ISO 27001 Starter Compliance

Overview

ISO 27001 Starter selects the 15 most critical controls from the ISO 27001:2022 Annex A catalogue.

It is a MyCISO derivative framework - not a standalone standard and not certifiable.

The framework covers governance, access control, endpoint protection, incident response, and awareness.

Implementation typically takes four to eight weeks with progress tracked in the MyCISO platform.

Starter is step one of a three-stage path: Starter (15 controls) > Essentials (30 controls) > Full ISO 27001 (93 controls).

Key Areas

• A.5.1 - Policies for information security
• A.5.2 - Information security roles and responsibilities
• A.5.10 - Acceptable use of information and associated assets
• A.5.15 - Access control policy and management
• A.5.24 - Information security incident management planning
• A.6.3 - Information security awareness, education and training
• A.6.5 - Responsibilities after termination or change of employment
• A.7.1 - Physical security perimeters
• A.8.1 - User endpoint devices
• A.8.5 - Secure authentication
• A.8.7 - Protection against malware
• A.8.8 - Management of technical vulnerabilities
• A.8.9 - Configuration management
• A.8.13 - Information backup
• A.8.15 - Logging and monitoring

Who It's For

• Organisations exploring ISO 27001 for the first time
• Small businesses that want ISO-aligned security without full certification overhead
• IT managers tasked with preparing the organisation for future ISO 27001 certification
• Organisations that need to demonstrate ISO-aligned practices to customers or partners
• Companies that completed MyCISO Getting Started and want an ISO-focused progression path

Core Requirements

Policies and Governance

Establish an information security policy (A.5.1), define roles and responsibilities (A.5.2), and publish acceptable use guidelines (A.5.10). These three controls form the governance foundation for all other controls.

Risk Management

While ISO 27001 Starter does not require a full ISMS risk assessment, organisations should identify the key risks that the 15 selected controls are designed to mitigate. This builds the risk-thinking discipline needed for the full standard.

Security Controls

Implement technical controls covering endpoint protection (A.8.1), secure authentication including MFA (A.8.5), malware protection (A.8.7), vulnerability management (A.8.8), secure configuration (A.8.9), backup (A.8.13), and logging (A.8.15).

Incident Response

Establish an incident management process (A.5.24) that defines how security incidents are reported, triaged, and resolved. At this stage, a clear escalation path and basic response procedures are sufficient.

Evidence and Reporting

Document the implementation status of each control and maintain evidence such as policy documents, access control configurations, backup logs, and training records. The MyCISO platform tracks this automatically.

Implementation Steps

1. Select and assess - Activate the ISO 27001 Starter framework in MyCISO and complete the initial assessment against all 15 controls. This establishes your baseline maturity and highlights priority gaps.
2. Governance foundations - Draft and publish your information security policy, define security roles, and communicate acceptable use guidelines to all staff.
3. Technical controls - Implement or verify endpoint protection, MFA, malware defence, patching processes, configuration baselines, backup schedules, and logging. These seven technical controls form the core of Starter.
4. People controls - Deliver security awareness training (A.6.3) and establish offboarding procedures to revoke access when staff leave (A.6.5).
5. Incident readiness - Document your incident response process and ensure all staff know how to report a suspected security incident.
6. Review and expand - Review your maturity scores after implementation. When all 15 controls are at an acceptable level, progress to ISO 27001 Essentials to expand coverage to 30 controls.

Frequently Asked Questions

Can I get ISO 27001 certified with just Starter?

No. ISO 27001 Starter is a derivative framework created by MyCISO to help organisations begin their journey. Certification requires implementing the full ISMS requirements (clauses 4-10) and all applicable Annex A controls.

How were the 15 controls selected?

MyCISO selected the controls that appear most frequently in audit findings, address the highest-risk areas, and provide the greatest security uplift for the least implementation complexity. They span governance, people, physical, and technical domains.

Is this the same as ISO 27001?

No. This is a curated subset designed by MyCISO as a learning and implementation aid. It uses ISO 27001 control references but does not include the full ISMS management system requirements needed for certification.

What is the difference between Starter and Essentials?

Starter covers 15 controls for initial foundations. Essentials expands to 30 controls for broader coverage. Both are stepping stones toward the full 93-control ISO 27001 standard.

Do I need to buy the ISO 27001 standard document?

For Starter, the MyCISO platform provides sufficient guidance. However, if you plan to progress to full certification, purchasing the official ISO 27001:2022 standard document is recommended.

Why It Matters

• ISO 27001 certification is increasingly demanded by customers, partners, and regulators. However, the full standard can take 12 to 18 months to implement from scratch. ISO 27001 Starter lets organisations demonstrate early progress and build momentum within weeks.
• The 15 selected controls address the most common audit findings and the highest-risk areas. By focusing here first, organisations achieve meaningful risk reduction while learning the ISO 27001 methodology and building the habits needed for full implementation.
• For organisations considering ISO 27001 certification, Starter provides a low-risk way to test whether the standard is the right fit and to build internal capability before committing to the full scope and cost of certification.

Common Challenges

• Assuming that having antivirus software installed is sufficient for endpoint protection without proper configuration and monitoring
• Writing policies that are too generic or copied from templates without tailoring to the organisation's context
• Neglecting the people controls (awareness and offboarding) in favour of technical controls only
• Not establishing evidence collection habits early, making it harder to demonstrate compliance later
• Treating Starter as the final destination rather than a stepping stone to the full standard