ISO 27001 Transition case studies
ISO 27001 Transition · Put your knowledge to work in context.
The ISO 27001 Transition credential is a certification-track exam aimed at practitioners who already hold an ISO/IEC 27001 certification and need to show they understand the current edition of the standard. It suits information security managers, ISMS consultants, internal auditors, and compliance leads who work with an established management system and must demonstrate that their knowledge is aligned with the revised requirements rather than the superseded text. The ISO 27001 Transition case studies are 5 cases and about 2,824 words.
1Scope expansion after acquiring a payment-data subsidiary
Northwind Analytics is a 420-person SaaS provider whose ISMS scope, certified in 2019, states: 'the provision of analytics services from the London headquarters and the Slough data centre.' In March 2024 it acquired a 60-person fintech subsidiary in Dublin that processes payment data on a third-party cloud platform. The subsidiary has no ISMS and its CTO reports to Northwind's COO.
586 words, about 3 min2CEO delegation and an ERP procurement
Helios Engineering has held ISO 27001:2013 certification since 2017. Its ISMS is run by a two-person security team; the CEO signs the information security policy annually but has not attended a management review since 2022.
581 words, about 3 min3Desktop control mapping under transition pressure
Vantage Logistics has a risk register with 62 risks and a Statement of Applicability that lists 114 controls from ISO 27001:2013 Annex A. The risk treatment plan maps each risk to one or more controls; 31 risks are treated only by controls that remain in 2022 Annex A, but 14 are treated by controls that were replaced or reorganised (for example, A.12.1.2 change management, A.14.2.5 secure system engineering, A.16.1.2 reporting security events).
572 words, about 3 min4Competence and awareness for new cloud and data controls
Meridian Health provides telehealth software to 300 clinics. Its ISO 27001:2013 certificate is valid until March 2026, but a customer requires 2022 certification by December 2024.
540 words, about 3 min5Cloud misconfiguration and change control
Blue Harbour Retail operates 180 stores and an e-commerce platform. It outsources payment processing to a PCI DSS-certified provider and cloud hosting to a Tier 3 data centre.
545 words, about 3 min