The Story of How a One-Person Company Got ISMS Certified with AI｜村山毅 Tim

A solo company gets ISO 27001 certified

Tim Murayama runs a small bookkeeping-service company that works with an AI employee. The company handles clients' financial data. Instead of paying a consultant, Murayama and the AI built the security management system themselves. The company received ISMS certification (ISO/IEC 27001:2022) on July 9, 2026.

Key numbers

• Actual build time: about 3 days. Audit response took about 2.5 days more.
• Cost: only AI usage fees (a few thousand yen) and the audit fee.
• Typical consultant route: several million yen and 6 to 12 months.
• Audit firm cost: about 500,000 to 600,000 yen in year one, and about 1,000,000 yen over three years.

How they did it

The AI first read the standard and studied GRC software (tools for governance, risk, and compliance) such as Vanta and Drata. Next, the AI listed every software tool the company used, starting from real systems instead of memory. The company also required all logins to go through one Google account. The team built an app, not just documents, to run the system. It links assets, risks, controls, rules, and training, and it tracks 93 security controls. Murayama made the decisions, and the AI did the drafting and checking.

Why it matters

Small companies often think security certification is too costly. This story shows that a one-person company can get certified by using AI for the hard work, while the owner makes the key decisions. It also shows that a clear map of where company data lives is a strong base for security.

What to watch

• Whether the company keeps the system running through yearly follow-up audits, which are cheaper.
• Whether more small companies copy this approach with AI tools.
• Whether auditors and clients accept AI-supported management records.