# Maintain ISO 27001 with a Small Team | AuditBadger For small teams sharing the work # Keep ISO 27001 running with a small team A part-time owner can coordinate your information security management system when management provides time and authority, and teammates own the controls they operate. Keep risks, decisions and evidence current as the business changes. ISO 27001 calls for maintaining and improving the ISMS, so the work continues between certification visits. [See pricing](/pricing/)[How it works](/features/) 01 / Is this you ## Is this you? ✓One person coordinates compliance alongside another job ✓You already have an ISMS, or want your first one to survive beyond the audit ✓New hires, suppliers and product changes keep moving the target ✓You need a routine that still works when the owner is away 02 / Why it's different ## Why compliance hits differently for you. 01 ### The coordinator becomes the bottleneck Every review and evidence request lands with the same person, even when someone else runs the process. Give each task a process owner, a due date and a clear completion record. The coordinator follows up on gaps instead of trying to do every job. 02 ### Your documents describe last year's company The risk register names an old supplier. A policy assumes a reviewer who has left. A new service handles customer information but isn't reflected in the records. Build a check for affected ISMS documents into the changes you already plan. 03 ### Audit preparation becomes reconstruction If decisions live in chat and evidence gets collected only before the next audit, you have to rebuild the story. Keep dated records alongside the work, and use your recurring check-in to find missing decisions or unfinished actions while someone can still resolve them. 03 / A worked example ## A new supplier joins your stack. What changes in the ISMS? Suppose your team wants to replace its customer-support tool. An operations lead runs the purchase; a part-time compliance owner coordinates the security review. This is an illustrative workflow for keeping records and responsibilities connected, not a universal approval checklist or a claim that software makes the decision for you. Step 01 The operations lead describes the proposed service, what information it will hold, who will access it and which existing service it replaces. Capture the business purpose and intended start date in the change record. The compliance owner checks which parts of the ISMS may be affected before the new supplier becomes an undocumented dependency. Step 02 Assign the assessment work to people who can answer it. A technical owner checks authentication, access and integration settings; the person responsible for contracts reviews the relevant terms. Collect supplier evidence that answers your questions and note its date. Escalate questions that need specialist advice rather than asking the coordinator to guess. Step 03 Review the risks and record the decision using your existing risk process. Identify any treatment actions, their owners and the person authorized to accept remaining risk. If approval depends on a configuration change or contract term, keep that condition visible. An uploaded supplier certificate alone does not explain whether the service is suitable for your use. Step 04 Update the affected records together: supplier and information-asset records, relevant risks, operating instructions and control documentation. Check whether the Statement of Applicability needs a change if your control decisions changed. Keep accurate existing entries and document the reason for revisions, so another owner can understand the decision later. Step 05 The operations lead confirms the agreed actions are complete, including the old service's access and data-handling arrangements. The compliance owner checks that the decision and completion evidence can be found, then records who will review the supplier next and when. Open issues stay assigned until someone verifies their resolution. Takeaway One person coordinates the ISMS; the people running the service supply the facts and carry out the work. Use the same handoff for other changes, such as a new system, a role change or a revised customer commitment, and scale the review to the risk. 04 / Two frameworks ## SOC 2 and ISO 27001, shaped to your reality. Same platform, two frameworks. Pick one, start with both, or switch later. SOC 2 The report US buyers ask for. - ✓Scoped to what you actually run — nothing inherited from a 500-person template - ✓One-person-ownable workflow with clear next actions - ✓Automated evidence so audit week isn't a fire drill - ✓Auditors we've worked with who understand small teams [Explore SOC 2 →](/soc2/) ISO 27001 The certificate European and enterprise buyers want. - ✓ISMS that fits on a small team's actual practices - ✓Risk register you'll genuinely update, not one that dies in a spreadsheet - ✓Realistic roadmap to certification and surveillance audits - ✓Controls proportionate to your size — not theatre [Explore ISO 27001 →](/iso27001/) 05 / Between audits ## Give the ongoing work a place in your calendar. This weekly and monthly rhythm is a suggested starting point, not an ISO-mandated schedule. Set control and review frequencies for your risks and commitments, and document the plan. Keep urgent incidents and time-sensitive tasks moving when they occur. Each week: coordination ### Check exceptions and the next due work Use a regular check-in to review overdue actions, failed evidence collection, reported incidents and upcoming tasks. Ask the relevant owner for a next action and completion record. Escalate a blocked decision to someone with authority to resolve it. Do not wait for this meeting to handle urgent security work. Each month: an operating check ### Check that the records still describe reality Review recent changes and a selection of completed tasks with their owners. Can you follow the decision, its evidence and any follow-up without relying on a private chat? Look for changed suppliers, responsibilities or systems that have not reached the ISMS records. Record what needs correction, who will do it and how completion will be checked. When the business changes ### Revisit the affected risks and controls Make significant service, supplier, organizational and customer-requirement changes visible to the compliance owner. Use the change to identify which risk assessments, policies or control decisions need attention. Keep the rationale for changes and involve the people who understand their consequences. A calendar review is not a reason to leave a new risk unaddressed. At your planned review dates ### Keep internal audit and management review distinct Plan internal audits with competent reviewers and an objective, impartial process. Bring management the ISMS performance information and decisions that need its attention, including risks, findings and resources. Keep review decisions and follow-up records. Your routine task check-in supports these activities; it does not replace them. Refer to ISO 27001 clauses 9.2 and 9.3 when planning their scope and inputs. Before absence or handover ### Let the backup run the next task Name a backup and give them appropriate access to the calendar, current documents, open issues and escalation contacts. Have them complete a scheduled task while the owner is still available to answer questions. Record missing context and clarify approval responsibilities. Before an external audit, also confirm the audit plan and the availability of the people who operate the controls. 