The business in question has high requirements for information security due to the sensitive nature of their work. The company has 5 people on staff and work with consultants from time to time. Is there another information security standard that can be used instead of ISO 27001 for a business of this size?


"OK, we can't achieve this standard, so let's look for a standard that we can achieve without much work"

is pretty much the opposite of a security-aware organization's mindset, though I'd agree (after 5 min of lecture) with the presumption that 27001 might be a bit much work – but then you'll have to just live without that certification.

Instead of trying to find an arbitrary certification that fits your organization, you might simply want to look into the standard and apply as much as possible to the 5-person-organization. A certification is worth nothing, to be honest, from a security perspective, but will cost you a lot of money. Actually adhering to sensible practices practically pays for itself.


The primary question is if you are aiming towards a certification of any kind.

If certification is not your goal, you can simply pick ISO27001 and approach it as a framework that you pick & choose from. Apply the risk-based approach of the SOA aggressively and exclude any controls that do not address a serious risk.

If you do want to get a certification, I recommend asking around your local certifiers. You didn't include a country in your question, that makes it difficult to point anywhere. I know that in Europe, several testing organisations also offer custom certifications and you should be able to find something among those. They will be happy to help you pick the right one, I'm sure.


You can implement ISO 27001 for any size of organization, as long as you want to build a system of processes to secure your information.

In your case, the documentation will probably be minimal (One document containing policy and procedures, with SoA embedded, and a risk register).

ISO never asks you for huge documentation.


You could use the NIST CyberSecurity Framework

As a framework, it's flexible, simple to understand and measure against and measuring adherence would be an excellent step in any Information Security program.

If you want to go into a lot more detail to increase maturity having completed the above, you could look to NIST's Security and Privacy Controls for Federal Information Systems and Organizations (see http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.