ISO 27001 Foundation case studies
ISO 27001 Foundation · Put your knowledge to work in context.
The ISO/IEC 27001 Certification is an APMG International certification listed in the Cyber Security category of its certification portfolio, which APMG describes as enabling professionals to safeguard data and manage evolving threats. It suits practitioners who build, run, audit or support an information security management system (ISMS) - security and risk officers, IT and service managers, compliance and audit staff, consultants, and team members whose work touches information security governance. The ISO 27001 Foundation case studies are 5 cases and about 2,553 words.
1Scope Creep at a 60-Person SaaS Firm
Nordwind Analytics is a 60-person SaaS company preparing for its first ISO/IEC 27001 certification. The CTO wrote the ISMS scope as: "All information systems, people, and processes of Nordwind Analytics worldwide." The company hosts its product on AWS, but payroll runs through a local bureau, and a 12-person engineering team in Lisbon operates as a legally separate subsidiary that Nordwind does not control operationally.
504 words, about 3 min2Leadership Sign-Off Without Authority
At Meridian Logistics, the Information Security Manager (ISM) has drafted the ISMS policy, risk treatment plan, and a set of 14 security objectives. The CEO signed the policy at a town hall but has since delegated all ISMS decisions to the ISM, saying "security is your area." The risk treatment plan requires a €180,000 spend on endpoint detection and a change to the procurement process that affects three departments.
521 words, about 3 min3Competence and Awareness in a Shift-Based Operation
Halcyon Foods runs three production shifts across two plants. The ISMS covers 420 staff.
512 words, about 3 min4Risk Assessment That Never Reaches Treatment
Vantage Health runs an annual risk assessment. This year the team scored 96 assets on a 1-5 likelihood/impact matrix and produced a 40-page register.
499 words, about 2 min5Internal Audit Independence Before Certification
Brightline Manufacturing is a 150-person firm pursuing certification. The Quality Manager, who also owns the ISMS documentation, conducted the internal audit.
517 words, about 3 min