Global Community

 View Only

  • 1.  ISO/IEC 27001:2022 – Is Information Security Just a Document, or Is It an Organizational Culture?

    Posted 09-07-2026 04:49 AM
    My approach is that a robust ISMS should consist not only of documentation or technical controls, but of an integrated whole comprising risk-based thinking, people, technology, processes and continuous improvement.
    As an auditor, what evidence would you look at first to determine whether an organisation's ISO/IEC 27001:2022 system is truly effective?
    1. Full compliance of the documentation with the standard? 
    2. The technical implementation of the controls in Annex A? 
    3. Employees' information security awareness? 
    4. The ability to demonstrate the effectiveness of risks and controls with objective evidence? 
    5. Top management's active involvement in the ISMS? 


    ------------------------------
    Selman NAS
    ISO 9001 : 2015 Lead Auditor
    ISO 27001 : 2022 Lead Auditor
    Quality Control Manager
    ------------------------------


  • 2.  RE: ISO/IEC 27001:2022 – Is Information Security Just a Document, or Is It an Organizational Culture?

    Posted 09-08-2026 11:40 PM

    Number four is where I start, Selman, but the route I take to get there matters. I pick up the risk assessment and the Statement of Applicability, choose two or three risks that genuinely threaten the business, and follow each one out to the control that is meant to handle it, the evidence that it actually ran, and the last time anyone checked whether it still works. Documentation conformity and the Annex A implementation both fall out of that walk without needing to be audited on their own.

    Awareness and management involvement I read as symptoms rather than starting points. If the people doing the work can tell me what would happen if they clicked the wrong thing and who they would call, the culture is real. If the exceptions and the accepted risks were signed off by someone who genuinely carries the consequence rather than by the security manager, top management is involved. Both of those surface faster in conversation than in any record.



    ------------------------------
    Dilawar Laghari
    Auditor, Consultant and Trainer
    Audit Workshop
    https://auditworkshop.com/
    ------------------------------



  • 3.  RE: ISO/IEC 27001:2022 – Is Information Security Just a Document, or Is It an Organizational Culture?

    Posted 25 days ago

    Thank you for your suggestion 



    ------------------------------
    Selman NAS
    ISO 9001 : 2015 Lead Auditor
    ISO 27001 : 2022 Lead Auditor
    ------------------------------

    Original Message


  • 4.  RE: ISO/IEC 27001:2022 – Is Information Security Just a Document, or Is It an Organizational Culture?

    Posted 09-09-2026 07:45 AM

    Selman, your integrated approach is well stated. I would start with objective evidence of risk and control effectiveness (option 4), then verify management involvement, employee awareness, technical implementation, and documented compliance. This evidence-based approach best demonstrates whether the ISMS is truly effective.



    ------------------------------
    Francisco J. Tapia Guerrero
    ftapia@qualitascertification.com
    www.linkedin.com/in/franktapiaguerrero
    ------------------------------



  • 5.  RE: ISO/IEC 27001:2022 – Is Information Security Just a Document, or Is It an Organizational Culture?

    Posted 25 days ago

    Thank you for your suggestion..



    ------------------------------
    Selman NAS
    ISO 9001 : 2015 Lead Auditor
    ISO 27001 : 2022 Lead Auditor
    ------------------------------

    Original Message


  • 6.  RE: ISO/IEC 27001:2022 – Is Information Security Just a Document, or Is It an Organizational Culture?

    Posted 29 days ago

    Hi@Selman NAS good approach. Effectiveness is demonstrated through stability and predictability and of course KPIs and trending. 



    ------------------------------
    Frank Higley-Sanchez
    ------------------------------



  • 7.  RE: ISO/IEC 27001:2022 – Is Information Security Just a Document, or Is It an Organizational Culture?

    Posted 25 days ago

    Thank you for your suggestion 



    ------------------------------
    Selman NAS
    ISO 9001 : 2015 Lead Auditor
    ISO 27001 : 2022 Lead Auditor
    ------------------------------

    Original Message


Related Content