ISO 27001 certification comes up when a small business starts selling to larger organisations. The honest answer is that it is frequently worth it, for reasons that are commercial rather than security-driven, and it is important to be clear-eyed about that.

What it actually certifies

An information security management system: that you have identified risks, selected controls, documented processes, and operate a cycle of review and improvement. It certifies that you manage security systematically. It does not certify that your systems are secure, which is a distinction buyers frequently misunderstand.

The realistic cost

Certification body fees, likely consultancy support for a first attempt, substantial internal time, and ongoing surveillance audits with recertification every three years. For a small business the largest cost is usually internal time — someone has to own it continuously, not just through the audit.

When it is worth doing

  • Enterprise or public sector clients require it to contract with you.
  • You are losing deals at the security review stage.
  • You handle sensitive data at a scale where systematic management is genuinely needed.
  • You operate in a sector where it is the de facto expectation.

When it is not

If no customer is asking, the money buys more security elsewhere. A business without MFA, tested backups, or logging should fix those before pursuing certification — and would fail meaningfully anyway, because auditors will look for evidence those things operate.

Consider the alternatives first

Cyber Essentials Plus in the UK, SOC 2 for North American software buyers, or simply a well-completed security questionnaire with evidence. Ask the client what they will actually accept before committing — quite often a lighter option satisfies the requirement that triggered the question.

If you proceed

Scope tightly at first. Certifying a defined service or business unit is considerably cheaper than certifying everything, satisfies most commercial requirements, and leaves room to expand. Broad initial scope is the most common way these projects become expensive.