Unpopular opinion: most ISO 27001 certificates prove one thing. You passed an audit on one particular week…
SIMON G. — Founder / Independent GRC & Information Security Consultant / Fractional CISO
Unpopular opinion: most ISO 27001 certificates prove one thing. You passed an audit on one particular week.
They don't prove your risk register reflects the business you run today. Or that your SoA justifications would survive a real incident. Or that anyone outside the ISMS owner has read a single policy.
After 16 years in GRC, the organisations I trust most aren't the ones with the thickest evidence folders. They're the ones where the ISMS changes when the business changes: new supplier, new AI tool, new market, new risk.
Compliance is a snapshot. Security is a habit.
What's the one control in your ISMS you suspect is 'audit-ready' but not actually working?
2 reactions · 0 comments