Controls Before Context: A Tender-Driven Certification Deadline
Meridian Logistics (420 staff, three sites) must show an ISO/IEC 27001 certificate within nine months to stay on a retailer's tender shortlist. The tender covers only the freight-booking platform and the data centre that hosts it. A newly appointed CISO, three weeks in post, inherits a consultant's deliverable: a gap analysis against all 93 Annex A controls and a remediation plan that begins with SIEM deployment, vulnerability scanning and a 40-page policy set. No scope statement exists, no risk assessment has been performed, and top management's only visible involvement is a signed purchase order. The IT director wants the SIEM live by month two so that the certificate arrives on time.
1. The IT director argues that closing the 93-control gap list first will save time later. Assess this approach against the intent of ISO/IEC 27001.
Read the worked answer
What is right about it: nothing in ISO/IEC 27001 forbids implementing a broad baseline quickly, and some controls (asset inventory, access control, logging) are near-universal. Speed matters here, and the deadline is real.
What is wrong about it: the standard is built on the sequence context → risk assessment → risk treatment → Statement of Applicability → controls. Annex A is a reference catalogue from which controls are selected and justified, not a checklist to be completed. Starting with the catalogue inverts the logic and produces three problems:
- No traceable justification. Clause 6.1.3 requires the SoA to justify inclusion and exclusion of each control. A gap analysis against 93 controls generates no such justification.
- Misallocated effort. Nine months is fixed. Effort spent on controls that no identified risk justifies is effort not spent on the controls that protect the freight platform.
- Audit exposure. A Stage 1 auditor will ask for the risk assessment and SoA before admiring the SIEM. Absent clauses 4, 6.1 and 6.1.3, the engagement fails readiness regardless of technical maturity.
Judgement: keep any quick baseline wins that are cheap and obviously needed, but re-sequence so that scope, risk criteria, risk assessment and SoA precede commitment of the bulk of the budget. Tell the IT director the SIEM is a candidate output of the risk process, and that its business case will be stronger once risks to the booking platform are documented.
2. What must be settled before remediation is prioritised, and how does the tender's narrow scope affect the decision?
Read the worked answer
Settle first (clauses 4 and 6):
- Scope (4.3): the boundary and applicability of the ISMS, expressed in terms of the platform and the hosting data centre, including interfaces and dependencies on shared corporate services (identity, network, HR, facilities).
- Interested parties and their requirements (4.2): the retailer's contractual security schedule is itself an input.
- Risk criteria (6.1.2 a): scales for likelihood and consequence, the rule for deciding when a risk is acceptable, and who may accept residual risk.
- Risk owners (6.1.3 b): named individuals accountable for each risk, not 'IT'.
Effect of the narrow scope: it is legitimate and it reduces cost, time and audit surface - but only if it is accurate. The auditor will test whether the scope statement is misleading. If the platform depends on a shared Active Directory, a shared network or corporate helpdesk staff with privileged access, those dependencies must be either brought inside the boundary or genuinely segregated and described.
Judgement: a narrowed scope is the single biggest lever on the nine-month deadline. The CISO should propose it formally, document the dependency analysis, and have top management approve it (5.1) rather than letting a consultant's all-93-controls plan implicitly define an enterprise-wide scope.
3. What evidence of leadership under clause 5 will the certification auditor look for, and what should the CISO ask top management to do now?
Read the worked answer
What the auditor tests (5.1, 5.2, 5.3): a signed information security policy that is appropriate to purpose and includes commitment to satisfy applicable requirements and to continual improvement; assignment of roles, responsibilities and authorities; evidence that the ISMS is integrated into the organisation's business processes, not bolted on; resources provided; communication of the importance of conformity; promotion of improvement; and direction and support at management review.
A purchase order proves budget, not leadership.
What the CISO should request in the next two weeks:
- Top management approves the scope statement and the risk acceptance criteria - a decision that is theirs under 6.1.3, not the CISO's.
- Top management appoints risk owners by name from operations and business units, and signs the policy.
- A steering rhythm with minuted decisions, so that resource and priority trade-offs are documented before the auditor arrives.
- An explicit statement of how the ISMS supports the tender and the business, which is the practical evidence of 'integration with business processes'.
Reasoning: the most common early-stage failure is an ISMS that exists only in the security function's folder. The fix is behavioural and hierarchical, not documentary: decisions must be made and recorded by the people the standard holds accountable.