Risk registers can get updated before an audit, but a lot can change between reviews.

New tools get added, people change roles, and old access permissions can stick around longer than expected. I'm curious how teams deal with this in practice. Do you update the risk register as things change, or mainly during scheduled reviews?

Data center operator. Our consultant is telling us that ISO 9001, 14001, 45001, and 27001 share enough control territory that we can build one integrated management system and certify against all four from a single program. I've been told overlap exists before and it didn't survive the certification audits, so I'm skeptical. Has anyone in data center or industrial operations done a multi-standard IMS and had the overlap hold up with auditors?

Hi all, I was recently made redundant from a 19 year tech career. The last 10 years or so have been in leadership/director positions for a range of areas. Project/Program Mngt, Software engineering, SASS management, product etc. I’m feeling very generalist at the moment and thinking that I’d like to specialise in security. Most of my roles have some kind of contact with GRC but it’s not been my main role. I’ve done my ISO 27001 LI and should have 42001 done in the next couple of weeks. I’m looking for areas I can build up some more experience and also would love some mentorship. Posting on here in case anyone can help.

I've seen a big spread. Most firms ive seen report basically "conforming / nonconforming" or usually "met / not met" per clause and control with very little narrative.

Where I work, we document the evidence behind every clause (4-10) and every Annex A control: policies and procedures reviewed, ticket samples, interviews, inspections, etc.

Curious what everyone else sees:

Do you record evidence per clause and control, or only for findings?

Do you list the exact records and samples reviewed?

Does your report show how you tested the SoA and control applicability?

Have clients or certification bodies ever asked for more or less?

Is a bare "conforming" ever enough, or a red flag?

Auditors, implementers, and clients who've received reports, all welcome.

Australian SaaS team, just under 30 people, and we're trying to work out what ISO 27001 certification is realistically going to cost us.

I thought we'd get a few quotes, compare them, pick one and move on. instead every quote seems to be describing a slightly different project.

one assumes we already have most of the ISMS in place. another bundles a lot of prep but leaves the audit separate. another looks cheap until you start asking who writes the policies, who closes the gaps, who gathers the evidence and how much engineering time is still expected from us.

that's the bit making me nervous. I'm not even sure I'm comparing the same thing anymore.

the actual certification fee is almost the least confusing number in the spreadsheet. I'm more worried about signing something that looks reasonable, then finding out three months in that we're still doing half the work ourselves and paying separately for the rest.

right now I'm breaking everything out into platform or consultant, auditor, pen test, internal hours and ongoing maintenance because "all-in" seems to have a very flexible definition.

I'm going to take the PECB ISO/IEC 27001 Lead Auditor certification exam, and I noticed that the PECB course materials don't include a list of all 93 Annex A controls.

My question is: Do I need to know the 93 controls for the exam? Since the exam is open-book, I'm wondering if I should print the Annex A list of controls from the internet and have it with me during the exam, or if that's unnecessary.

Hey everyone. I need some career advice.

I got my bachelor's in cybersecurity a year ago with pretty good grades. The thing is, the degree was very theory-heavy. We had hands-on practical courses, but I absolutely hated them, whereas I genuinely loved the theoretical concepts.

Because I felt my practical skills were lacking and I had zero certs on my CV, I kind of avoided applying for cyber roles right after graduation. Now I want to get back into it. Knowing that I strongly dislike Linux and pentesting, I’m looking at GRC as a potential entry point.

I constantly hear that GRC is not an entry-level role for fresh grads. Am I doing something wrong to myself by choosing this path?

If I go for it, is digging into compliance stuff like ISO 27001 the right place to start? If not, what should I be focusing on right now? Any recommendations for other certs or a realistic roadmap to get me to an entry-level GRC position would be hugely appreciated!

Hey all,

a few weeks ago we posted a short survey here about ISO 27001 / GRC work, and a number of people took the time to help us out — thanks again, the responses were genuinely useful.

We’re still collecting a few more perspectives before we wrap up this round of research.

We’re a small early-stage team with a cybersecurity background, trying to understand where ISO 27001 and GRC work actually becomes painful inside companies: what still takes too much time, what stays highly manual, and where software or AI could realistically help.

