ISO/IEC 27001 explained for SMBs: the standard, the controls and the audit

You want to bid on a contract with a large organization, and the tender asks for ISO/IEC 27001 certification. Your team protects its data well, but nothing on paper proves it. Here is what the standard is, what it asks of a small business and where to start.

What ISO/IEC 27001 is

ISO/IEC 27001 is the international standard for an information security management system (ISMS). The International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) publish it together. The current edition is ISO/IEC 27001:2022, published in October 2022. Amendment 1, published in February 2024, adds climate change to the issues you consider when you describe your context.

An ISMS is the way your business runs information security: the scope, the roles, the risk decisions, the controls and the regular reviews. Its aim is to protect the confidentiality, integrity and availability of information.

A fleet of delivery vans is a useful comparison. A new lock on one van is a control. The program says who checks each van, how often, what to fix first and how you prove the work was done. ISO/IEC 27001 describes that program for your information.

ISO writes the standard, but it does not certify anyone. An accredited certification body audits your ISMS and issues the certificate. In Canada, the Standards Council of Canada (SCC) accredits certification bodies for information security management systems. A business that is “aligned with” ISO/IEC 27001 follows the standard but holds no certificate. No accredited body has audited it.

Why it matters for an SMB

ISO/IEC 27001 certification is voluntary, and the standard applies to organizations of any size or sector. For a small or medium business (SMB), three reasons stand out:

• Customers ask. Large customers and partners may ask for a certificate before they sign.
• An orderly plan. The standard gives you a structure for security work, with an owner, a risk method and a review cycle.
• Your vendors. You can ask your own suppliers for their certificate. You then need to read its scope and its edition.

ISO/IEC 27001 differs from SOC 2. SOC 2 is an attestation report by an independent CPA (chartered professional accountant) firm, against the Trust Services Criteria of the American Institute of CPAs (AICPA). It is common in North American business-to-business sales. ISO/IEC 27001 gives you a certificate for a management system, from an accredited certification body. Ask your customers which one they accept.

A certificate does not prove, on its own, that you meet Law 25 or PIPEDA. Map each legal duty to a control first.

What it asks for

The standard has two parts: the requirements in clauses 4 to 10, and the reference list of controls in Annex A.

The management system clauses

• Clause 4, Context: define the scope of the ISMS, the issues that affect it and the interested parties. Since 2024, this includes whether climate change is a relevant issue.
• Clause 5, Leadership: top management commits to the ISMS, approves an information security policy and assigns roles.
• Clause 6, Planning: assess your information security risks, decide how to treat each one and set objectives. Changes to the ISMS must also be planned.
• Clause 7, Support: provide the people, skills, awareness, communication and documents that the ISMS needs.
• Clause 8, Operation: carry out the plan, repeat the risk assessment and control what outside providers do for you.
• Clause 9, Performance evaluation: monitor and measure, run internal audits and hold management reviews.
• Clause 10, Improvement: fix nonconformities, act on their causes and keep improving.

Annex A: 93 controls in four themes

Annex A lists 93 controls in four themes: organizational, people, physical and technological. Examples are information security policies, staff screening and awareness training, physical entry, backups and secure coding. The 2013 edition had 114 controls in 14 clauses.

Annex A is not a checklist. You choose your controls through risk treatment, then compare them with Annex A to check that you did not miss a necessary one. ISO/IEC 27002 is the companion guidance. It explains each control and how to put it in place. You cannot be certified to ISO/IEC 27002.

The Statement of Applicability

The Statement of Applicability (SoA) is a required document. It lists the controls you need, says why you include each one and whether it is in place, and explains why you excluded any Annex A control. It links your risk decisions to your controls.

The certification audit

The initial audit has two stages. Stage 1 checks your readiness: your documents, your scope and your plans. Stage 2 checks that the ISMS works in practice. A certification cycle usually lasts three years. Surveillance audits take place at least once a calendar year, except in the year of recertification. The first one comes no more than 12 months after the certification decision.

The transition from the 2013 edition ended on October 31, 2025. All certifications based on ISO/IEC 27001:2013 expired or were withdrawn on that date. A valid certificate now names the 2022 edition.

How to approach it

1. Ask your customers what they need. Ask whether they need a certificate, or whether answers to their questionnaire are enough.
2. Set the scope. Name the business units, locations, systems and data that the ISMS covers.
3. Name an owner, and get support from top management. The standard requires both.
4. List your information assets, then assess the risks to each one.
5. Choose a treatment for each risk. Compare your controls with Annex A, and use ISO/IEC 27002 for guidance. Write your Statement of Applicability.
6. Run the controls, and keep the evidence: dated exports, logs and signed records.
7. Run an internal audit and a management review. Fix what they find.
8. Choose an accredited certification body. In Canada, check that the SCC or another recognized accreditation body accredits it for ISO/IEC 27001.

Common mistakes

• Buying a template pack and calling it an ISMS. Documents alone do not show that the ISMS runs.
• Treating the 93 Annex A controls as a checklist instead of starting from your risks.
• Choosing a scope so narrow that the certificate does not cover what customers care about.
• Skipping the internal audit or the management review before stage 1.
• Saying “certified” when you are only “aligned with” the standard.
• Accepting a vendor’s ISO/IEC 27001:2013 certificate. It is no longer valid.
• Treating the certificate as the finish line. Surveillance audits come every year.

How NextIT helps

NextIT tracks your progress against ISO/IEC 27001, Law 25, SOC 2, NIST CSF and other frameworks. The compliance assessment shows your score for each framework you follow. Control Management and Evidence Repository keep each control with its proof, and you can sort evidence by expiry to renew it on time. The compliance report covers one framework at a time and exports as a PDF to share with an auditor. To see how this fits your business, book a demo.