ISO 27001 Essentials Compliance
A curated subset of the 30 most critical ISO 27001 Annex A controls, extending ISO 27001 Starter with broader coverage across risk management, supplier security, and data protection.
Overview
ISO 27001 Essentials selects the 30 most critical controls from ISO 27001:2022 Annex A.
It extends the 15 controls in Starter with supplier security, data protection, business continuity, and advanced technical controls.
The framework is a MyCISO derivative - not certifiable but closely aligned with certification requirements.
Implementation takes three to six months after Starter completion, with progress tracked in the MyCISO platform.
Essentials is step two of three: Starter (15) > Essentials (30) > Full ISO 27001 (93 controls).
Key Areas
- All 15 controls from ISO 27001 Starter, plus:
- A.5.3 - Segregation of duties
- A.5.9 - Inventory of information and associated assets
- A.5.12 - Classification of information
- A.5.14 - Information transfer policies
- A.5.19 - Information security in supplier relationships
- A.5.23 - Information security for cloud services
- A.5.26 - Response to information security incidents
- A.5.29 - Information security during disruption (business continuity)
- A.5.34 - Privacy and protection of personal information
- A.8.2 - Privileged access rights
- A.8.3 - Information access restriction
- A.8.10 - Information deletion
- A.8.12 - Data leakage prevention
- A.8.24 - Use of cryptography
- A.8.25 - Secure development lifecycle
Who It's For
- Organisations that have completed ISO 27001 Starter and want to expand coverage
- Mid-market businesses preparing for formal ISO 27001 certification within 12 months
- Organisations that need to demonstrate substantial ISO alignment to customers or regulators
- Security teams building a phased ISO 27001 implementation roadmap
- Companies managing supplier relationships that require demonstrated security controls
Core Requirements
- Policies and Governance
- Building on Starter's policy foundations, Essentials requires policies for information classification (A.5.12), data transfer (A.5.14), supplier security (A.5.19), cloud services (A.5.23), and privacy (A.5.34). Segregation of duties (A.5.3) should be documented and enforced.
- Risk Management
- A more formal risk assessment process should be established, incorporating asset inventory (A.5.9) as an input. Risk treatment should consider supplier risks (A.5.19), business continuity scenarios (A.5.29), and data classification levels (A.5.12).
- Security Controls
- Technical controls expand to include privileged access management (A.8.2), granular access restrictions (A.8.3), data leakage prevention (A.8.12), cryptographic controls (A.8.24), secure development practices (A.8.25), and information deletion procedures (A.8.10).
- Incident Response
- Extend the Starter incident process with structured response procedures (A.5.26) that include evidence preservation, root cause analysis, regulatory notification requirements, and lessons-learned reviews.
- Evidence and Reporting
- Evidence requirements expand significantly. Maintain an asset inventory, classification records, supplier assessments, access reviews, cryptographic key management records, and business continuity test results. The MyCISO platform manages this evidence centrally.
Implementation Steps
- Assess expanded scope - If you have completed Starter, your existing scores carry forward. Assess your maturity against the 15 additional Essentials controls to establish the new baseline.
- Asset and data management - Build an information asset inventory (A.5.9), classify assets by sensitivity (A.5.12), and define handling procedures for each classification level.
- Supplier and cloud security - Identify critical suppliers and cloud services. Conduct security assessments (A.5.19) and define security requirements for cloud service usage (A.5.23).
- Technical expansion - Implement privileged access management, data leakage prevention, cryptographic controls, and secure development practices. These are the most technically complex controls in Essentials.
- Business continuity - Develop business continuity plans that address information security during disruptions (A.5.29). Conduct at least one test or tabletop exercise.
- Prepare for full ISO 27001 - Review your maturity across all 30 Essentials controls. Identify the remaining 63 controls needed for full ISO 27001 compliance and develop a timeline for the final stage.
Frequently Asked Questions
- Do I need to complete Starter before Essentials?
- It is recommended but not required. Essentials includes all 15 Starter controls plus 15 additional controls. If your organisation already has foundational controls in place, you can start directly with Essentials.
- How close to full ISO 27001 is Essentials?
- Essentials covers 30 of the 93 Annex A controls. However, these 30 controls represent the most impactful and commonly examined controls. Organisations that complete Essentials typically find the remaining 63 controls easier to implement because the core practices are established.
- Can Essentials satisfy customer due diligence requirements?
- While it is not a formal certification, demonstrating structured implementation of 30 ISO-aligned controls with evidence in the MyCISO platform can significantly strengthen your position in customer security assessments.
- What about the ISMS management system requirements?
- Essentials focuses on Annex A controls only. Full ISO 27001 certification also requires implementing the ISMS management system (clauses 4-10). These are addressed when you progress to the full standard.
Why It Matters
- Essentials covers the controls that address approximately 80% of the most common audit findings. Organisations that implement these 30 controls are substantially better prepared for certification than those attempting to address all 93 controls at once without prioritisation.
- The additional controls in Essentials address critical areas like supplier risk, data protection, and business continuity that are increasingly important in customer due diligence and regulatory expectations.
- By progressing through Starter and Essentials before attempting full certification, organisations avoid the common pitfall of trying to do everything at once, which leads to superficial implementation and audit failure.
Common Challenges
- Underestimating the effort required for a complete asset inventory, which underpins classification and risk assessment
- Implementing cryptographic controls without a clear key management process
- Supplier assessments creating friction with commercial relationships if not handled diplomatically
- Business continuity planning being deprioritised because it feels theoretical until a real disruption occurs
- Data classification schemes that are too complex for staff to follow consistently
- Secure development requirements conflicting with rapid delivery timelines in development teams