ISO 27001 for SMBs in Morocco: where to start, step by step

The short answer: an SMB starting ISO 27001 does not begin by buying software or writing fifty procedures. It begins with three decisions: why it is doing it, on what scope, and who leads. Everything else follows an order set by the standard: context, risk assessment, choice of controls, implementation, evidence of operation, internal audit, management review, then a certification audit by an accredited body. This guide covers each step, with what an auditor will actually ask for.

At ALLSAFE SOLUTIONS, we support SMBs in Casablanca and across Morocco on the technical and operational side of their information security management system (ISMS): firewalls, backups, accounts, endpoints, monitoring and evidence. We are not a certification body, and we give neither prices nor typical timelines here, as they depend entirely on your scope and starting point. The elements of the standard quoted here come from ISO/IEC 27001:2022 and its implementation guide, ISO/IEC 27002:2022.

ISO 27001 in two sentences

ISO/IEC 27001 is the international standard that sets the requirements for an ISMS: an organised way to identify the risks to your information, decide on controls to reduce them, check that they work and improve them. It does not tell you which firewall to buy: it asks you to prove that your security choices follow from your risks and are maintained over time.

The current version is ISO/IEC 27001:2022, supplemented in 2024 by an amendment requiring organisations to determine whether climate change is a relevant issue. Certificates issued against the old 2013 version have not been valid since 31 October 2025, the end of the transition period set by the IAF (International Accreditation Forum). If a customer asks for “ISO 27001”, the 2022 version is what you should aim for.

Do you really need certification? The three common cases

Before committing to anything, clarify the reason. It drives the scope, the level of effort and even whether certification is needed at all.

Situation	What to aim for
A customer (bank, insurer, operator, large account, foreign client) requires a certificate	ISO 27001:2022 certification on the scope that serves this customer
A tender rewards or requires the standard	Certification, after checking the scope required in the specifications
No external requirement, but a need to structure security	Apply the approach without certifying, or prepare certification for later

A Moroccan point of context: no law requires ISO 27001 from a private SMB. Law 05-20 on cybersecurity and the national information systems security directive (DNSSI) published by the DGSSI primarily target public bodies, critical infrastructure and digital operators. The DNSSI covers themes very close to those of ISO 27001 Annex A (security policy, human resources security, asset management, access control, cryptography, communications security): an SMB serving these organisations gains twice. On personal data, Law 09-08 and the CNDP set their own obligations, which an ISMS helps meet without replacing them.

The structure of the standard: clauses 4 to 10 and Annex A

ISO 27001 reads in two parts. Clauses 4 to 10 are mandatory: they describe the management system. Annex A is a list of security controls from which you select those that treat your risks.

Clause	Topic	What it means for an SMB
4	Context of the organisation	Internal and external issues, interested parties, ISMS scope
5	Leadership	Management commitment, security policy, roles and responsibilities
6	Planning	Risk assessment and treatment method, security objectives
7	Support	Resources, competence, awareness, communication, documents
8	Operation	Actual implementation of controls and the risk treatment plan
9	Performance evaluation	Indicators, internal audit, management review
10	Improvement	Nonconformities, corrective actions, continual improvement

Annex A of the 2022 version contains 93 controls in four themes: 37 organisational, 8 people, 14 physical and 34 technological. Eleven controls are new in this version, including threat intelligence, information security for cloud services, ICT readiness for business continuity, configuration management, information deletion, data leakage prevention, monitoring activities, web filtering and secure coding.

Step 1: secure real management commitment

Clause 5 is not a formality. The auditor will check that management approved the security policy, allocated resources, appointed a lead and took part in the management review. In an SMB, the lead is often the finance and administration director or the IT manager, supported by a provider. What does not work: handing the project to one person with no dedicated time, or to the provider alone. The standard requires the organisation to own its system.

Step 2: set a realistic scope

The scope appears on the certificate. It is the decision that weighs most on the effort. It can cover the whole company, one site, one activity or one specific service, provided its boundaries and interfaces are clear: which sites, teams, applications and suppliers.

For a first certification, we recommend a scope that matches exactly what the customer or tender asks for, for example “hosting and operation of application X” or “managed IT services delivered from Casablanca”. Too broad a scope dilutes the effort; too narrow a scope may not satisfy the customer. Have it validated by them before you start.

Step 3: the gap analysis, to know where you stand

The gap analysis compares your current situation with clauses 4 to 10 and the Annex A controls. It produces a prioritised list of what is missing. In the SMBs we audit, the same gaps keep coming up:

• no up-to-date inventory of endpoints, servers, accounts and applications;
• shared accounts, admin rights everywhere, former employees still active;
• no multi-factor authentication on email and remote access, see our MFA rollout guide;
• backups never tested by restoring, or all on the same site;
• updates applied “when there is time”;
• logs not kept, or kept with no one reading them;
• no written rules for employees, and no awareness training.

Our article IT audit for SMBs: where to start explains how to run this technical assessment.

