ISO 27001, ITIL, COBIT: where should a small organisation start?

I take a close interest in governance and security frameworks, through my master's degree in information systems security and in my day-to-day work. One question keeps coming up: is any of this useful for a team of ten or twenty people? My answer: yes, as long as you take the spirit rather than the letter.

ISO/IEC 27001: know what you're protecting

The standard describes an information security management system. For a small organisation, the starting point is simple: list your sensitive information, who can access it and what would happen if it leaked or disappeared. That risk analysis, even on a single page, already changes decisions.

ITIL: treat IT as a service

ITIL helps deliver and operate reliable services. Three practices are enough to begin with: a single entry point for requests and incidents, change management (you don't touch production on a Friday night without warning) and a knowledge base where solutions get written down.

COBIT: align digital with your goals

COBIT asks a question many leaders forget: do our digital investments really serve our objectives? In practice, that means linking every project to an organisational goal, naming an owner and tracking a few indicators.

Quality and Kaizen to tie it all together

Quality management and Kaizen bring the method: processes written simply, measured, and improved a little with each cycle. That's what stops frameworks from becoming binders nobody opens.

There's no need to aim for certification on day one. Start with a risk inventory, an incident log and a clear rule for production changes. You'll already be more mature than many much larger organisations.