency changes are reviewed afterwards.

7. Supplier risk. A list of suppliers that touch your data, with an assessment of each and the security terms in their contracts. Cloud and SaaS providers count.

8. Logging and evidence. Key systems keep logs, someone looks at them, and you can show both. Evidence is stored where it can be found a year later.

9. Incident response. A written process for reporting, handling and learning from security incidents, and records showing it was used.

10. Awareness and training. Staff know the policies that apply to them, and you can show who completed what.

11. Internal audit. Someone independent of the work checks the management system against the standard, and findings are tracked to closure.

12. Management review. Leadership reviews performance, risks, audit results and improvements on a set schedule, with minutes and decisions recorded.

If you can answer each of these with a document and a record, you are close to ready.

The fixed flow: changes that leave evidence

Compliance automation: ISO evidence on autopilot

1. Any change
2. Capture the event
3. Write evidence record
4. Map to control
5. Review due?
6. Owner signs off
7. Audit pack updated
8. Audit-ready any day
9. Audit preparation: 6 weeks → 3 days (Example)

The same pattern covers access, changes, supplier onboarding and incidents. A request is made in one place, not by chat. Approval follows written rules, and the approver is recorded. The action is logged by the system that performed it. Evidence is filed automatically, tagged to the control it supports. When the auditor asks, you export it, not reconstruct it.

This is where automation earns its place in ISO 27001. It doesn't write your policies or pass the audit for you. It makes the daily work produce records consistently, which is the thing small teams struggle to do by hand.

How long ISO 27001 readiness takes

It depends: on scope, on how much already exists, on how many systems are involved, and on how much time your team can give it. The typical shape is the same, though. Scope and risk assessment come first. Then a period of implementing controls and, more importantly, running them long enough to generate records. Then an internal audit and management review. Only then does the certification body start its audits.

Be wary of anyone who promises a date before they have seen your scope. Certification is granted by accredited certification bodies, not by consultants, and the auditor needs to see controls working over time.

What to do this week without us

• Write a one-paragraph scope. Which business, which systems, which locations.
• Start the asset list in a shared sheet, with an owner for each row.
• Pull the last three access removals for leavers. Check whether you can show when and who.
• List your top ten suppliers that hold your data and find their security terms.
• Answer the last client questionnaire again and note which answers had no evidence behind them.

When to call us

Call Devvion when evidence gathering is eating weeks, when client questionnaires are slowing deals, or when your processes run across systems that don't log anything useful. Our two-week assessment includes an ISO gap list alongside the process map, and the fee is credited if you continue. Business consulting then maps and matures the processes so they produce their own evidence, and forward-deployed engineering automates the logging; our engineer works inside your business, not from a ticket queue. We get you ready for the certification body. The people you meet stay on your work from the first day to the last. Devvion is not a certification body and is not itself ISO certified. See the use cases and the FAQ.

FAQ

Can Devvion certify us for ISO 27001?

Devvion gets you ready for ISO 27001; certification itself is granted by an accredited certification body. We map the gaps, redesign the processes so they produce their own evidence, and help you prepare for the certification audits.

How long does ISO 27001 readiness take for an SME?

Devvion won't give a date before seeing your scope, because it depends on how many systems are involved and what already exists. The usual shape is scope and risk first, then controls running long enough to produce records, then internal audit and management review.

What is the hardest part of ISO 27001 for small companies?

Devvion sees the same answer most of the time: evidence. Policies are easy to write. Showing that access, changes and incidents were handled as written, every time, is hard when the records live in chat threads and email.

How does automation help with ISO 27001?

Devvion builds processes where requests, approvals and actions are recorded by the systems doing the work. Evidence is filed as it happens and tagged to the control it supports. That cuts preparation time and gives the auditor consistent records.

Do we need ISO 27001 if clients only send questionnaires?

Devvion's view is that you can answer questionnaires without certification, but they get harder as clients grow. Building the evidence habits first helps either way: questionnaires get faster now, and certification becomes a smaller step if a client requires it later.