Guides
Plain-English ISO 27001 guides for businesses without a compliance team.
A customer has asked for ISO 27001: what to do in the first two weeks
5 min read · UpdatedA customer has asked if you have ISO 27001. A plain-English plan for the first two weeks: what to ask, what to gather and how to give an honest answer.
Can a small business run ISO 27001 without a compliance team?
5 min read · UpdatedYes, many small businesses run ISO 27001 with one owner and the right tools. What the work involves, what to expect from a small team, and what to watch for.
Do we need ISO 27001 to win a public sector contract? What buyers actually ask for
5 min read · UpdatedPublic sector buyers ask for different things depending on the contract. How to read what a tender really requires, and how to show a working security system.
How much does ISO 27001 cost for a small business, and what drives the cost?
5 min read · UpdatedThe costs behind ISO 27001 for a small business, what makes them go up or down, and the questions to ask before you budget. Includes ClearIMS's published price.
How to answer a supplier security questionnaire when you don't have ISO 27001 yet
5 min read · UpdatedHow to answer a customer's security questionnaire honestly and quickly without ISO 27001: what to say, what to attach and how to stop starting from scratch.
Internal audits and management review without a compliance team
5 min read · UpdatedHow a small business can run ISO 27001 internal audits and management reviews that are useful, independent enough and finished on time, without a compliance team.
Surveillance audit preparation for a small team: what gets forgotten between audits
5 min read · UpdatedSurveillance audits check that your ISMS has kept running since the last visit. What small teams forget between audits, and a routine that keeps it from becoming a scramble.
What a virtual ISMS manager does day to day: got 5 minutes or 5 hours?
5 min read · UpdatedWhat it looks like to run ISO 27001 as a small team: reminders by email, replies in plain text and a Recommended tasks list that works whether you have 5 minutes or 5 hours.
When one person holds the whole ISMS: make ISO 27001 survive a holiday, a resignation or a busy quarter
5 min read · UpdatedIn many small firms one person carries ISO 27001. How to spread the load so the ISMS keeps running through leave, a resignation or a busy quarter.
A tender asks for ISO 27001 and you don't have it yet: what to do
8 min read · UpdatedHow to read the requirement, what to ask the buyer, what to write in your response, and the evidence that makes "working towards ISO 27001" credible.
How long does ISO 27001 take for a small UK business?
8 min read · UpdatedUsually several months from start to certificate. Why, a phase-by-phase timeline, what speeds it up, and what to do if a tender is due in weeks.
Cyber Essentials for law firms and accountants: what clients, lenders and insurers expect
8 min read · UpdatedWhy law firms and accountancy practices are asked for Cyber Essentials, what the five controls mean in a small practice, and how to get it done.
DSPT vs ISO 27001: what NHS suppliers actually need
8 min read · UpdatedDo NHS suppliers need ISO 27001, the DSPT or both? How the Data Security and Protection Toolkit, ISO 27001 and DTAC differ, and where they overlap.
ISO 27001 and Cyber Essentials for charities: what funders and partners ask for
8 min read · UpdatedWhy charities get asked for Cyber Essentials or ISO 27001 by commissioners, funders and partners, which to do first, and how to keep it going with a small team.
ISO 27001 and Cyber Essentials for logistics, freight and transport firms
8 min read · UpdatedWhy retailers, the NHS, defence primes and ports ask hauliers, forwarders and 3PLs for security assurance, the risks they worry about, and what to do first.
ISO 27001 checklist: every step to certification for a small business
9 min read · UpdatedA practical ISO 27001:2022 checklist for small UK businesses: clauses 4 to 10, the Annex A controls, the records an auditor will ask for, and the audit itself.
ISO 27001 for MSPs and IT support companies: for you and for your clients
8 min read · UpdatedWhy clients ask their MSP about ISO 27001, what an MSP's own ISMS has to cover, and how to help clients with it without becoming a consultancy.
ISO 27001 for SaaS and software companies selling to enterprise and the public sector
9 min read · UpdatedWhy enterprise and public-sector buyers ask SaaS companies for ISO 27001, how to scope it, the Annex A controls that matter, and ISO 27001 vs SOC 2 in the UK.
ISO 27001 policies list: what's mandatory and what's typical
8 min read · UpdatedWhich documents ISO 27001:2022 actually requires, which topic-specific policies most small businesses write for Annex A, and how to keep the list short.
The Telecoms Security Act for small ISPs and altnets: where ISO 27001 fits
8 min read · UpdatedWhat the Telecommunications (Security) Act 2021, the 2022 regulations and the Code of Practice tiers mean for a small ISP or altnet, and where ISO 27001 fits.
Using AI assistants like ChatGPT and Claude with ISO 27001: what's safe and what isn't
8 min read · UpdatedWhere AI assistants genuinely help with an ISO 27001 ISMS, where they create risk, what MCP is, and a checklist for connecting one safely.
Can you get ISO 27001 without a consultant?
8 min read · UpdatedYes, many small businesses do. What it takes, where people get stuck, a step-by-step route, and when a consultant is still worth paying for.
Cyber Essentials vs ISO 27001: which do you need?
7 min read · UpdatedThe difference between Cyber Essentials and ISO 27001, what each costs and proves, and which to do first if a customer or tender is asking.
How much does ISO 27001 cost a small UK business?
8 min read · UpdatedWhat ISO 27001 really costs a UK business of 10 to 250 people in 2026: the certification audit, consultants, software and your own time, with typical ranges.
ISO 27001 for manufacturers: when your customers start asking
6 min read · UpdatedWhy manufacturers and engineering firms get asked for ISO 27001 or Cyber Essentials by their customers, what's different on a factory floor, and how to get there without a compliance team.
ISO 27001 for recruitment agencies: do you need it, and what's involved?
6 min read · UpdatedWhy recruitment agencies get asked for ISO 27001 and Cyber Essentials, what the auditor will look at in an agency, and how to get there without hiring a compliance person.
ISO 27001 for software development companies
6 min read · UpdatedWhy clients ask software houses and agencies for ISO 27001, what the auditor looks at in a development team, and how to get there without slowing delivery.
ISO 27001 in Hull and East Yorkshire
4 min read · UpdatedFor Hull and East Yorkshire businesses being asked for ISO 27001 or Cyber Essentials: what it involves, what it costs, and a local way to get there without a compliance team.
ISO 27001 software: what to look for (UK buyer's checklist)
6 min read · UpdatedA plain-English checklist for choosing ISO 27001 software as a UK small or mid-sized business: approvals, ongoing running, auditor access, pricing traps and honest claims.
ISO 27001 templates vs software: which is right for you?
5 min read · UpdatedTemplate packs are cheap; software costs more each month. Here's what each actually saves you, where templates break down, and how to choose for a small UK business.
What is a customer security questionnaire, and how do you answer one?
7 min read · UpdatedWhy customers send security questionnaires, what they ask, how to answer them quickly and honestly, and how ISO 27001 makes the next one easier.