ISO 27001 LI case studies
ISO 27001 LI · Put your knowledge to work in context.
The ISO/IEC 27001 Lead Implementer credential is a professional certification offered by PECB for people who plan, build, operate and improve an information security management system (ISMS) against the requirements of ISO/IEC 27001. It suits information security managers, ISMS project leads, consultants, risk and compliance staff, and technical specialists who are moving from supporting a programme to owning its delivery. The ISO 27001 LI case studies are 5 cases and about 4,213 words.
1Controls Before Context: A Tender-Driven Certification Deadline
Meridian Logistics (420 staff, three sites) must show an ISO/IEC 27001 certificate within nine months to stay on a retailer's tender shortlist. The tender covers only the freight-booking platform and the data centre that hosts it.
823 words, about 4 min2A Risk Register That Justifies Nothing
Northwind SaaS (180 staff) has run an ISMS for 14 months. Its risk register lists 214 risks, each scored on the same 5x5 matrix, and every one is owned by the IT manager.
786 words, about 4 min3An ISMS That Lives Only on the Shared Drive
A precision-parts manufacturer with 600 staff has had an ISMS 'operational' for six months. Symptoms: the access-control policy exists on a shared drive in five versions, and the plant manager keeps a printed 2021 copy; agency temps receive ERP administrator rights on day one because the onboarding checklist has no security step; a March phishing simulation produced a 34% click rate, yet only 12 of 600 staff have attended awareness training; the payroll provider has been used for two years and appears in no supplier register; the documented backup restore procedure has never been exercised; and the IT team says, without irony, that 'the ISMS is the CISO's project'.
869 words, about 4 min4Auditing Your Own Work, Reviewing Nothing
Vantage Health (900 staff) has outsourced internal audit to the same consultancy that designed and implemented its ISMS. One audit was performed 11 months ago; it covered the IT department only and sampled 5 of the 60 applicable controls.
838 words, about 4 min5Eighteen Days to Stage 1: Scope, Gaps and the Temptation to Rewrite
Kestrel Financial Services has its Stage 1 certification audit in 18 days, with Stage 2 six weeks later. The scope statement reads 'the provision of Kestrel's online lending platform'.
897 words, about 4 min