Information security guide
ISO 27001 for small business in Australia: what it takes, costs and timeline
A plain-English guide for owners and directors who’ve been asked for ISO 27001 by a client or tender.
A client has sent through a supplier security questionnaire. Or a tender has a line that reads “ISO/IEC 27001 certification preferred”. Either way, you now need to know what ISO 27001 actually involves for a business of 10 to 100 people, and whether it’s worth it.
This guide covers what the standard asks for, the steps to certification, what drives the cost, a realistic timeline, and how it fits with Australian rules like the Privacy Act and the Essential Eight. It’s written for owners and directors, not IT specialists.
What is ISO 27001?
ISO/IEC 27001 is the international standard for an information security management system (ISMS). An ISMS is the set of policies, processes, roles and controls you use to manage risks to information: client data, staff records, financial information, intellectual property and the systems that hold them.
The key word is management. ISO 27001 isn’t a technical checklist or a piece of software. It asks you to understand your risks, decide how to treat them, put controls in place, check they work and keep improving. The same “plan, do, check, act” approach sits behind ISO 9001 for quality and ISO 45001 for health and safety.
The 2022 version is now the only one that counts
The current edition is ISO/IEC 27001:2022. Certification bodies gave organisations three years to move off the 2013 version, and that transition period ended on 31 October 2025. Certificates to the 2013 version have now expired or been withdrawn. If you’re starting today, you’re working to the 2022 edition (with its 2024 amendment, which added a requirement to consider climate change as part of your organisation’s context).
Annex A: 93 controls in four themes
The 2022 edition lists 93 reference controls in Annex A, grouped into four themes:
| Theme | Number of controls | Examples |
|---|---|---|
| Organisational | 37 | Policies, supplier security, cloud services, incident management |
| People | 8 | Screening, awareness training, remote working |
| Physical | 14 | Secure areas, equipment, clear desk and screen |
| Technological | 34 | Access control, backups, malware protection, logging, secure coding |
You don’t have to implement all 93. You assess your risks, then record in a Statement of Applicability which controls apply, which don’t, and why. For a small business, that keeps the paperwork sensible.
What it takes: the main building blocks
The clauses of the standard (4 to 10) set out what every ISMS must have. In plain terms, you’ll need:
- A clear scope. Which parts of the business, locations, systems and services are covered. A tight, honest scope keeps the effort manageable.
- Leadership commitment. An information security policy, assigned roles and someone accountable at director level.
- A risk assessment and treatment plan. A repeatable method for identifying risks to information, rating them and deciding what to do about them.
- A Statement of Applicability. Your list of Annex A controls, with justification for each one included or excluded.
- Controls that actually operate. Things like multi-factor authentication, access reviews, backups, supplier checks and staff training, with records to show they happen.
- Monitoring, internal audit and management review. You must check your own system and have leadership review it before an external auditor will.
- Corrective action and improvement. When something goes wrong, you fix the cause and record it.
Most of the work is in the risk assessment and in producing evidence that controls run day to day. Templates help, but an auditor will quickly spot a policy that doesn’t match how your team really works.
How certification works in Australia
Certification is done by an independent certification body, not by your consultant. In Australia, look for a certification body accredited by JAS-ANZ (the Joint Accreditation System of Australia and New Zealand), the government-appointed trans-Tasman accreditation body. Accreditation means the certificate will be recognised by clients and tender panels, including internationally.
The steps
- Gap audit. Compare what you already do against the standard and work out what’s missing.
- Build the ISMS. Set the scope, run the risk assessment, write the policies and procedures you need and put controls in place.
- Run it. Operate the system long enough to generate real records: training, access reviews, incidents, supplier checks.
- Internal audit and management review. Both must be completed before the certification audit.
- Stage 1 audit. The certification body reviews your documentation and readiness, and reports any gaps to fix before Stage 2.
- Stage 2 audit. A deeper audit of how the system works in practice: interviews, evidence and testing of controls. Major nonconformities must be closed before a certificate is issued; minor ones need corrective action within an agreed time.
- Certification decision. The certification body makes the final call and issues your certificate.
After certification: a three-year cycle
A certificate is valid for three years. In the years between, the certification body runs surveillance audits, usually annually, each looking at part of the system. At the end of year three there’s a recertification audit, similar in depth to Stage 2, and the cycle starts again. Budget for ISO 27001 as an ongoing commitment, not a one-off project.
What does ISO 27001 cost a small business?
There’s no single price, and anyone quoting a flat figure without knowing your business is guessing. The cost has three main parts.