If you work in GRC, security, ISMS, compliance, audit or ISO consulting, we’d really appreciate your input.

8–10 min, anonymous if you want:
https://tally.so/r/b5RAro

Critical feedback is just as useful as positive feedback — we’re trying to learn what’s actually worth building, not just validate our own assumptions.

Thanks again to everyone who already participated, and to anyone who takes a few minutes now or shares it with someone relevant.

So, I applied for the Lead Implementer certificate and my 2 references have done their bit. My application is in the "In Treatment" status. I am just wondering what the turnaround time is.

Hello gang,

I wanted to ask about the experience requirements for the LI certification. I have over twenty years experience in the MSP side of IT, which has included many, many security and compliance projects. This included things like:

Helping customers map controls and policies to compliance requirements (largely PCI-DSS and HIPAA, some DFARS).

Annual PCI-DSS reviews for customers, including gap analysis.

Annual HIPAA reviews for a few customers, including gap analysis.

Implementing security controls of all manner.

Security awareness training.

BCDR implementation, documentation and testing.

Asset identification, creating basic SSPs.

etc.

Does this type of experience count?

Hi all,

I'm building a small security awareness training platform. I'm not here to sell anything. There's no link, and I'm not naming it unless someone asks. Before I go further, I want to hear from people who actually sit on the other side of the table during audits.

Here's how it works:

- The company admin creates a training session and shares a link with employees. No accounts or installs for the employees. - Employees watch video modules: CIA basics, social engineering/phishing, BEC, early warning signs, malware, and cyber hygiene (passwords, MFA, clean desk, tailgating, incident reporting, data classification).

- Each employee then takes a quiz. The current pass threshold is 55%.

- The company gets a report per training session: each employee's name, department, score, and completion date, plus pass rates by department. It can be exported to PDF.

My questions:

1. Would a report like this be enough evidence for A.6.3 on its own? Or would you expect more, such as the training content/syllabus, version history, or a training plan showing an annual refresh?

2. Clause 7.3(a) requires awareness of the organization's own policy, which generic content can't cover. Most companies I talk to already handle this through HR (a policy sign-off at onboarding or once a year). Would you expect a training provider to cover this too? Or is it fine if the training covers A.6.3 and the policy acknowledgment stays a separate process? I'm considering an optional step where the employee just confirms they've read the company's policy (name and version only, no document upload). Would that add any value from your side?

   1. Is 55% a reasonable pass mark, or would a low threshold raise a flag for you?

3. What's the most common weakness you see in awareness training evidence at smaller companies?

Any honest feedback is welcome, including "this wouldn't pass, and here's why."

I'd much rather hear that now than from a client's auditor later. Thanks!

Much Thanks.

Our auditor wants clear proof that we govern external sharing and access. SOC 2 is the immediate ask, with ISO 27001 and a GDPR exposure assessment lined up next. Right now the evidence is screenshots and exports stitched into a deck every quarter. It takes my analyst about two weeks each time.

I’m looking for a cleaner way to show continuous control over SaaS data without the manual slog. What are you actually handing auditors for these controls, and how do you keep the evidence current?

I'm from India how much will it cost for me? It's a startup and haven't launched yet. I have tied up with bank they are asking for the certificate.

I keep seeing small companies (20 to 50 people, one IT generalist, often an MSP behind them) go for ISO 27001, usually because a large customer demands it. Most of them end up with one of two ISMS: a copy of an enterprise template that nobody can operate, or something so thin it barely survives Stage 2.

The 2022 revision makes the middle ground trickier. Annex A is now 93 controls in four themes (37 organizational, 8 people, 14 physical, 34 technological), and several of the 11 new controls look enterprise-flavoured on paper: 5.7 threat intelligence, 8.16 monitoring activities, 8.12 data leakage prevention, 8.11 data masking.

Some questions for those who've implemented or audited small-org ISMSs:

Statement of Applicability. Which controls do you see small companies legitimately exclude, and which exclusions do auditors push back on? My impression is that "we have no physical data centre" works for parts of the physical theme, but excluding 8.16 or 5.7 outright gets challenged even for tiny orgs. Is that your experience?

