Is ISO 27001 Worth It for Small Businesses?

Quick answer: It depends on your market. If customers require it or you're competing for contracts where it's expected, yes. If no one's asking and you just want a certificate for the wall, probably not. The investment only makes sense if there's a return.

When ISO 27001 Is Worth It

Customers require it

Enterprise customers increasingly mandate ISO 27001 from suppliers. If you're hearing "do you have ISO 27001?" in sales conversations, certification removes that objection.

Contracts specify it

Some RFPs and frameworks require ISO 27001 or equivalent. No certification = automatic disqualification.

You want structured security

ISO 27001 forces discipline. Risk assessments, documented processes, regular reviews, continual improvement. The framework makes you better—certification is almost a byproduct.

Cyber insurance is difficult

Some insurers offer better terms for ISO 27001 certified organisations. If you're struggling to get coverage, certification may help.

You're in regulated industries

Financial services, healthcare, defence—sectors where information security is expected. Certification demonstrates commitment.

Competitive differentiation

In markets where competitors aren't certified, ISO 27001 stands out. In markets where everyone has it, you need it to compete.

When ISO 27001 Isn't Worth It

No one's asking

If your customers aren't requesting it, tenders don't require it, and your market doesn't expect it—certification is solving a problem you don't have.

You can't sustain it

ISO 27001 isn't one-time. Annual audits, continuous operation, management commitment. If you'll get certified then let it lapse, don't bother starting.

Budget is severely constrained

£15,000-40,000 for implementation plus ongoing costs. If that's your entire IT budget, you have more pressing priorities.

You just want a logo

Certification without genuine commitment creates bureaucratic overhead without security improvement. Auditors see through paper-only ISMS.

Cyber Essentials meets your needs

For many SMEs, Cyber Essentials Plus provides adequate certification for their market at a fraction of the cost.

The ROI Calculation

Cost:

• Implementation: £15,000-40,000
• Annual maintenance: £3,000-8,000
• Internal effort: Significant

Return:

• Contracts won that required certification
• Contracts retained that would have been lost
• Premium pricing (in some markets)
• Insurance savings (possibly)
• Actual security improvement
• Reduced breach likelihood

If you can point to specific contracts or opportunities that require ISO 27001, calculate their value. Does it exceed the certification cost?

The Honest Assessment

Get ISO 27001 if:

• You can name customers or opportunities that require it
• You're in a market where it's becoming standard
• You'll maintain it properly, not just achieve then ignore it
• You genuinely want to improve your security management

Skip ISO 27001 if:

• You can't articulate who's asking for it
• Cyber Essentials meets your actual requirements
• You're just collecting certifications
• You won't sustain the ongoing commitment

Starting Smaller

If ISO 27001 feels like too much:

1. Start with Cyber Essentials Plus - Achievable quickly, meets many requirements
2. Implement good practices - Risk assessment, policies, incident management
3. Revisit ISO 27001 later - When the business case is clearer

You don't have to do everything at once.

Our Perspective

We're ISO 27001 certified. We went through it ourselves, not just for a logo but because our customers expect it and it makes us better.

We help clients assess whether it's right for them—honestly. Sometimes the answer is "not yet" or "Cyber Essentials is enough." We'd rather give good advice than sell unnecessary projects.

---

- we'll help you decide what's right.

---