1. Certification body fees
Certification bodies quote based on audit days, which depend mainly on the number of people in scope, the number of sites and the complexity of your systems. Fees vary between certification bodies, so get at least two quotes and ask what’s included for Stage 1, Stage 2 and each surveillance audit across the full three-year cycle.
2. Consulting and implementation support
This is optional, but most small businesses without an in-house compliance person use outside help. At OHS Talks:
- A gap audit starts from $1,650 per standard (+ GST). You get a clear picture of where you stand and what needs doing.
- A full certification program, or an integrated system combining ISO 27001 with ISO 9001 or ISO 45001, is quoted on scope.
3. Your internal time and any technical fixes
This is often the cost people underestimate. Someone has to own the ISMS, staff need training, and the gap audit may show technical work such as turning on multi-factor authentication everywhere, improving backups or tightening admin access. Some of that work belongs with your IT provider.
How long does it take?
Timelines depend on your starting point, the size of your scope and how much time your team can give it. A business that already has good IT hygiene and some documented processes will move much faster than one starting from scratch.
As a rough guide, plan around these phases:
- Gap audit and planning: a few weeks.
- Building the ISMS: usually the longest phase, depending on the gaps found.
- Operating the system: long enough to produce evidence, complete an internal audit and hold a management review.
- Stage 1 and Stage 2 audits: booked through your certification body. Many certification bodies expect Stage 2 to follow Stage 1 within a set window, so check theirs when you book.
If a tender deadline is driving you, tell your consultant and certification body early, as audit dates can book out.
The Australian context: Privacy Act and Essential Eight
Privacy Act and the Notifiable Data Breaches scheme
Under the Privacy Act 1988, the Notifiable Data Breaches (NDB) scheme applies to businesses with annual turnover above $3 million, plus some smaller businesses, such as private health service providers and those handling tax file numbers. If you suspect an eligible data breach, you must take reasonable steps to assess it within 30 days, and if serious harm is likely, notify affected individuals and the Office of the Australian Information Commissioner (OAIC).
ISO 27001 doesn’t replace your legal obligations, but it helps you meet them. Controls for incident management, access, logging and supplier security make it far easier to detect, assess and respond to a breach. Get legal advice on your specific privacy obligations.
Essential Eight: complementary, not a replacement
The Essential Eight, from the Australian Signals Directorate’s Australian Cyber Security Centre (ACSC), is a set of eight technical mitigation strategies: application control, patching applications, configuring Microsoft Office macros, user application hardening, restricting admin privileges, patching operating systems, multi-factor authentication and regular backups. It’s measured on maturity levels from zero to three.
The two work at different levels:
- Essential Eight is a technical baseline for hardening your systems. It isn’t a certification.
- ISO 27001 is a management system covering governance, risk, people, suppliers and physical security, with independent certification.
Many Australian businesses use the Essential Eight as the technical backbone of their ISO 27001 controls. If a client asks for both, you can plan them together rather than as two separate projects.
Is ISO 27001 right for your business?
It’s usually worth it if you hold sensitive client data, sell to government or larger corporates, keep getting security questionnaires, or are losing tenders without it. It may be overkill if no client is asking and your information risk is low. In that case, the Essential Eight and good basic practices may be the better first step.
If you already hold, or plan to get, ISO 9001 or ISO 45001, an integrated system can share the same document control, internal audits and management reviews. See our WHS consulting page if safety compliance is also on your list.
Frequently asked questions
Can a small business get ISO 27001 certified?
Yes. The standard applies to organisations of any size. Smaller businesses often have an advantage: fewer systems, fewer people and faster decisions. The key is a sensible scope and controls that match your real risks.
Do we have to implement all 93 Annex A controls?
No. You select controls based on your risk assessment and justify any exclusions in your Statement of Applicability.
Is the Essential Eight the same as ISO 27001?
No. The Essential Eight is a technical maturity model from the ACSC with no official certificate. ISO 27001 is a certifiable management system standard. They work well together.
Who issues the ISO 27001 certificate?
An independent certification body. In Australia, choose one accredited by JAS-ANZ. Your consultant helps you prepare but can’t certify you.
Can our 2013 certificate still be used?
No. The transition period ended on 31 October 2025, so certificates to ISO/IEC 27001:2013 are no longer valid. An organisation whose old certificate lapsed will generally need a full initial audit to the 2022 version.
Talk to an ISO 27001 consultant in Melbourne
OHS Talks Pty Ltd is a Melbourne ISO and WHS consultancy led by Muhammad Shibli Aslam, an ISO lead auditor. We’ll help you scope ISO 27001 properly, find the gaps and build a system that fits a small business.
Learn more about our ISO 27001 consulting service, or book a free 20-minute scoping call to talk through your client or tender requirements.
Book a free 20-minute call ISO 27001 packages