Tidal Control incident
Is your startup too small for ISO 27001? Three triggers to start now
Resolved on February 28, 2026.
ISO 27001 has no minimum size requirement, but timing matters: a traditional project takes six to twelve months, so waiting until a customer demands it often means losing the deal. Three triggers justify starting now: a customer has listed it in a questionnaire or RFP, you have enterprise or international ambitions within 12 months, or you process sensitive data in a regulated sector. Waiting makes sense if you lack product-market fit, process little sensitive data in a market that does not ask for it, or your team is fewer than four people with no spare capacity.
Update timeline
- resolved Feb 28, 2026, 12:00 AM UTC
ISO 27001 has no minimum size requirement, but timing matters: a traditional project takes six to twelve months, so waiting until a customer demands it often means losing the deal. Three triggers justify starting now: a customer has listed it in a questionnaire or RFP, you have enterprise or international ambitions within 12 months, or you process sensitive data in a regulated sector. Waiting makes sense if you lack product-market fit, process little sensitive data in a market that does not ask for it, or your team is fewer than four people with no spare capacity.
Your product runs on more than Tidal Control
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services