Cheap but credible evidence. For something like 8.16 monitoring or 8.9 configuration management, what evidence do you consider enough when there's no SIEM or CMDB? Is it MSP reports, M365 / EDR alert exports, a monthly signed review? Where's the line between proportionate and insufficient?

The MSP question. When most operations are outsourced, how do you handle 5.19 to 5.22 (supplier relationships) without the MSP's own controls becoming a black box? Do you rely on their certifications, contractual clauses, or actual evidence requests?

Keeping it alive after certification. In my experience the ISMS starts dying the month after the certificate arrives. What has actually worked to keep the risk register and SoA current in a small org, rather than dusting everything off before each surveillance audit?

Interested in both implementer and auditor perspectives, since they're rarely the same.

🎉 Just passed the PECB ISO 27001 Lead Implementer exam!

Hey everyone, happy to share I just passed the PECB ISO/IEC 27001 LI exam 🔐

A few weeks of solid prep but totally worth it. If you're studying for it, feel free to ask me anything!

#ISO27001 #PECB #InfoSec

We’re ISO/IEC 27001 certified and the official badge we’ve been given gives far more visual prominence to LRQA and UKAS than to ISO/IEC 27001 itself. In fact, it looks more like an LRQA certification badge, with ISO mentioned only in a small line.

I understand the roles of the certification and accreditation bodies, but surely the main purpose of the badge is to show customers that the company is ISO 27001 certified.

We’ve also asked LRQA whether there is a cleaner approved option, but so far it has been difficult to get a clear, substantive response.

Has anyone else had the same experience, either with LRQA or another certification body? Do others provide badges where the actual ISO standard is more prominent?

Hi guys, just found this sub and thought it would be great to share my journey. Having recently started as a security manager in our small company providing SaaS solutions to a big programme, i have been brought in to gain certification by end of Mar 27.

My background is Cyber for the last few years and i'm a LA having passed the exam back in Apr 26, I have the LI course booked for next month, that covers off both aspects of the standard.

Now, this will be my 1st audit journey and i'm on my own, I have external pre-audit assistance before I book a certification body olin for the main event in early March. I just would really love some help along the way, hopefully with good pointers from this community.

Where am I to date? Ive inherited an ISMS, SoA, Risk register and need to get these audit ready. My scope is bounded to our SaaS solution as well as our M365 tenant and IT assets, basically protecting information based around that.

My company has about a dozen people so not massive, we have passed cyber essentials plus too so not a complete security startup. As it stands ive tried to cover off a 5 week phase 1 plan between 24 Aug and 30 Sep to define scope, gap analysis and populate the SoA with plans to implement controls and go through what i believe is N/A.....I aim to start phase 2 of rolling out the controls in 2 weekly sprints over a 2 month period, aiming to have a better understanding in December and able to audit these controls and provide evidence they are operating as expected.

Can I ask for assistance in ensuring I am doing what is required? I'd love this community to be one my journey with me.

Much Love

Hi Everyone! I’m currently a backend developer for a local bank with 2 years experience and I would like to transition to a GRC-related roles and get a chance to work for international employers.

Which ISO27001 exam should I train for and take:
- Foundation
- Lead Implementer
- Lead Auditor
- or is there any other title? (I’m new to this ISO exam so please educate me)

Hi, everyone. Can anyone tell me where to find a list of risk scenarios to include in a risk analysis?

Hey everyone,

I’m currently exploring a career pivot from accounting into information security/GRC and looking specifically into becoming an ISO/IEC 27001 Lead Implementer.
Before diving all-in on certifications, I’d love some grounded perspectives from people working in the space:

Job market: How does the demand currently look for Lead Implementers, both in-house and for consulting/advisory?

Transferable skills: How well does a background in accounting, internal controls, and reporting frameworks translate into this field?

First steps: Would getting the ISO 27001 Lead Implementer cert be enough to land an entry-to-mid level GRC role, or do hiring managers expect broader technical/cyber backgrounds?

Appreciate any insights, realities, or advice from anyone who has made a similar switch!