ISO27001 Implementation alongside BAU/Projects in the UK - 4 person team
​
Hi all,
I'm a IT at a UK organisation with approximately 570 employees, supported by a relatively small IT team of four people, including myself.
We're exploring how to align our existing information security governance, policies and operational practices with ISO 27001:2022, with the longer-term ambition of achieving formal certification.
We already have an overarching Information Security Policy with supporting policies, standards and procedures, alongside established technical security controls. However, we haven't previously implemented a full ISO 27001 ISMS and we're also doing large scale, organisation wide projects (new networks, new erp system, and the entire team being less than 6 months in).
My biggest concern isn't necessarily the technical controls, but understanding how to structure and manage the implementation alongside our existing responsibilities.
I'm particularly interested in hearing from people who have implemented ISO 27001 within similarly sized organisations, especially those with small internal IT teams.
A few questions:
Where would you start? Would you begin with a formal gap assessment, defining the ISMS scope, reviewing existing policies or something else?
(Every other thing at this organisation has been poor so I've taken a clean slate approach to everything so far, e.g. new desktops/OS, new servers, new networks).
How would you structure the project? Would you approach it in phases, allocate specific workstreams to individuals or appoint a dedicated internal lead? If a dedicated lead, who - we don't have certified ISO implementers.
How much resource is realistically required? Can a four-person IT team deliver most of the implementation alongside BAU responsibilities, or should we consider additional resource or external consultancy?
How many hours does an audit take from IT staff ?
How do you distribute responsibility? Given that ISO 27001 covers much more than IT, how did you involve HR, Finance, senior leadership and other departments?
We don't do software development so I plan on excluding any mentions of that in the SoA.
How did you manage documentation and evidence? Did you use dedicated ISMS software, SharePoint, spreadsheets or a combination?
How did you avoid creating unnecessary administrative overhead?
What would a realistic implementation timeline look like? Particularly if the initial objective is ISO alignment, followed by certification.
What would you do differently? Any lessons learned, common mistakes, training recommendations or things you wish you'd known before starting?
I'm not looking to simply produce documentation for an audit, although that is nice to do.
I'd like to build a functioning, sustainable ISMS that genuinely improves the standard at the organisation, so that the rest of the business can also improve too "hey, look at IT, they're ISO27001 certified, we should aim for something similar" type of rhetoric so that the standard across the organisation raises. (It's a badly optimised workplace.)
I'm also keen to develop the knowledge internally rather than becoming completely dependent on consultants.
I'd really appreciate any practical experiences, recommendations or examples of how others have approached this.
I appreciate it's a lot to read so thanks if you got this far.
Thanks in advance!