Step 4: risk assessment and treatment

This is the core of the standard. ISO 27001 does not impose a method, but requires it to be defined, repeatable and to produce comparable results. For an SMB, a simple method is enough:

1. List the key assets in scope: information, applications, servers, accounts, suppliers.
2. Identify the risks for each: loss of confidentiality, integrity, availability.
3. Assess each risk by likelihood and impact, on a scale defined in advance.
4. Decide on treatment: reduce, avoid, transfer or accept, with formal approval from the risk owner.
5. Write the treatment plan: controls, owner, due date.

A well-built spreadsheet is more than enough to start. A compliance management tool becomes useful as the scope or the number of people involved grows.

Step 5: the Statement of Applicability

The Statement of Applicability lists the 93 Annex A controls. For each one, it states whether it is selected, why, and whether it is already in place. Every exclusion must be justified: an SMB with no in-house software development can, for example, exclude secure coding and explain why. It is one of the first documents the auditor reads, and the one that most quickly reveals an inconsistent approach.

Step 6: implement the controls, starting with the fundamentals

Most Annex A technological controls map to concrete projects. Here is the mapping we use with our customers:

Annex A theme	Concrete control in an SMB
Access control, authentication	Named accounts, MFA, periodic access reviews, leavers handled the same day
Protection against malware	EDR on endpoints and servers, with alerts actually handled, see managed EDR and 24/7 monitoring
Technical vulnerability management	A documented update process, see our patch management guide
Information backup	Tested backups, one off-site copy and one immutable copy, see the immutable 3-2-1 rule
Logging and monitoring	Centralised logs that are actually analysed, see SIEM for SMBs
Network security, web filtering	Next-generation firewall, segmentation, VPN with MFA
Business continuity	A tested continuity and recovery plan, see BCP vs DRP
Incident management	A written procedure and emergency contacts, see the first hour of an incident
Awareness	A regular programme, see phishing awareness training for employees
Acceptable use of assets	Rules signed by every employee, see the IT acceptable use policy

On the network side, we deploy Fortinet and WatchGuard firewalls, as a Fortinet partner, and Veeam backups. All our services are presented on our cybersecurity for businesses in Morocco page.

Step 7: the required documentation, without excess

The standard requires specific “documented information”, not a library of procedures. The minimum expected:

• the ISMS scope;
• the information security policy;
• the risk assessment and treatment method, and their results;
• the Statement of Applicability;
• the security objectives;
• evidence of competence of key people;
• monitoring and measurement results;
• the internal audit programme and results;
• the management review results;
• nonconformities and corrective actions.

Add the procedures that your own risks make necessary. A useful rule: if nobody reads or applies a document, it should not exist.

Step 8: run the system, then the internal audit and management review

A certification auditor is not satisfied with documents: they look for evidence that the system works. Access reviews carried out, restore tests recorded, incidents logged and handled, awareness sessions tracked, indicators followed. So the system has to run before the audit.

Then come two clause 9 requirements many SMBs discover late: an internal audit carried out by someone who does not audit their own work (a trained employee or an external party), and a formal management review, with its decisions. A security audit or penetration test can complement the internal audit on the technical side.

Step 9: certification by an accredited body

ISO writes the standard but certifies no one. Certification is granted by an accredited certification body, following a standard cycle:

Stage	Content
Stage 1 audit	Review of documentation and readiness
Stage 2 audit	On-site check that the system is applied and effective; certification decision
Surveillance audits	At least once a year, on a sample of controls
Recertification	At the end of the three-year cycle, a full audit of the system

Before choosing the body, check its accreditation for ISO/IEC 27001 and the accreditation body that granted it, then ask the customer requiring the certificate whether they have preferences. Nonconformities raised at stage 2 must be corrected before the certification decision.

Mistakes that derail or delay the project

1. Starting from a purchased document template unrelated to how the company works: the auditor sees it at the first question.
2. A scope decided without the customer who requires the certificate.
3. A purely theoretical risk assessment that the controls do not follow from.
4. Technical controls announced but not in place: MFA “planned”, backups “tested once”.
5. No evidence of operation: no logs, no reports, no records.
6. Suppliers forgotten: host, software vendor, managed service provider and cloud providers are all risks to treat.
7. The project stops after the certificate, and the next surveillance audit becomes a catch-up exercise.

Getting-started checklist

• Reason for the project and exact requirement of the customer or tender.
• Named lead, management sponsor, allocated time.
• Written and validated scope.
• Inventory of in-scope assets.
• Gap analysis against clauses 4 to 10 and Annex A.
• Risk assessment method chosen and a first assessment done.
• Treatment plan and Statement of Applicability.
• Technical fundamentals in place: MFA, tested backups, updates, EDR, logs.
• Schedule for the internal audit and management review.

How we support an ISO 27001 project

We start with a free initial audit of your IT on the target scope, which forms the basis of the technical gap analysis. We then implement the Annex A controls that belong to the infrastructure: firewalls, segmentation, MFA, backups, EDR, patch management, logging. With our managed IT services in Morocco, we produce over time the evidence the auditor will ask for: 24/7 monitoring reports, restore tests, access reviews, incident tracking, with critical incidents handled in under 15 minutes. Writing the policy, the risk assessment and the internal audit stay under your leadership, with an ISO 27001 consultant if you wish.

To prepare your project, request your free initial audit: we reply within 24 business hours.