ISO 27001 Consultant for UK SMEs | TLN Consulting

Practical ISO 27001:2022 support for UK SMEs without a big IT team. Proportionate controls, audit-ready evidence and certification support.

ISO 27001:2022 – Information security, cybersecurity and privacy: protect your information, people and assets and win client trust

More and more clients ask suppliers how they protect data, and some won’t award work without ISO 27001. It’s also a sensible way to reduce the risk of a breach, whether or not you have a large IT team.

It’s for you if clients or tenders are asking about information security, you handle sensitive or personal data, or you rely on outsourced IT and want to be confident it’s under control.

What it asks of you

Understand what information you hold, where it is and who can access it.
Assess the risks and choose proportionate controls (documented in a Statement of Applicability).
Set clear responsibilities for staff, suppliers and outsourced IT.
Test, audit and review, and keep improving.

How I help
I’ll translate the technical requirements into practical controls and records your team understands, run awareness training, support internal audits and management review, and prepare you for the certification audit. It doesn’t have to be an IT-only project. See the Jenkinsons case study →

[Part of an integrated system? See Integrated Management Systems →]

Acceptable Use Policy and AI

If your team uses free tools like ChatGPT, for example to draft tenders, an auditor may well challenge it. ISO 27001 doesn’t mention AI by name, but its controls on acceptable use, data classification, suppliers and cloud services all apply. It’s worth updating your acceptable use policy to cover AI, and being able to show your staff know it.

What larger buyers now expect

Many corporates, public bodies and tier-one contractors are now:

blocking free AI tools on their networks unless they’re accessed through an approved enterprise version, and
writing AI acceptable use policies that:
prohibit putting personal or confidential data into free tools;
define approved uses, such as summarising public documents;
require a human to review the output, with no blind copy-and-paste; and
set a route for approving new AI tools, so IT and security can check the contract and compliance first.

If you supply these organisations, they’ll increasingly expect the same of you, in tenders and supplier questionnaires as well as audits.

FAQ

We don’t have an IT department. Can we still get ISO 27001?

Yes. Jenkinsons did exactly that, and passed its Stage 1 audit within five months. The key is leadership ownership, clear responsibilities and proportionate controls.

What is a Statement of Applicability?

It’s the document that lists which controls apply to you, which don’t, and why. Your risk assessment drives it, and it’s central to the audit.

What happens at certification?

There are two audit stages with an accredited certification body: Stage 1 reviews your documented system and readiness, and Stage 2 checks it’s working in practice. Certificates last three years, with annual surveillance audits in between.

Does it cover cloud services and outsourced IT?

Yes, supplier and outsourced arrangements are part of the standard, and I’ll help you put proportionate controls and checks in place.

Do we need an AI policy for ISO 27001?

It isn’t a named requirement, but if staff use AI with company or client information, auditors will expect to see it addressed under acceptable use and risk. A short policy is the simplest way to show that.

Can we just ban AI?

You can, but bans rarely hold, and they push use out of sight. Clear rules and approved tools are safer and easier to evidence.

Does using AI put our certification at risk?

Not by itself. What matters is that the risks are assessed, controlled and understood by your staff.

Questions to be ready for

Which AI tools are approved, and who decides?
What can’t go in? For example client data, personal data, passwords, tender pricing and anything under NDA.
Which accounts and settings are used, and is your data kept or used to train the tool?
Who checks the output before it goes to a client or into a tender?
Do your suppliers use AI on your data, and is it covered in the contract?
What training have people had, and what happens if someone pastes something they shouldn’t?

What I put in place

A one-page AI acceptable use policy written for your business.
An approved-tools list and a simple rule on what can go where.
A short staff briefing, with a record of attendance.
Supplier checks for the tools you rely on.
Your risk assessment and Statement of Applicability updated, so it all shows as audit evidence.

ISO 27001 or ISO 42001? 27001 covers the information security side of using AI. 42001 goes further, into governance and impact across the AI lifecycle. Many SMEs need only the first, and I’ll tell you honestly which fits. [See ISO 42001 →] · [How I use AI →]

Where to start

If any answer is “I’m not sure”, that’s your first job. A short review of these three areas often removes a surprising amount of risk, and it’s also the foundation of any ISO 27001 system, if you decide later that you want one.

Start with a gap analysis, not a big project

Many businesses are told they need a full ISO 27001 project when what they really need is to know where they stand. A full certification project is the right answer for some, especially where a client or tender requires a certificate. For many others it’s more than they need.

So I usually start with a gap analysis: a focused review of your current controls against the standard, in plain English, with a RAG-rated action plan.

You’ll know:

where you’re already strong,
what to fix first, and what can wait,
and whether certification makes sense for you, or whether acting on the priorities is enough.

If you do decide to certify, the gap analysis becomes the starting point for the project, so none of the work is wasted. If you don’t, you’ll still have a clear, practical plan.

Contact trudie@tlnconsulting.co.uk if you would like a more in-depth gap analysis to any standard.

Contact Trudie for a copy of “ISO Terms in Plain English”

or request a Gap Analysis Checklist for any standard.

07795 802 982

trudie@tlnconsulting.co.uk

Download my High-level 27001 Checklist

Find out more about our AI Services

Further Resources to Explore

See Case Study for Winget

See Case Study for Jenkinson's

See Case Study for Seddon