After the incident at TechVision AG (see Blog 1 of this series), the CEO asked the IT manager a question: 'Do we have an ISMS?' The IT manager replied: 'A what?'
This is not an isolated case. And it's not a failure on the IT manager's part. It's a structural problem: most SMEs treat information security either not at all, or as a purely technical matter. Both are wrong.
What an ISMS is – in one sentence
An Information Security Management System (ISMS) is a systematic approach to identifying, protecting and continuously improving a company's information assets. It is not a product you buy. It is a process you build and live.
Think of your company as a building. A firewall is a lock on the front door. An antivirus programme is a ground-floor alarm system. An ISMS, by contrast, asks: how many doors does the building have? Who holds which key? What happens if the basement floods? And who is responsible when something goes wrong?
The difference between 'we have a firewall' and 'we manage risk'
Technical measures are necessary – but not sufficient. That can be illustrated with one simple statistic: 90% of all successful cyberattacks begin not with a technology gap, but with a human action. An employee clicks a link. A password is reused. A system administrator skips a second factor.
An ISMS addresses exactly that. It ensures:
- Risks are systematically identified and assessed – not just by gut feeling
- Clear responsibilities exist – not just 'IT handles it'
- Employees know what they are and aren't allowed to do
- Incidents are detected, reported and analysed
- Management is regularly informed about the security posture
Who benefits from ISO 27001?
ISO 27001 is the international standard for ISMS. It doesn't prescribe which technologies to use, but which processes, evidence and controls a company needs. Certification is proof to customers, partners and regulators that these requirements are met.
Most companies ask the wrong question about ISO 27001. They ask: 'Do we have to?' The better question is: 'What does it cost us not to?'
Situation 1: Enterprise or public sector clients
ISO 27001 makes sense because tenders increasingly require ISO 27001 as a minimum qualification.
Situation 2: Processing personal data (GDPR/DPA)
ISO 27001 makes sense because certification simplifies data protection evidence to regulators.
Situation 3: Financial services, healthcare, critical infrastructure
ISO 27001 makes sense because FINMA, NIS2, DORA require or strongly recommend ISMS.
Situation 4: Growth and investor conversations
ISO 27001 makes sense because due diligence processes explicitly ask for information security standards.
Situation 5: Cyber insurance
ISO 27001 makes sense because certified companies receive better terms or coverage at all.
Situation 6: All other SMEs
ISO 27001 makes sense because a ransomware attack without an ISMS costs more than CHF 1.0 million.
What a CISO does – and what happens without one
A Chief Information Security Officer (CISO) leads the ISMS, assesses risks, coordinates measures and reports regularly to the board. In large enterprises, this is a full-time role. In SMEs, it's often one of five responsibilities the IT manager somehow squeezes in.
The problem isn't that SMEs lack a dedicated CISO. The problem is that the function then isn't genuinely fulfilled by anyone. Security decisions are made reactively, risks aren't systematically assessed, and when something happens, nobody knows what to do.
The alternative: an external CISO who takes on the function on a mandate basis. The model is called CISO-as-a-Service. It provides the necessary expertise without full-time salary costs – and it's exactly what most Swiss SMEs need.
The three biggest misconceptions about information security
Misconception 1: 'That's an IT topic.'
Information security is a leadership responsibility. ISO 27001 Clause 5 explicitly requires management commitment. The CEO must sign the IS policy. The board must be informed about risks. IT implements – but leadership decides.
Misconception 2: 'It's too expensive and too complex for us.'
An ISO 27001 project costs, depending on the starting point, CHF 30,000–100,000 for a company with 50–200 employees. A single ransomware incident costs on average many times more. The return on investment is unambiguous.
Misconception 3: 'We already do all this – just not on paper.'
'Not on paper' means, to an auditor: it doesn't exist. Without documentation, without evidence, without processes, there is no conformance. This isn't a bureaucracy exercise – it's the foundation for reproducible security.
The first step is simpler than you think
Building an ISMS doesn't begin with a 200-page document and a year-long project. It starts with an honest assessment: what do we have, what's missing, where are the biggest risks?
In the coming blogs in this series, we'll walk you through the entire journey – from risk analysis to documentation to the audit. Step by step, without jargon.
Want to understand whether an ISMS makes sense for your company – and what it would actually mean in practice? We'll talk you through it in a no-obligation 45-minute conversation. No commitment, no sales pressure. Contact us: security@centriq.ch
Next in this blog series:
Blog 3: The 5 most expensive security mistakes Swiss SMEs make
With concrete examples – and a test to see whether your company is affected.
*TechVision AG is a fictional company that will regularly appear in the coming blog articles.