Hi I’m looking at aiming my career at being an 27001 external auditor for a while hoping I will get to travel a bit. I currently like the job I’m doing and while it can have periods of stress and lots of work it’s got a very good balance and I like it here.

Basically I would like a review from any ISO standard auditors ( I assume they are similar)

Is it a good job?

Is it tiring and mind numbing?

Do you like it or regret it etc?

Anything to add or advice? I’ve been on the other side of an audit and it was a very tiring week or just day long meeting and taking.

Hello,

I've read about several different options to complete the required internal audit... GRC team, other employees independent of the controls, outsourced auditors or a combination. What approach have you used and have you had any issues with the auditors accepting the audit?

BISO in regulated healthcare here, so DSPT is my day job.

If you're supplying the NHS, the Data Security and Protection Toolkit is

usually non-negotiable and "Standards Met" is the bar. What trips people up:

- It's annual and self-assessed, but evidence-backed — treat it like a mini

audit, not a form. Dates and screenshots matter.

- ISO 27001 gets you most of the way; heavy overlap, so map existing controls

across rather than starting fresh.

- The staff-training and leadership-accountability sections are where people

lose marks — not the technical controls.

- Start early. The evidence-gathering, not the assessment, is the slow part.

Happy to answer specifics if you're going through it.

Hi All,

Has anyone tried any of the automated ISO 27001 programs that are out there?

There are quite a few, what are your thoughts?

Software engineer, trying to understand how teams without dedicated GRC staff approach ISO 27001 readiness.

Something I keep seeing described: the confusion isn't really about the controls themselves, it's not knowing what order things are supposed to exist in. Someone here put it as discovering the pattern yourself instead of walking in with one.

For anyone who's led a first-time implementation: was the sequencing the hard part, or was it something else?

Newbie here fact finding…

What’s the typical retention period you use for Microsoft Teams chats (both user‑visible and back‑end storage)?

I’m specifically interested in:
• how long Teams chat data is retained in Exchange Online / Purview
• whether you use short deletion windows (e.g., 6–12 months)
• how you justify retention periods in your ISMS
• how you handle evidence preservation for grievances, disputes, or audits
• whether you run eDiscovery/Purview searches before confirming deletion

I’m trying to understand what’s considered “normal” or “ISO‑aligned” for retention of business communications in M365.

Any insight would be really appreciated.

Hey guys I'm gonna do my exam in 2 days do u guys have tips on how to pass the exam. I'm also looking how to get iso 27002 printed i don't know where to get it. I got my course through pecb but they didn't provide the document they just provided 4 day course ppt and video. can anyone suggest what can i take for the exam which can be useful. Thanks

I have just realised that GAICC's certification is not PECB endorsed. I'm 50% of the way through.

Should i abandon and restart through PECB providers?

Or is there no real difference in how it is regarded by employers??

Hey everyone,

hope this is okay to share here. I read through the subreddit rules beforehand, but if I missed something and surveys like this aren’t appropriate, apologies — just let me know and I’ll take it down.

We’re a small, very early-stage founding team with a cybersecurity background, and we’re currently trying to understand how ISO 27001 projects actually work in practice, not just how the process is supposed to work on paper.

We’re particularly interested in things like where teams lose the most time, what creates uncertainty, which parts are still unnecessarily manual, how consultants and software are used today, and where software or AI could genuinely make the process easier.

We put together a short survey around this. It takes about 8–10 minutes and can be completed anonymously.

If you’ve actually worked with ISO 27001 (internally, as a consultant, auditor, ISMS lead, security professional, etc) your experience would genuinely help us a lot at this stage. We’re still early enough that feedback from people who know this space can really influence what direction we take and stop us from building around the wrong assumptions.

We’re also absolutely not looking for people to tell us that our ideas are great. If you think software/AI isn’t particularly useful for certain parts of ISO, or we’re looking at the wrong problems entirely, we’d genuinely like to hear that too.

Here is the survey: https://tally.so/r/b5RAro

Thanks a lot to anyone who takes a few minutes to help us out. And again, mods, if this isn’t appropriate here, apologies — happy to remove it.

We are thinking of buying an iso27001 toolkit for our newly founded llc, anyone has good experience kickstarting iso 27001 implementation? Or tried any of these toolkits (ClausePass27001, hightable, certikit…) ?

Hey all I just finished my stage 2 audit as a consultant for a small 35 user business and we were recommended for certification with no minors or majors

This is was my first experience implementing iso 27001 I've mainly been been IT ops service delivery but I did the CISM course last year haven't sat the exam tho!

I feel like i aced the iso but I put a lot of work into built the isms in SharePoint with power automate flows too.

But now I've done it what's next I'm struggling to find more clients who need this I'm based in the UK

Anyone have experience of finding initiating these contracts ?

I am already ISO 27001 LA certified and have done audit related projects. But I want to move to GRC. My other non-audit experience includes vendor risk management, vrm tool migration, bcm planning and iso aligned policy and procedure drafting.

Is it worth getting 42001 certified?
What are the most credible certifying bodies?

