Can a small business run ISO 27001 without a compliance team?
Yes. ISO 27001 doesn't say you need a compliance department, and plenty of small businesses run it with one named owner and a few part-time contributors. What you do need is time, a clear owner, and a way to keep records without drowning in paperwork. The real question isn't "do we have a team?" but "who owns this, and can they keep it going when they're busy?"
What the standard asks of you
ISO 27001 asks you to run an information security management system (ISMS). In plain terms: decide what is covered, find out what could go wrong, choose and apply sensible protections, write down the rules, check that people follow them, and review it regularly with senior people involved. The standard expects top management to be involved, so this can't be left entirely to IT.
It isn't a tick-box list. The point is to know your risks, so you spend effort where it matters. A business that understands its risks answers customer questions faster and is less exposed when something goes wrong.
What a small business needs instead of a team
- One owner with protected time. A few hours a week is a realistic starting point, and more at the beginning. It doesn't have to be a security specialist.
- A senior sponsor. Someone who can approve policies and give the owner authority.
- Contributors. The person who looks after IT, the person who hires staff and the person who manages suppliers each know part of the picture.
- A routine. Regular tasks, reviews and internal checks that come round on a schedule, not when someone remembers.
The benefits of doing it properly
- Winning bigger customers. Larger buyers often ask suppliers about ISO 27001, and a working system gives you a credible answer.
- Faster questionnaires. Approved policies and records mean you answer from evidence rather than starting again each time.
- Knowing your risks. You see what matters most and can explain why.
- Less riding on one person. When procedures are written down and owned, the business doesn't stop when one colleague is away or leaves.
Where small teams get stuck
Three problems come up again and again:
- Documents nobody reads. Policies copied from a template and never used. Keep them short and true to how you work.
- No routine. The set-up gets done, then reviews, audits and risk updates slip. Recurring, owned tasks help.
- Everything on one person. If the owner leaves, so does the knowledge. Make sure the records, not their memory, hold the system.
What you can't skip
Software and advisers can save a lot of time, but some things stay with your people: a named person approves your policy and your risks, your senior team reviews the system, and your certification body, not a tool or an adviser, decides whether to certify you. Whether you use an adviser or not is up to you; see can you get ISO 27001 without a consultant? and what ISO 27001 costs in the UK. If your customers are in the public sector, health or telecoms, our pages for public-sector suppliers, NHS suppliers and ISPs and altnets cover what they tend to ask for.
Questions people ask
How many people does it take? There's no fixed number. One owner with a sponsor and a few contributors can work for a small organisation, if they have time and a routine.
Do we need a security specialist? Not necessarily. You need someone organised and with authority, and you may want advice on particular decisions.
Is it a one-off project? No. The system has to keep running, with reviews and improvements, for as long as you want to hold certification.
How ClearIMS helps
ClearIMS is designed for a business where an IT manager, or an individual or very small team, has been handed ISO 27001. A step-by-step setup wizard gets you started, and once AI drafting is activated for your organisation the AI drafts your scope, risk register, Statement of Applicability and policies from a plain-English description of your business. A named person approves every record; the AI never approves anything. ClearIMS works like a virtual ISMS manager: it emails people about outstanding and overdue actions, and they can reply in plain text. Recurring tasks keep audits and reviews coming round on time.
We make the software. Your certification is yours, awarded by your certification body. The price is £300 a month, monthly with 30 days' notice, with unlimited users and no VAT charged.
Book a 20-minute call or try the demo company to see a fully set-up ISMS first.