Security compliance for small businesses: which framework, and how to make it real

Sooner or later a customer’s procurement team sends a questionnaire asking whether you have SOC 2, ISO 27001 or Cyber Essentials. Security compliance for a small company is mostly about answering that question well: knowing which requirements genuinely apply, picking the framework your customers recognise, and building one set of controls that satisfies several frameworks — tied to the risks they are meant to reduce.

By Alex Martyushin, founder & risk consultant · Updated 30 October 2026 · 14 min read

What security compliance means for a small company

Security compliance is a subset of wider compliance risk management. It covers three kinds of requirement, and it helps to keep them apart because the consequences of missing them differ:

Security and compliance are not the same thing. Security is whether your systems and data are actually protected; compliance is whether you can show you meet a defined standard. A certificate does not stop a breach, and a well-run small company can be secure without one. The aim is to use compliance as a structure for doing security properly — not as paperwork that sits beside it.

The main security compliance frameworks compared

SOC 2

SOC 2 is not a certificate but an auditor’s report, shared with customers under NDA. A Type II report covering several months is what most buyers want, because it shows controls actually operated. The Trust Services Criteria are principle-based, so you design controls that fit your business and the auditor tests them. Read the scope carefully on both sides: as a buyer, check what the report covers; as a seller, keep the scope to the service customers actually use.

ISO 27001

ISO 27001 certifies a management system rather than a fixed control list. You must define scope, assess information security risks, choose controls to treat them (documenting decisions in a Statement of Applicability), set objectives, run internal audits and management reviews, and improve continually. Its risk-based core is why it fits naturally with an ISO 31000-style risk register. The transition period from the 2013 version ended on 31 October 2025, so current certificates should be to the 2022 edition.

Cyber Essentials (UK)

Cyber Essentials is the cheapest credible signal of basic security in the UK. It is deliberately narrow — five controls that stop the most common internet-based attacks — and it is renewed every year. Since 27 April 2026 new applications use an updated question set (known as Danzell) with stricter marking: multi-factor authentication must be enabled on cloud services wherever the service offers it, and failing to apply high-risk and critical updates within 14 days is an automatic fail. Under Procurement Policy Note 014, UK central government departments, their agencies and NHS bodies must require Cyber Essentials (or equivalent controls) from suppliers on contracts with higher cyber risk.

Essential Eight (Australia)

The Essential Eight are application control, patching applications, configuring Microsoft Office macro settings, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication and regular backups. Each has maturity levels from 0 to 3, and organisations pick a target level based on the threats they face. In October 2026 ASD launched ASD Essentials as the evolution of the Essential Eight, with a broader scope and an approach focused on whether controls are effective; ASD is keeping both on cyber.gov.au during the transition. If you are starting now, build to the Essential Eight controls — they remain the core — and follow ASD’s transition guidance for how to report.

NIST CSF 2.0

Released in February 2024, CSF 2.0 added the Govern function, which puts cyber risk strategy, roles, policy and supply chain risk under board oversight. It does not prescribe controls; it describes outcomes and points to detailed catalogues. It is free and flexible, which makes it a good organising frame even if a customer asks you for ISO 27001 or SOC 2. See risk management frameworks compared for how it sits alongside ISO 31000 and COSO.

PCI DSS

If you take card payments, PCI DSS applies through your merchant agreement. The requirements introduced as future-dated in version 4.0 became mandatory on 31 March 2025. For a small online store the biggest lever is scope: using a hosted payment page or redirect keeps card data off your systems and shrinks your obligations dramatically. Our PCI DSS compliance checklist walks through it.

How to choose your first framework

Do not start with the framework you find most interesting. Start with the one that unlocks revenue or is legally required, then reuse the work.

One control set, many frameworks

The frameworks overlap heavily. Build one set of controls and map it, instead of running parallel programmes. A simplified mapping of common controls:

The mapping is indicative; each framework words its requirements differently and auditors test them differently. The point is visible in the dashes: Cyber Essentials and the Essential Eight are technical baselines, while ISO 27001, SOC 2 and NIST CSF add governance, supplier management, monitoring and incident response. A company that has done Cyber Essentials has made a strong start on ISO 27001 but is nowhere near finished.

Mapping controls to risks

Frameworks list controls; your cybersecurity risk assessment tells you which risks those controls are meant to reduce. Linking the two is what turns compliance into security. It also answers the auditor’s favourite question — why did you choose this control? — and shows the board what each pound of security spend buys.

Related guides go deeper on individual risks: ransomware, third-party risk, vulnerability management and data breach response.

Building a security compliance programme in eight steps

1. List your obligations. Laws, contracts, card schemes and the frameworks customers are asking for.
2. Set the scope. Which entities, services, systems, locations and people are in? A tight scope is cheaper and more honest.
3. Assess risks. Score the information security risks in the register so control choices have a reason.
4. Run a gap assessment. Compare existing controls with the chosen framework and record each gap as an action with an owner and date.
5. Write the few policies you need. Information security, access control, acceptable use, supplier, incident response, backup. Short and true beats long and aspirational.
6. Implement and collect evidence as you go. Screenshots, reports and logs gathered continuously are far less painful than a scramble before the audit.
7. Check yourself. An internal audit or readiness review before the external assessor arrives.
8. Certify or attest, then maintain. Track control health, overdue actions and renewal dates with a few key risk indicators.

Common mistakes

• Choosing the framework before asking customers. The certificate nobody asked for does not win deals.
• Scope creep — or scope tricks. Too wide is expensive; too narrow makes the certificate meaningless to buyers who read it.
• Parallel programmes. Separate spreadsheets for each framework multiply the work. Map once.
• Compliance without risk. Controls chosen to satisfy a checklist, not a threat, leave real gaps.
• Policies nobody follows. Auditors test practice, not documents; so do attackers.
• Treating the certificate as the finish line. Controls decay between audits unless someone owns them.