ISO 27001 Guide For Canadian Small Business
What ISO 27001 Takes, And Who Does Each Part
A large client asks whether you are ISO 27001 certified, or tells you that you will need to be. Before you commit, it helps to know what certification involves and who does each part. Your business owns the security program. An accredited certification body audits it. Your IT team supplies much of the evidence.
This guide explains the standard, the path to certification, and where your managed IT provider fits.
The Standard
What Is ISO 27001?
ISO/IEC 27001 is the international standard for an information security management system (ISMS). It is more than a list of security tools. It asks your business to run security as a managed program: know your risks, choose controls to treat them, check that the controls work, and keep improving.
The current version is ISO/IEC 27001:2022. Certificates issued against the older 2013 version had to move to the 2022 version by October 31, 2025.
Certification gives clients third-party proof of your security, clearer responsibilities inside your team, and a structure that supports your privacy obligations under PIPEDA and provincial laws.
What It Requires
A Working Management System, Documented
The Management System
- A defined scope and boundaries.
- An information security policy.
- A risk assessment method and a risk treatment plan.
- A Statement of Applicability.
- Security objectives and a way to measure them.
Leadership
- Leadership sets the policy and assigns roles.
- Leadership provides the resources.
- Leadership reviews performance and drives improvement.
Records Auditors Ask For
- Evidence of staff competence.
- Monitoring and measurement results.
- An internal audit program.
- Management review results.
- Nonconformities and corrective actions.
Controls
Annex A Controls
ISO/IEC 27001:2022 lists 93 controls in Annex A, grouped into four themes (Barr Advisory):
Organizational
37 controls, such as policies, supplier relationships and incident management.
People
8 controls, such as screening, awareness training and remote working.
Physical
14 controls, such as secure areas and equipment protection.
Technological
34 controls, such as access control, malware protection, backup, logging and secure configuration.
You do not have to apply every control. You choose the ones that fit your risks and record your choices in the Statement of Applicability, which lists every Annex A control, says which apply, justifies any exclusions, and shows how each is implemented.
The Path
Four Steps To Certification
1
Gap Assessment
Review your documents, processes and controls against the standard to see what is missing.
2
Plan The ISMS
Set the scope, write the policy, choose a risk method and design your control framework.
3
Implement
Put the controls in place, write the documentation, train staff and build the process into daily work.
4
Audit
Run internal audits and a management review, fix what they find, then complete the Stage 1 and Stage 2 audits.
The Certification Audit Cycle
Choose an accredited certification body with experience in your industry. Then:
- Stage 1 audit: a documentation review.
- A remediation period to close any gaps.
- Stage 2 audit: proof that the controls work in practice.
- A certification decision.
- Surveillance audits every year, and recertification every three years.
Keeping the certificate means running internal audits, management reviews and corrective actions, and reassessing risk as your business and technology change.
What You Can Expect
-
Rated 5 out of 5
quick, reliable and professional
“…They helped us switch to Office 365 for all our email and document storage with back up of our files, and it’s been great. We always find them to be quick, reliable and professional, and we’re happy to have found them.”
Maria C.
Office Manager
-
Rated 5 out of 5
there to help me
“When I needed some IT assistance, Berj @ TUCU was there to help me and take care of what needed to be done in order for me to continue working and adding a more efficient manner to do so! Thank you, Berj!!”
Dawn Nelson
Roles
Who Does What In ISO 27001
Certification is a team effort. These roles are usually separate.
Your Business
Owns the ISMS. Leadership sets the policy, accepts the risks and signs off on the Statement of Applicability.
Your ISO Lead Or Consultant
Runs the program, writes the documentation and prepares you for audit. This can be someone on staff or an outside ISO consultant.
An Accredited Certification Body
Performs the Stage 1 and Stage 2 audits, issues the certificate, and returns for surveillance audits every year of the three-year cycle.
Your IT Provider
Runs the technology and produces evidence that the technical controls work.
Our Role
Where We Fit
We do not certify businesses, and we do not run your ISMS. For our managed clients, we run the IT that many of the technological controls depend on, and we supply the evidence your ISO lead and auditor ask for:
- Who has access to what, and how access is granted and removed.
- Device management, encryption and patching records.
- Endpoint protection and security monitoring.
- Backups and restore tests.
- Change records and IT documentation.
That way, the technical questions in your audit have clear, documented answers.
Questions
ISO 27001 FAQ
Updated November 2026 for ISO/IEC 27001:2022.
Does ISO 27001 replace our privacy obligations?
No. It sits alongside them: PIPEDA for private-sector businesses in most provinces, Quebec’s Law 25, Alberta’s and British Columbia’s PIPA, and Ontario’s PHIPA for personal health information.
Who needs to be on our ISO team?
Usually an executive sponsor, an ISMS manager or outside ISO consultant, an information security lead, representatives from each department, and internal auditors. Your IT provider supplies the technical evidence.
What does certification cost?
Costs cover consulting help, technology controls, staff time, documentation tools, the certification audits and ongoing upkeep. The scope your client expects drives most of it, so confirm that first.
Where should we start?
- Read our IT governance and risk guide for the basics.
- Ask the client who requested it which scope they expect.
- Talk to an ISO consultant about a gap assessment.
- Talk to us about the IT evidence your auditor will ask for.
More Resources Zero Trust Security Guide Personal Devices At Work IT Governance And Risk Guide NIST Framework Guide NIST Website COBIT / ISACA Website
Security Driven. People Powered.
What Would Your Team Do With Fewer IT Headaches?
1
Talk With An Owner
A relaxed call with one of our co-founders about your business, your team and what you want IT to do for you.
2
Get A Clear Proposal
If we are a fit, you get a tailored proposal and quote, with every line explained in plain English.
3
Hand Your IT To Us
Our in-house team runs your IT every day: support, security, devices and planning, so you can work with ease & security.