SME WORKING GUIDE / INFORMATION SECURITY
ISO 27001.
Make it workable.
A practical starting point for managing information security in a smaller business.
Use the European DIGITAL SME Alliance’s guide to structure the work, then use our readiness self-assessment to identify the questions your team needs to examine.
EUROPEAN DIGITAL SME ALLIANCE
Updated guide · November 2025
THE STARTING POINT
Manage the information
your business depends on.
A customer asks for evidence of security. A supplier changes how it handles your data. A key service becomes unavailable. These are management questions as well as technical ones.
ISO/IEC 27001:2022 sets requirements for an information security management system, often shortened to ISMS. It provides a way to organise how a business assesses information security risks, treats them, and reviews whether its arrangements are working.
KEY TAKEAWAYS
- Choose a meaningful scope and give the work an accountable owner.
- Build a plan around your risks and the evidence you need.
- Keep self-assessment, implementation, and certification distinct.
YOUR STARTING POSITION
Explore your
ISO 27001 readiness.
Bring your current arrangements to a structured set of questions. Use the result to organise a conversation about gaps, priorities, and the evidence needed for the next step.
The assessment opens in a dialog. It is a self-assessment, not an audit, certification decision, or assurance that every requirement has been met.
READINESS CHECK
Review the result with the people responsible for the work.
THE PUBLISHER’S RESOURCE
A guide you can work through.
The updated DIGITAL SME guide reflects the 2022 revision. It covers foundations and responsibilities, information and other assets, risk evaluation, and the selection and monitoring of security measures.
It also discusses certification. The publisher explicitly says that implementing its guide does not imply full compliance with ISO/IEC 27001 and is not a substitute for certification.
A PRACTICAL WORKING RECORD
Give the plan something concrete to work on.
Use the prompts below to begin your own working record. They are CyberSolace suggestions for organising the work, not a replacement for the standard or a complete implementation checklist.
01
Set the boundary.
Write down which services, teams, locations, and information the proposed ISMS will cover. Identify dependencies outside that boundary.
Record: what is included, what is outside the scope, and why the boundary makes sense.
02
Identify what matters.
Talk to the people who use and own important information. Consider what would happen if it were disclosed, changed incorrectly, or unavailable.
Record: the information, its owner, and the business consequence you need to manage.
03
Choose a proportionate response.
Examine the safeguards already in place before buying more. Agree which risks need action, who will act, and what evidence would show the work is effective.
Record: the decision, owner, resources, and intended evidence.
04
Review how it works.
Schedule time to examine progress, test important assumptions, and address weaknesses. A completed template is useful only if it reflects the organisation’s actual arrangements.
Record: what you checked, what you found, and the next decision required.
BE CLEAR ABOUT THE OUTCOME
Implementation and certification
are different decisions.
Build an ISMS that works.
ISO explains that organisations can implement the standard without seeking certification. Decide what the business needs from the work and what evidence customers or partners expect.
Avoid a fixed promise about how quickly implementation will take. Scope, existing arrangements, available time, and the issues found will shape the programme.
Decide whether certification is needed.
Certification involves assessment by a certification body. Confirm any contractual requirement, the relevant scope, and the evidence required before committing to an audit.
Neither this guide nor our self-assessment establishes compliance with legislation. Check the obligations that apply to your organisation and obtain specialist advice where needed.
Turn the guide into a practical programme.
If you need help defining scope, assessing gaps, or setting realistic priorities, discuss the next step with CyberSolace.
SOURCES & REVIEW
European DIGITAL SME Alliance: updated guide · Publisher’s resource collection · ISO/IEC 27001:2022 overview
Originally published 14 January 2023. Reworked and sources reviewed 20 October 2026. The linked guide is the November 2025 edition.