5 lessons I learned from ISO 27001

When we began our ISO 27001 journey, I was ready for policies, risk registers, controls, evidence, and audits. I was not ready for how much of it would turn out to be behavioural change.

Here are five lessons, for anyone about to start (or quietly wondering why theirs feels stuck):

1. Security is a company-wide job, not a job title. You may have one CIO, but you need the whole organisation. HR, IT, Finance, Admin, Engineering, Delivery, and Leadership all handle information, and all make decisions that raise or reduce risk every day. The most energetic CIO in the world cannot carry a system that the rest of the business treats as "somebody else's problem." It won't survive the first busy quarter.

2. Policies are a diagnostic, not a paperwork exercise. The conventional sequence is: do the work, prepare for audit, write the policies, collect the certificate. I'd argue for starting with the policies, not for the document's sake, but for the conversations it forces:

• What are we actually doing today?
• What should we be doing?
• Who owns it?
• Can we realistically do it every time?

Sometimes the honest answer is "no." That is the most useful output you'll get. A policy that describes an idealised company that exists only on paper is fiction. A good one shows you where the real organisation needs to change. So draft it, challenge it, argue about it, then go back into the business and make it true.

3. Training is easy. Behaviour is hard. Everyone completes the awareness module. Everyone nods. Then someone leaves a laptop unlocked or forwards something they shouldn't have, and the follow-up conversations begin. Somewhere along the way you become the person asking, "Why is that document here? Who has access to this? Please don't send that." It's an unglamorous role, but awareness only counts once it shows up as habit.

4. The risk register is a living system, not a quarterly ritual. Yes, the review cycle may be quarterly. The business, however, does not operate on a quarterly basis. People, systems, customers, and technology change constantly, and the risks move with them. A register that wakes up every ninety days, stretches, and goes back to sleep is a spreadsheet, not a control. Keep it wired into what is actually happening.

5. Certification is the starting line, not the finish. The certificate is a milestone. The culture is the achievement. ISO 27001 was never about a plaque on the wall. It is about changing how an organisation thinks about information, risk, and accountability, and then sustaining that when the auditor has gone home and no one is checking.

The takeaway for leadership: treat ISO 27001 as an operating-model change with a certificate attached, not a certificate project with some operational side effects. The organisations that get lasting value are the ones that fund the behaviour change, not just the audit.

And yes, I will probably still ask why that document is sitting there.

Some habits are worth keeping. 😉