Hi everyone. We are a small IT company currently finalizing our SOC 2 compliance. As we look toward the EU market, we know that ISO 27001 is heavily favored there. In your experience, is SOC 2 generally accepted by European clients, or would you recommend we pursue ISO 27001 as well?

Hello everyone. I am from Kyrgyzstan, and recently our governing body - National Bank of Kyrgyz Republic, published a statement in which it is now mandatory to implement ISO/IEC 27001 standard at every bank, whether it's small scale or large scale, before the end of 2028. I have a Bachelor's in Information Security and am currently working as an Information Security Specialist in middle scale bank, primarily administrating security systems and doing somewhat of managerial work for little over a year now.

In Kyrgyzstan, there are only 3 organizations that have obtained the ISO 27001 certification so far, and with recent changes more and more organizations will commit to become certified. And right now i am contemplating about switching career paths from mainly administrative InfoSec to more of a managerial InfoSec.

Hence my question - in my situation, does it make sense for me to take the ISO 27001 Lead Auditor exam now? To my knowledge the exam shouldn't be difficult since i am familiar with concepts of ISMS and ISO 27001 standard.

I've been teaching AI governance for a while and writing about ISO/IEC 42001, so I figured the auditor course would mostly be review. It wasn't. Sharing this because I couldn't find much firsthand info before signing up.

What I expected: memorize clauses 4 through 10, memorize Annex A controls, pass.

What it actually was: scenario judgment. You get a situation and have to decide whether it's a nonconformity, an observation, or an opportunity for improvement. Then justify it. Which clause, which requirement, what evidence is missing.

That distinction turned out to be the whole course. Explaining a standard and auditing against it are different skills. When you explain, you describe what the clause says. When you audit, you look at a document and ask whether it constitutes objective evidence of conformity. Completely different mental motion.

A few things worth knowing if you're considering it:

The AI Impact Assessment requirement in clause 6 has no equivalent in ISO 27001 or 9001. Organizations have to assess and document the effects their AI systems have on individuals and society. Most companies I've worked with have nothing here. It's the single most common gap.

Annex A data controls are brutal in practice. Provenance, quality, bias, preparation methods for training data. Anyone who deployed a generative AI tool without documenting where the data came from will fail this.

Your organizational role determines your requirements. Developer, provider, or user. A company that only uses third-party AI has a very different scope than one training models. A lot of people misclassify themselves at the start and build the wrong scope.

Third-party management is where most AI-using orgs are exposed. If you're running your business on external APIs and have no supplier control procedure, that's a finding.

Open question for anyone here who's done actual 42001 audits: how are you handling evidence for impact assessment? The standard says assess, it doesn't prescribe a format. Curious what's holding up in real certification audits versus what auditors are pushing back on.

Happy to answer questions about the course structure or exam format if anyone's on the fence.

Hi Everyone,

Quick context: I have an MSc in Cybersecurity and Forensic IT, a BSc in Software Engineering, and I'm currently job hunting for entry-level GRC/IT audit/information security roles (Middle East market specifically, if that matters). I do have few months of experience in the field as an assistant.

I've heard that some employers pay for certifications once you're hired. So I wanted to ask from your experience, should I wait and hope for that, or self-fund it now while I'm still job hunting?

We're curious about experiences from those of you who have brought in external help with information security, NIS2, GDPR, or ISO 27001. Many engagements start with a current-state assessment and end with a report. But for the report to create value, you often also need prioritization, clear ownership, support with implementation, and follow-up.

What do you expect from a good consulting deliverable? A detailed report? A concrete action plan? Practical help carrying out the measures? Support for management and the board? Ongoing follow-up?

What has worked well or less well in previous consulting engagements?

Many Swedish organisations currently need to work with several sets of requirements at the same time. It's easy to end up creating a separate project, a separate checklist and new governance documents for each regulation.

At the same time, many areas overlap, for example risk management, incident management, supplier governance, accountability and documentation.

One alternative is to first establish a common control structure, and then map each requirement to existing processes, controls and responsibilities.

How do you work with this? Do you have a shared governance model, or do you handle each regulation separately? Which parts have been hardest to align?

PECB has been a pita from start to, as it turns out, finish. I filled in all details from my jobs/projects and my reference details. Uploaded my CV in Docx and ticked all boxes at the bottom declaring my allegiance to the ISO flag.

And when I click NEXT, the page gives an error, but not saying what the problem is.... See attached the error and the page, filled in.

I do understand the claimed years experience do not match the referenced experience, but my total experience is way bigger than these two references can vouch for. That can't be the issue, can it?

Any suggestions?

Ahead of the autumn, we're curious to hear practical experiences from organisations working with the Cybersecurity Act (NIS2), ISO 27001, GDPR, GRC or similar requirements.

What has made the biggest difference for you?

Examples:

• a better current-state assessment,
• clearer risk ownership,
• simpler governance documents,
• stronger management buy-in,
• external advisory support,
• technical verification,
• a clearer CISO/GRC role,
• better follow-up on remediation actions.

What is your best practical tip?