ISO 27001 Checklist for Startups: What to Do, in Order

ISO 27001 takes a startup eight steps: set the scope, name an owner, assess risks, choose controls, write short policies, train your people, check the system internally and review it with management. A small team gets through them in weeks rather than months, provided the system stays small and matches how the company really works.

The steps follow ISO 27001:2022 (Information Security Management), so the clause numbers match the current standard.

What ISO 27001 asks of a startup

The standard prescribes no tools. It asks you to run an information security management system, or ISMS: know what information you hold, know what could go wrong with it, act on the biggest risks and check that the actions work.

Clauses 4 to 10 describe the management system: context of the organization, leadership, planning, support, operation, performance evaluation and improvement. Annex A lists 93 reference controls in four themes: organizational, people, physical and technological. You pick the controls that fit your risks and give a reason for each one you leave out.

A ten-person SaaS team needs no guarded server room. It needs clean access control, backups and a plan for when something breaks.

Decide first what the certificate is for

Ask who will read the certificate before you start. If a customer, a tender or a regulator only wants evidence that you take information security seriously, a certificate based on a self-assessment is a sensible and fast option. If they explicitly demand the classic route with an on-site audit by a certification body, it cannot replace that route.

The checklist is the same work either way. Only the final check differs.

The checklist, step by step

Step 1: Define the scope (clause 4)

Write down what the ISMS covers. For most startups that is the whole company: the product, the people, the offices or home offices, and the cloud services you depend on. A narrow scope that leaves out your main product raises questions with every customer.

Then list who has expectations of your security: customers, investors, employees, authorities. Clause 4.2 calls them interested parties and asks for their requirements. A short table does the job.

Step 2: Name an owner and set roles (clause 5)

Leadership is a real requirement, not a formality. A founder or managing director must back the ISMS and assign responsibility. In a small company one person, often the CTO or an operations lead, acts as information security owner. Write the role down. Clause 5.2 asks for an information security policy approved by top management, and clause 5.3 for assigned roles and responsibilities.

Step 3: Make an asset list and assess risks (clause 6)

List the information that matters: customer data, source code, contracts, financial records, employee data. Note next to each item where it lives and who can reach it. Include the SaaS tools you use, such as code hosting, ticketing, email and cloud infrastructure.

The risk assessment (clause 6.1.2) comes next. Estimate for each risk how likely it is and how bad the impact would be, on a simple scale such as low, medium and high. A complex model that nobody updates is of no use.

The results go into a risk treatment plan (clause 6.1.3). For each significant risk you decide to reduce it, avoid it, share it or accept it. Management approves the accepted risks.

Step 4: Select controls and write the Statement of Applicability

Go through the Annex A controls and mark each as applicable or not, with a short reason. The result is the Statement of Applicability, and a reviewer reads it early.

For startups, these control areas usually matter most:

• Access control (5.15) and secure authentication (8.5): single sign-on or multi-factor authentication, and removing access when someone leaves.
• Supplier relationships (5.19): knowing which vendors touch your data and what they promise.
• Incident management planning (5.24): who does what when something goes wrong.
• Awareness and training (6.3): people know the rules and why they exist.
• Information backup (8.13) and logging (8.15): backups that you have tested, and logs you can actually read.

If you build software, add the controls for secure development and change management in the technological theme.

Step 5: Set objectives and plan the work (clauses 6.2 and 6.3)

Set a few measurable security objectives, for example: all staff complete awareness training within the first month, all production access requires multi-factor authentication. Two or three are enough. The 2022 edition adds clause 6.3, planning of changes: changes to the ISMS are made deliberately.

Step 6: Provide support: policies, skills, documents (clause 7)

Clause 7 covers resources, competence, awareness, communication and documented information. Many startups overbuild here. A 200-page manual is not required.

A lean document set often looks like this:

• Information security policy (one to two pages)
• Acceptable use and remote work rules
• Access control rules
• Supplier and cloud service rules
• Incident response procedure
• Backup and recovery procedure
• Risk assessment and treatment plan
• Statement of Applicability

Write in plain language. When your team cannot explain a policy in their own words, shorten it. Keep versions and approval dates, since clause 7.5 requires controlled documented information.

Step 7: Run the operation (clause 8)

Clause 8 turns the plan into daily practice. You repeat the risk assessments at planned intervals and carry out the treatment plan. Collect evidence as you go: a screenshot of the multi-factor authentication setting, a record of a backup restore test, a list of completed trainings, an offboarding ticket. It does not have to be elaborate, only present and dated.

Step 8: Check and improve (clauses 9 and 10)

Three activities close the loop:

• Monitoring and measurement (9.1): do you meet your objectives?
• Internal audit (9.2): someone checks the ISMS against the standard and your own rules. In a small team, that is a person who does not audit their own work, or an outside helper.
• Management review (9.3): leadership meets, reviews results, risks and incidents, and records decisions.

When something fails, clause 10 asks you to fix the cause rather than the symptom, and to record it. A logged incident with a clear fix shows a working system, not a weak one.

The one-page checklist

Copy this into your project tool.

• Scope of the ISMS written down
• Interested parties and their requirements listed
• Information security owner named by management
• Information security policy approved and shared
• Asset and information list complete, including SaaS tools
• Risk assessment done with a simple, repeatable method
• Risk treatment plan approved, accepted risks signed off
• Annex A controls reviewed, Statement of Applicability written
• Two or three security objectives set
• Core policies and procedures written in plain language
• Multi-factor authentication on email, code hosting and cloud consoles
• Joiner, mover and leaver process in place
• Backups running and a restore tested
• Incident procedure written and walked through once
• Staff awareness training completed and recorded
• Internal audit carried out and findings logged
• Management review held and minuted
• Corrective actions tracked to closure

Common mistakes in young companies

Teams copy a template without adapting it. A policy that mentions systems you do not run is worse than no policy. Others treat ISO 27001 as an IT task, although hiring, onboarding, contracts and offboarding all fall under it. Some skip the risk assessment because it feels abstract, and then their control choices have no basis.

The costliest habit is waiting until a big customer asks. By then the pressure is high and the evidence is missing, and a rushed system takes more effort than a small, accurate one built early. If you are still sizing the effort, our overview of ISO certification for small and medium businesses shows what is realistic for a small team.

How Zertify fits in

Zertify issues ISO certificates based on a self-assessment. You answer structured questions about how your company works. Once you pass and have paid, the certificate follows within 4 hours, issued by G6 Agency AG under licence from SICE (Swiss Institute of Certification and Education). SICE reviews every assessment before issue. There is no on-site audit, and anyone can verify the certificate publicly on zertify.ch.

The certificate is valid for three years and is confirmed every year with a short online re-audit. It runs as a yearly subscription: the first year costs the full price, every following year a lower yearly fee. You can cancel at any time for the end of the year.

It shows that you assessed your own practice against the standard and met the requirements, which suits startups that need a credible signal for customers, partners or investors. If a tender or contract explicitly requires the classic route with an on-site audit by a certification body, choose that route instead.

The checklist above doubles as your preparation. Once scope, risks, controls and policies are in place, the assessment means describing what you already do.

• Read what the standard covers on the ISO 27001 page.
• See current fees on the pricing page.
• When you are ready, start the assessment.

A realistic plan for the first month

Week one: scope, owner, asset list. Week two: risk assessment and Statement of Applicability. Week three: policies, access rules, backup test, training. Week four: internal check, management review, and the assessment itself.

Your pace may differ. Build the system around how you really work, because you will have to maintain it afterwards.