A common mistake of smaller companies is trying to design policies and documentation and comply with security standards like ISO 27001 before gaining adequate insight into their organization.