Audits & Certification
Your Certificate Has an Expiration Date — Here's What Happens Next That ISO 27001 certificate hanging in your lobby isn't permanent. It expires every three years, and what happens during those three years determines whether recertification is a smooth process or a scramble to rebuild everything from
Audits & Certification
What Surveillance Audits Really Are Your ISO 27001 certificate lasts three years, but certification bodies don't just hand you a certificate and walk away. They come back to check on you—twice. These visits are called surveillance audits, and they happen at 12 and 24 months after your
Audits & Certification
The Reality Check: What Actually Happens in Stage 2 Stage 2 is where the theater ends and reality begins. I've walked into organizations that breezed through Stage 1 with beautiful documentation, only to watch them stumble spectacularly when I asked their receptionist what to do if someone tailgates
Getting Started
The Real Cost of ISO 27001: Four Categories That Determine Your Budget I've watched companies budget €15,000 for ISO 27001 certification and spend €150,000. I've also seen startups get certified for under €30,000 while competitors burned through resources for years without success. The
Audits & Certification
Three months ago, a manufacturing client called me in a panic. They'd spent six weeks choosing between certification bodies, comparing accreditation details and pricing models. Meanwhile, their biggest customer had just asked for their ISO 27001 certificate—and they didn't have one. The certification body decision
Audits & Certification
What Actually Happens During ISO 27001 Certification Your ISO 27001 certification isn't a single event—it's a two-stage process that can make or break your timeline and budget. I've seen companies prepare flawlessly for months, only to stumble because they misunderstood what auditors look
Management Review
What Clause 9.3 Actually Requires (And Why Most Organizations Miss the Point) I've audited hundreds of management reviews, and the pattern is always the same. The CISO presents forty-seven slides covering every required input from Clause 9.3.2—status of previous actions, changes in external issues,
Management Review
Why Most Management Reviews Fail Before They Start I've audited over 300 organizations, and the pattern is depressingly consistent: the ISMS manager spends two weeks compiling a 50-slide deck, presents it to executives who haven't thought about security since the last review, and walks out with
Management Review
What Clause 9.3 Actually Demands Management review meetings are where I've witnessed some of the most spectacular displays of compliance theater in my auditing career. Organizations wheel out PowerPoint decks thicker than a phonebook, executives nod along while checking their phones, someone reads the policy document aloud,
Audits & Certification
The Uncomfortable Truth About Internal Auditor Selection The internal audit program lives or dies based on the people you put in those seats. I've watched organizations burn through three audit cycles with zero meaningful findings because they staffed their program with whoever had the lightest workload that quarter.
Audits & Certification
Common Internal Audit Failures and How to Avoid Them I've reviewed thousands of internal audit reports over my career, and I'd estimate that roughly 70% of them are fundamentally worthless. Not because the auditors were incompetent—most weren't—but because organizations treat internal audits
Audits & Certification
Understanding What You're Actually Auditing Before diving into the checklist itself, let's address a fundamental misunderstanding I encounter constantly: internal audits aren't compliance checks against every single control. Clause 9.2 requires you to audit against "the organization's own requirements for