Example of ISO 27001 implementation in a business

Example of ISO 27001 implementation in a medium-sized company

Let's consider a hypothetical Bulgarian trading company with 85 employees, a central office and a warehouse. It operates with an ERP system, cloud mail, CRM, an online store and external couriers. Some employees work remotely, and IT support is provided by an external partner.

The management decides to implement an information security management system according to ISO 27001 for three specific reasons. The company processes personal data of customers and employees, several large corporate clients require demonstrable security measures, and an interruption of the ERP or online orders directly leads to lost sales and delayed deliveries.

At the beginning, the organization does not have a single picture of the risks. There is antivirus protection, backups and password policies, but it is not clear whether all important systems are backed up, who approves access to financial data and what to do if a company laptop is lost. This is a typical starting point for many small and medium-sized enterprises.

The first step is scope, not documentation

The company does not include all its activities without analysis. It defines the scope of the information security management system: IT infrastructure, cloud services, ERP, CRM, online ordering system, customer data processing and customer service processes.

This decision has practical implications. If the scope is too broad at the beginning, the project becomes difficult to control and requires disproportionate resources. If it is too narrow, systems and processes that actually affect security are left out. The appropriate scope follows the flow of important information, not just the list of servers.

Management designates an owner for the information security management system. This could be an internal IT manager, COO, or other employee with sufficient organizational clout. The external IT partner assists with the technical side, but cannot replace management’s decision on acceptable risk, budget, and priorities.

Risk assessment shows where the weak spots are

Next, an inventory of assets is taken: devices, applications, user accounts, data, vendors, network connectivity, and physical premises. The company finds that the most significant risks are not necessarily the most sophisticated technical attacks.

Among the scenarios identified are a compromised email account of a finance employee, unauthorized access to the ERP by a former employee, encryption of a file server by ransomware, failure to successfully restore from a backup, and interruption of Internet connectivity in the warehouse.

Each risk is assessed according to its likelihood of occurrence and the impact on the business. For example, in the case of a compromised email, the impact could include fake payment orders, leaking offers, accessing customer correspondence, and distributing fraudulent messages from a trusted address.

Here, ISO 27001 does not require a single formula. What is important is that the method is clear, repeatable, and approved. The company must be able to show why a given risk is assessed as high and what decision has been made about it: reduce, transfer, avoid, or accept.

Controls are selected according to risk

For the risk of a compromised email account, the company implements multi-factor authentication, conditional access rules, and anti-phishing. Access to financial systems is restricted by role, and requests to change a supplier's bank details are confirmed through a second channel.

For the risk of access by departing employees, a formal process is introduced for hiring, changing positions, and leaving. Human Resources notifies the responsible persons, the IT team deactivates the accounts within a certain period of time, and the employee's manager confirms the transfer of the necessary files and official information.

Backups also receive specific rules. Data is backed up on a schedule, the copies are stored separately from the main environment, and the recovery is tested periodically. A backup that has never been successfully restored is not proof of continuity.

Backup internet connectivity and a procedure for working in the event of a failure of the main channel are provided for the warehouse. Not every company needs a complete duplication of all systems. The decision depends on the cost of downtime. If one hour without access to orders brings significant losses, a backup channel and a clear response plan are a justified expense.

Policies must lead to action

ISO 27001 requires a documented system, but good documentation is not written just for the auditor. It tells people what to do in a real-world situation. An acceptable use of IT resources policy, access management procedure, remote work policies, and an incident response plan should be concise, understandable, and actionable.

In the example, an employee who receives a suspicious email knows where to report it. The manager knows how to request or revoke access. The IT team knows who can approve an emergency change to a critical system and how it is documented afterward.

That’s why the procedures are tested. The company runs a simulation of a phishing campaign and a separate exercise to recover a critical database. The goal is not to find a culprit, but to measure response time, communication quality, and process gaps.

People and suppliers are part of the system

Many incidents start with human error, but training should not be limited to a one-time presentation. New employees undergo an initial orientation, and everyone else receives short, periodic training on phishing, passwords, handling sensitive information, and incident reporting.

The company also reviews its relationships with external vendors. The cloud provider, the payroll company, the telecommunications operator, and the IT support partner may process or have access to information. Contracts and work procedures should define security requirements, incident notification, responsibilities, and conditions for terminating access.

There is an important balance here. A small business cannot conduct a full audit of every vendor. However, it can classify vendors according to their criticality and set stricter requirements where the risk is higher.

What does an internal audit and certification look like

Once the processes have been running for a sufficient amount of time and there is evidence of their implementation, the company conducts an internal audit. Not only are the policies checked, but also records of granted access, archive test results, incident logs, employee training, vendor evaluation, and implementation of risk measures.

Nonconformities identified are recorded, analyzed, and corrected. For example, an internal audit may find that two employees who have left have access to a secondary cloud platform still active. The corrective action is not just closing both accounts. The process needs to be improved so that the list of all systems is checked upon each exit.

After a management review, a certification audit by an accredited certification body follows. The auditor will look for a connection between the context of the organization, the risks, the selected controls, and the evidence that they are being implemented. Certification does not mean zero risk. It shows that the organization manages risk systematically and maintains a process for continuous improvement.

What is the measurable business result

After implementation, the company does not just have a certificate to attach to a tender or customer questionnaire. It has clearer accountability for access, shorter response times to suspicious events, verified recovery capabilities, and better visibility into its critical suppliers.

For the manager, the most valuable result is predictability. There are now concrete answers to the questions of which systems are critical, what happens in an incident, when recovery is tested, and who reports status. For the internal IT team or external technology partner, this turns fragmented tasks into a managed, prioritized process.

The best time to start is not after a major customer requirement or after an incident. Start with a realistic picture of your systems, data, and dependencies. Even the first risk assessment often reveals measures that can mitigate risk before the certification project is even complete.