ISO 27001 Policies for UK SMEs

What is ISO 27001?

Quick answer. ISO 27001 is the international standard for an Information Security Management System (ISMS). The current 2022 version reorganises Annex A into 93 controls across four themes — organisational, people, physical, technological. Certification by an accredited body evidences to UK enterprise buyers, financial-services clients and public-sector procurement that information security is run as an ongoing discipline rather than a one-off exercise.

ISO 27001 is the international standard for information security management. It's the certification UK enterprise buyers, financial services clients, and public-sector procurement teams expect before they'll trust you with their data. The current version is ISO 27001:2022, which restructured the Annex A controls into four themes — organisational, people, physical, and technological.

Certification requires a documented Information Security Management System (ISMS) — a set of policies, procedures, risk assessments, and evidence records that prove you run security as an ongoing discipline, not a one-off exercise. The policy layer is the foundation: auditors read every policy and test whether your day-to-day operations match what the policy says.

Who needs ISO 27001?

Quick answer. UK SaaS and tech companies, outsourced service providers handling regulated-industry data, MSPs facing cyber-insurance demands, scale-ups raising Series A or later, and public-sector suppliers above contract thresholds. It is the default request in enterprise vendor risk questionnaires; a committed roadmap is often acceptable for early-stage firms but a certificate is expected from buyers above ~£1M ARR.

• UK SaaS and tech companies — it's the default expectation in enterprise RFPs and vendor risk questionnaires.
• Outsourced service providers handling customer data on behalf of regulated industries (financial services, healthcare, legal).
• UK managed service providers (MSPs) — increasingly required by insurers and by customers' own compliance teams.
• Scale-ups pursuing Series A or later — due diligence almost always asks for ISO 27001 or a committed roadmap to it.
• Public sector suppliers — frequently required alongside Cyber Essentials Plus for contracts above certain thresholds.

Policies you need for ISO 27001

Quick answer. ISO 27001:2022 does not prescribe a fixed list — Annex A lists 93 controls across four themes and the controller documents its own approach. Most UK SMEs maintain 16 policies covering the highest-impact controls: information-security, access-control, acceptable-use, cryptography, incident-response, supplier-security, data-classification, business-continuity, change-management, secure-development, physical-security, HR-security, asset-management, remote-working, backup and risk-management.

The 2022 standard doesn't prescribe an exact list of policies — it lists controls in Annex A and expects you to document your approach to each. In practice, most UK SMEs maintain the following 16 policies, all included in our ISO 27001 Core Set pack:

Realistic timeline to certification

Planning your rollout. There is no fixed readiness timetable. After purchase, complete the business questions and confirm your answers to generate editable drafts. Your team must review, approve and implement the policies. Evidence collection and any independent assessment take additional time.

Policy packs for ISO 27001

PolicySuite vs GRC platforms vs consultant vs DIY

Compare the scope. PolicySuite prepares editable policy drafts from your business answers. Compare the included documents and current shop price with the scope offered by a consultant, a template supplier or a governance platform. Implementation, specialist advice and independent assessment may require separate work.

Further reading

• ISO 27001:2022 policy requirements — full breakdown
• Cybersecurity policy templates for UK SMEs
• SOC 2 Type II — how it compares to ISO 27001
• Free ISO 27001 Gap Checker (5-minute assessment)
• PolicySuite vs Vanta — UK SME comparison

Frequently asked questions

References and primary sources

Quick answer. The framework guidance on this page is reviewed against the primary-source documents below. Each link resolves to an official regulator or standards-body publication so an auditor, procurement reviewer or DPO can verify the alignment without taking the page on trust.

• ISO/IEC 27001:2022 (ISO) — the international standard text and Annex A control set.
• NCSC product assurance scheme — the UK National Cyber Security Centre route to certification recognition.
• ICO security outcomes — the UK regulator’s expectations on security controls aligned to ISO 27001.
• NIST CSF (mapping) — the cross-walk most enterprise vendor questionnaires reference alongside ISO.

In our experience working with UK SMEs and similar organisations across the EU and US, the framework pages that survive enterprise vendor reviews are the ones that cite primary sources rather than secondary blog posts. Many UK SMEs typically discover this only after their first failed vendor questionnaire — the reviewer asked for a clause-to-source map and the standard reply pointed at a marketing page rather than the relevant regulator. The references above are the standing set we cite from inside the policies themselves so the chain stays intact end-to-end.