Information security in a small company: from spreadsheet to auditable evidence in 90 days

This guide is for companies with roughly 10 to 50 staff, for practices and small service firms. It describes a path in three stages of 30 days each. The 90 days are a method, not a promise: how long it takes you depends on your starting point, your scope and the time you have.

Small companies need the same proof, not the same effort.

What "proof" means

A customer or auditor does not want to see folders full of documents. They want to understand that you manage information security. That takes six building blocks:

Policy: a short document in which management sets out what security means for your company.
Responsibilities: who is in charge, who deputises, who decides.
Risk assessment: what can go wrong, how likely it is and what it would cost.
Implemented controls: what you do about these risks.
Evidence: proof that the controls are really in place.
Review: a fixed date on which you look at the whole and improve it.

If one of these blocks is missing, an experienced auditor notices quickly.

Days 1 to 30: lay the foundation

Define the scope. Decide what belongs to the project: the whole company, one site, one product or one service. To start, the area your customer asks about is often enough.

Name an owner. One person drives the project and reports to management. In small companies this is often the head of IT or management itself.

Clarify applicability. Check whether laws such as NIS2 apply to you or whether it is mainly customers who ask for proof. The free applicability check gives a first assessment within minutes.

Choose one framework. Start with exactly one framework, usually ISO/IEC 27001 or the one your customer requires. Further frameworks come later; many controls then count more than once.

Gap analysis. Go through the framework's requirements and mark each one: implemented, partly, open or not applicable. Honestly, not generously. The result is your starting point.

Days 31 to 60: plan and start the controls

Draw up an action plan. Turn every gap into a measure with an owner and a date. Prioritise by risk: MFA for remote access and a tested backup usually matter more than a perfect document index.

Adapt templates. You do not need to invent a policy, access rules or an emergency plan from scratch. Take templates and adapt them to your company. A short document that is true beats a long one nobody reads.

Assess the first risks. Start with ten to twenty risks that really concern you: failure of a central system, ransomware, a lost laptop, a service provider dropping out. Rate likelihood and impact and link each risk to the controls that reduce it.

Days 61 to 90: evidence and review

Collect evidence. For every implemented control you need something you can show: a screenshot of the MFA setting, the record of a restore test, an attendance list from the training. Store the evidence directly with the control, with a date.

Management review. Management looks at the status, open points and risks and decides how to proceed. Record the result and the decisions in writing.

Internal check. Someone who did not implement the controls checks samples: is the evidence right, is it current? This can be a colleague from another department or an external consultant.

Export for customer or auditor. Put the status together so that a third party understands it without your explanation: scope, policy, risk assessment, controls with status and evidence.

Evidence beats documents: every control needs something you can show.

What a small company can leave out at the start

You can leave out or postpone:

a second or third framework
detailed process descriptions for procedures that involve two people
a separate software tool for every sub-task
a metrics system with dozens of figures

You should not leave out:

MFA for remote access, email and administration
a backup whose restore you have tested
managed access, including when staff leave
a simple procedure for security incidents: who reports, who decides, whom you call
a short yearly training for everyone

Spreadsheet or software: an honest comparison

A spreadsheet is enough as long as one person maintains everything, one framework applies and nobody asks for the status of six months ago.

It reaches its limits when:

several people implement controls and work in the same file at the same time,
evidence has versions and you have to show which state applied when,
audits repeat and you gather the same documents again every year,
a second framework comes along and you maintain controls twice,
a customer or auditor needs access to selected evidence, but not to everything.

What a project roughly costs with your own staff, with consultants or with software, you can work out for your situation with the free compliance cost calculator.

How Complass helps

Step-by-step guidance per framework: with explanations, checklists and document templates you adapt.
Gap analysis and action plan: see the gaps, steer measures with owners and dates.
Risk register: assess risks and link them to controls.
Evidence with the control: store proof where an auditor looks for it.
Audit export: an encrypted package with checksums for your customer or auditor.
Time-limited auditor access: your auditor sees only the projects you choose and only until the expiry date. You see in the log what they opened.
MFA for every user and hosting in Germany.

The Start package includes one framework and suits getting started. For medical and dental practices there is the Practice package. You can try Complass for 14 days without payment details.

Try it for 14 days Request a demo

Your 90-day plan

Period	Task	Result
Days 1–30	Scope, owner, applicability, one framework	Project mandate from management
Days 1–30	Gap analysis against the framework	List: implemented, partly, open
Days 31–60	Action plan by risk	Measures with owners and dates
Days 31–60	Adapt templates, adopt the policy	Policy and core rules
Days 31–60	Assess the first risks	Risk register with 10 to 20 entries
Days 61–90	Evidence per control	Proof with dates
Days 61–90	Management review, internal check	Minutes with decisions
Days 61–90	Export for customer or auditor	Auditable package

Checklist

The scope is defined and written down.
One owner is named.
One framework is chosen and the gap analysis is complete.
Every gap has a measure with an owner and a date.
Management has adopted the policy.
The main risks are assessed and linked to controls.
MFA, a tested backup, access rules and an incident procedure are in place.
Every implemented control has evidence with a date.
Management review and internal check are documented.
The next review date is in the calendar.

Not legal advice. This guide gives a general overview and does not replace an assessment of the individual case.