06 / How it works ## How AuditBadger handles it. ### One-owner workflow The platform's task list, reminders, and next-actions are built so one person — part-time — can drive the program end to end without blocking engineering. [Learn more →](/features/compliance-management/) ### Scheduled evidence collection The single biggest time-saver for small teams. Evidence is pulled from AWS, GCP, Azure, DigitalOcean, Scaleway, GitHub and Cloudflare monthly, plus on demand, so audit prep is review, not creation. [Learn more →](/features/automated-evidence-collection/) ### Assessment library kills questionnaire fatigue Small teams get asked the same questions by every enterprise prospect. Answer once, reuse forever. This is the single highest-leverage feature for small teams selling up-market. [Learn more →](/features/assessment-management/) ### Training sized for small teams Role-appropriate security training in 30–60 minutes per person per year, tracked automatically. No mandatory two-hour modules on topics irrelevant to an 8-person team. [Learn more →](/features/training-awareness/) ### Proportional vendor management Small teams have 10–30 vendors, not 300. The workflow reflects that — quick assessments for low-risk vendors, real depth for the few that matter. [Learn more →](/features/vendor-assessment/) ### AI assistant as compliance buddy For judgment calls that would otherwise need a consultant — 'do we need a DPO given our size?', 'is quarterly access review enough?' — the assistant answers using your specific context. [Learn more →](/features/ai-compliance-assistant/) 07 / What auditors ask ## What auditors actually ask teams like yours. Real questions we've seen in SOC 2 and ISO 27001 audits for your cohort — and what a good answer looks like. Q How do you handle segregation of duties given your team size? A Auditor isn't trying to trap you — they want to see you've thought about it. Good answer: named compensating controls (peer review, dual approval, logging), each documented and enforced. Bad answer: 'we trust each other'. Q How do you keep the program running when someone is on vacation or leaves? A Small-team continuity question. Expect to cover: documentation in the platform (not in one person's head), backup approvers for critical actions, offboarding checklist. The point is that the program survives personnel changes. Q Show me your last quarterly access review. A For small teams this is often the weakest point because it's easy to forget. A platform that schedules it, runs it against live IAM, and logs decisions is usually the difference between a clean finding and an exception. Q What's the smallest incident you logged in the last 12 months? A Auditor is checking your bar for 'incident' isn't set so high that you never log anything. A near-miss, a minor outage, a botched deployment — all reasonable incidents for a small team. 'We've never had one' is a yellow flag. 08 / FAQ ## Questions we hear a lot. #How can I maintain ISO 27001 compliance with a small team?+ Give one person responsibility for coordinating the ISMS, with time and authority to follow up. Share control tasks with the people who operate each process, keep dated evidence, and revisit the records when the business changes. Maintain the planned internal audits, management reviews and improvement work alongside the day-to-day routine. #Can one part-time owner handle the whole ISMS?+ A part-time owner can coordinate the work if its scope fits their capacity and management supports them. They still need input from process owners, appropriate reviewers and people authorized to make decisions. If overdue work grows or critical decisions wait for one overloaded person, change the allocation of work or add capacity. #How many hours should we budget for ongoing ISO 27001 work?+ Build the estimate from your actual tasks, their frequency and the people needed to complete them. Track time spent on routine work separately from changes, incidents, questionnaires and audit preparation, then adjust the allocation. There is no reliable fixed weekly-hour promise for every small team; a new service or unresolved finding can change the workload. #Can our compliance owner also perform the internal audit?+ Plan for competence, objectivity and impartiality rather than assuming that a different job title solves the issue. Someone reviewing controls they designed or operate may have a conflict; use a suitably competent colleague or external support where needed. Document who reviews which work and how you address conflicts in the audit process. #What happens when our compliance owner is away or leaves?+ A named backup needs access to the current calendar, decisions, evidence and open issues, plus clear approval and escalation contacts. Test the handover by having them perform the next real task before the owner leaves. As the team grows, distribute responsibilities with the work rather than routing every decision back through the original coordinator. #What records should stay current between audits?+ Keep the ISMS scope, risks and treatment decisions, Statement of Applicability, policies and responsibilities aligned with actual practice. Retain records of control activities, relevant changes, reviews, findings and corrective actions so you can explain what happened and what you improved. Confirm the evidence needed for each external audit with your certification body instead of treating this overview as its complete request list. Small-team maintenance guidance reviewed 21 September 2026. - [ISO: ISO/IEC 27001 and maintaining an ISMS](https://www.iso.org/standard/27001) - [NQA: ISO 27001, ongoing reviews and certification](https://www.nqa.com/en-gb/resources/knowledge-hub/iso-27001-guide) - [BSI: the role of an independent, objective internal audit](https://www.bsigroup.com/en-US/products-and-services/internal-audit/) ## Ready to stop postponing this? Get SOC 2 or ISO 27001 on your terms — without a consultant, without a full-time compliance hire, without the dread. [See pricing](/pricing/)[See all features](/features/) We use only essential cookies and privacy-friendly, cookieless analytics ([Plausible](https://plausible.io/privacy-focused-web-analytics)). No advertising or cross-site tracking. [Cookie Policy](/cookie/). Got it