ISO 27001 is worth it for a small or mid-sized business when it unlocks revenue, such as customers or tenders that require it, or when you need a structured way to manage growing security risk. If nobody is asking for it and basic controls are not yet in place, start with Cyber Essentials and revisit ISO 27001 later.
ISO 27001 is a real investment of time and money, and it does not end with the certificate. For a business with a few dozen or a few hundred staff, the question is not whether the standard is good (it is) but whether the return justifies the effort now. This article sets out how to make that call.
Executive Summary & Key Takeaways
- ISO 27001 pays back fastest when it is a condition of winning or keeping contracts.
- The largest cost is usually internal time, not the certification body’s fee.
- Scope is the main lever. Certifying the service your customers buy, rather than the whole business, keeps effort proportionate.
- Certification runs on a three-year cycle with surveillance audits every year, so budget for the ongoing commitment as well as the first audit.
- A certificate from an accredited certification body carries more weight with buyers than one that is not.
What you are actually buying
ISO/IEC 27001:2022 specifies requirements for an information security management system (ISMS): the policies, processes, risk assessments and reviews you use to manage security as an ongoing activity. ISO describes it as suitable for organisations of any size and sector (ISO, retrieved 20 October 2026). It is widely used, with over 70,000 certificates reported in 150 countries in the ISO Survey 2022.
The standard has two parts. The management system clauses set out what you must do: define a scope, assess risks, set objectives, train people, monitor performance, carry out internal audits and management reviews, and fix what you find. Annex A then lists a reference set of 93 controls across four themes: 37 organisational, 8 people, 14 physical and 34 technological (ISO/IEC JTC 1/SC 27, retrieved 20 October 2026). You decide which apply based on your risks.
Certification is a separate step. An independent certification body audits your ISMS and, if it conforms, issues a certificate. ISO notes that a certificate from an accredited body adds confidence because an accreditation body has independently confirmed the certifier’s competence (ISO, retrieved 20 October 2026). In the UK, that accreditation body is UKAS. Falx is not a certification body; we prepare organisations for the audit.
When ISO 27001 pays back
In our experience, the strongest cases share one or more of these features:
- Lost or stalled deals. Enterprise, public sector or regulated customers have asked for ISO 27001, and its absence is slowing or blocking sales.
- Questionnaire overload. Your team spends days answering security questionnaires that a certificate and Statement of Applicability would largely answer.
- Regulated or sensitive clients. You handle data for financial services, insurance, healthcare or legal clients whose own regulators expect them to vet suppliers.
- Growth beyond informal security. Security has outgrown one person’s head. You need defined ownership, risk assessment and supplier management, and the standard gives you a proven structure.
- Investment or exit. Buyers and investors carrying out due diligence will look for evidence that security is governed, not improvised.
Where these apply, the certificate becomes a sales and governance asset rather than an overhead.
When it is probably not worth it yet
ISO 27001 is a poor fit if:
- No customer, tender or partner is asking for it, and you have no plans to sell to those who would.
- Basic controls are missing. If multi-factor authentication, patching and device management are not in place, a management system will mostly document gaps. The Cyber Security Breaches Survey 2025/2026 found only 47% of UK businesses reported using two-factor authentication and 30% had carried out a cyber risk assessment (DSIT and Home Office, retrieved 20 October 2026). Fixing those comes first.
- Nobody can own it. An ISMS needs someone with time and authority to run it. Without that, certification tends to lapse at the first surveillance audit.
In these cases, Cyber Essentials gives a recognised, independently checked baseline at a fraction of the effort. It also lays the technical foundations ISO 27001 will later build on. Our comparison of Cyber Essentials, ISO 27001 and SOC 2 explains how the three fit together.
What drives effort and cost
We do not publish prices, and any figure without knowing your scope would be guesswork. The cost of ISO 27001 is shaped by a small number of factors.
| model | Why it matters |
|---|---|
| Scope | The people, locations, systems and services covered. A narrow, well-defined scope is cheaper to build, run and audit. |
| Headcount in scope | Certification bodies calculate audit time starting from the number of people doing work under your control within the scope, including contractors (European Accreditation, retrieved 20 October 2026). |
| Starting maturity | Existing policies, asset inventories, access reviews and Cyber Essentials controls shorten the build. |
| Internal time | Control owners, leadership involvement, internal audits and management reviews. Often the largest single cost. |
| External support | Consultancy for gap analysis, risk assessment, policies and audit preparation, typically priced by day rate or fixed scope. |
| Tooling | Some businesses use a compliance platform to collect evidence; others manage well with existing tools. |
| Ongoing cycle | Certification follows a three-year cycle: an initial audit in two stages, annual surveillance audits, then recertification (ISO/IEC 17021-1:2015, clause 9.1.3). |
In-house, outsourced or a mix
You can build an ISMS entirely in-house if you have someone with the experience and the time. Most smaller businesses do not, so a common approach is outside help for the gap analysis, risk method and audit preparation, with the business owning day-to-day operation. The aim should be a system your team can run without depending on the consultant. If a provider offers to both implement your ISMS and certify it, decline: the certificate is only credible if the auditor is independent of the people who built the system.
Getting more value from the same work
ISO 27001 is worth more when the effort counts several times. The same controls and evidence support:
- SOC 2, if US customers ask for it. The AICPA publishes its own mapping between its Trust Services Criteria and ISO 27001 (AICPA, retrieved 20 October 2026). See Do UK companies need SOC 2?.
- UK GDPR, where your security measures form part of the evidence that you protect personal data appropriately.
- Customer due diligence, where a current certificate and scope statement answer most questions quickly.
- Cyber insurance proposals, where documented controls make answers easier to stand behind.
Common mistakes
- Scoping the whole business by default. Start with what customers buy. You can extend the scope later.
- Buying a policy pack and calling it an ISMS. Auditors interview staff and sample records. Policies nobody follows produce nonconformities.
- Treating certification as the finish line. Surveillance audits arrive every year. Budget for the ongoing effort before you start.
- Choosing an unaccredited certifier to save money. A certificate buyers do not recognise saves nothing.
- Skipping the basics. ISO 27001 does not replace multi-factor authentication, patching or backups. It expects them.
Frequently asked questions
Can we follow ISO 27001 without getting certified?
Yes. ISO notes that organisations can implement the standard for the benefit of its good practice without going through certification. That can be a sensible interim step, but customers who ask for ISO 27001 will usually expect a certificate from an independent body.
Can we certify only part of the business?
Yes. You set the scope, so a smaller business might certify a single product, service or location first. Make sure the scope covers what your customers actually buy, because they will check.
Does an unaccredited certificate count?
It depends on who is reading it, and some buyers will not accept one. A certificate from a body accredited by UKAS, or another signatory to the International Accreditation Forum’s recognition arrangement, is the safer choice. UKAS advises procurers to check exactly this when validating certificates.
How much leadership time does ISO 27001 need?
More than most expect at the start, and less once the system is running. The standard expects top management to show leadership and commitment to the ISMS and to review it at planned intervals. In practice that means regular, scheduled involvement rather than a one-off sign-off.
Getting started
The quickest way to decide is a short gap analysis: what you already have, what a sensible scope looks like and what is missing. That turns “is it worth it?” into a concrete comparison of effort against the deals and risks at stake. Our ISO 27001 service starts there, and our compliance support team can keep the ISMS running afterwards. Talk to our team to scope your first step.
Ashley Argyle
Writing about cyber security and technology at Falx.
