---
title: "ISO 27001 for Small Businesses (UK): Costs & Times"
description: "ISO 27001 for small UK businesses: when it is worth it, what it costs and how long it takes at up to 50 staff, and the proportionate route to certification."
canonical: https://www.isosecurity.co.uk/resources/iso-27001-for-small-businesses
updated: 2026-11-10
---

# ISO 27001 for small businesses: the proportionate version

Small organisations get certified with the same standard as multinationals, applied proportionately: a narrow honest scope, a slim policy set, one named owner and controls that match how a small team actually works. The certificate then does commercial work for you every week.

## When is ISO 27001 worth it for a small business?

The honest test is commercial. If certification wins or keeps contracts, passes diligence you currently fail, or replaces a growing pile of questionnaires, it pays.

If nobody is asking and your risks are modest, start with [Cyber Essentials](/resources/iso-27001-vs-cyber-essentials) and build the basics well. ISO 27001 will still be there when a customer requires it, and the work will count.

I give the same advice on readiness calls even when it costs me the engagement. A certificate bought too early often lapses unloved at the first surveillance audit.

## What does proportionate ISO 27001 look like at up to 50 staff?

- **Scope:** the service your customers buy, from your single site or remote setup: credible, and trimmed to what you can defend.
- **Policies:** one information security policy plus a handful of topic policies people actually read.
- **Risk:** a simple documented method and a register your managers scored themselves.
- **Controls:** strong basics (MFA everywhere, tested backups, joiners/leavers discipline, supplier checks, patching), evidenced from the systems you already use.
- **Ownership:** one named person with a few protected hours a month; see [who should own the ISMS](/resources/who-should-own-your-isms).

## What is the route to certification for a small business?

1. Agree the scope and run a gap analysis against it.
2. Build the risk register and treatment plan with your managers.
3. Produce the Statement of Applicability and the slim policy set.
4. Operate the controls and accumulate dated evidence (about three months).
5. Internal audit and management review; fix what they find.
6. Stage 1, then Stage 2 with an accredited certification body you booked early.

Timelines and phasing are detailed in my guides to [how long ISO 27001 takes](/resources/how-long-does-iso-27001-take) and [what it costs](/resources/iso-27001-cost-uk). If you are weighing doing it yourselves against support, my [consultant vs toolkit comparison](/resources/iso-27001-consultant-vs-toolkit) prices the internal hours honestly; the [charity case study](/case-studies/charity-iso-27001) shows the proportionate route in practice.

## Frequently asked questions about ISO 27001 for small businesses

### Is ISO 27001 worth it for a small business?

When a customer, tender or framework requires it, the question answers itself: the certificate unblocks revenue and replaces dozens of security questionnaires with one audited credential. Without that driver, most small UK businesses get proportionate value from Cyber Essentials first and come to ISO 27001 as they sell to larger customers, because certification for its own sake is rarely the best use of a small firm's money.

### How much does ISO 27001 cost a small business?

For up to about 50 staff on a single site, budget £13,000 to £26,000 in year one excluding VAT: implementation support typically £10,000 to £16,000 with ISO Security, plus certification-body fees of roughly £3,000 to £10,000, plus your team's time. My UK cost guide breaks the components down with published market comparisons.

### How long does ISO 27001 take for a small business?

Typically three to six months for a small, single-site, largely cloud-based organisation, provided decisions are quick and evidence starts accumulating early. The factor most within your control is naming one owner with protected time; the factor least within it is the certification body's diary, so book early.

## Contact

Small firm, large customer's requirement? Arrange a readiness discussion: [contact ISO Security](/contact) or email info@isosecurity.co.uk.