ISO 27001 Transition common mistakes
ISO 27001 Transition · Understand the traps and how to avoid them.
Treating Annex A controls as a mandatory checklist to be implemented in full, and answering questions about control selection by listing controls rather than by tracing them to a documented risk assessment and risk treatment decision.
Many candidates arrive from older control-catalogue thinking (or from a previous version of the standard) and assume the Annex is prescriptive. The current standard makes the Annex a reference set to be applied only where relevant, with the Statement of Applicability explaining inclusions and exclusions.
What to do instead
For any control-selection question, answer in the sequence: risk assessment output, risk treatment option chosen, control(s) selected or justified exclusion, then SoA entry. Practise writing a one-line SoA justification for each of a handful of controls and for one deliberate exclusion, and check that the justification cites a risk rather than a preference.
Confusing the Statement of Applicability with the risk treatment plan, and describing the SoA as the document that schedules and funds remediation work.
Both documents emerge from risk treatment and are often produced together, so candidates collapse them into one artefact. The distinction between 'what applies and why' and 'what we will do, by when, by whom' is easy to lose under time pressure.
What to do instead
Memorise the SoA as a justified list of applicable controls with inclusion/exclusion reasons and current implementation status; memorise the risk treatment plan as the action plan with owners, resources and dates, plus acceptance of residual risk. For each, be able to say which clause requires it and who approves it.
Answering questions about interested parties by listing generic stakeholders (customers, regulators, staff) without identifying their relevant requirements and without stating which of those become compliance obligations.
Candidates treat 'interested parties' as a brainstorming exercise and stop at the list. The standard requires determining the relevant requirements of these parties, and the transition adds the explicit concept of compliance obligations, which many candidates have not separated from legal requirements alone.
What to do instead
Answer in three steps: identify the party, state the requirement that is relevant to the ISMS, then classify it (legal, regulatory, contractual, or self-imposed such as a policy commitment). Note that compliance obligations include self-imposed ones, and be ready to say where they are recorded and how they are kept current.
Describing top management involvement as 'supporting the ISMS' or 'approving the budget', rather than demonstrating leadership through specific behaviours such as establishing the policy, ensuring integration into business processes, and directing and supporting persons.
The word 'support' appears in the standard and candidates map it to the wrong clause, or they equate visible leadership with sign-off. Transition material emphasises leadership behaviours, and questions probe the difference between a sponsor and an accountable leader.
What to do instead
Learn the leadership clause as a set of active verbs: establish policy, ensure integration, ensure resources, communicate importance, ensure intended outcomes, direct and support persons, promote improvement. When a scenario describes a passive executive, name the specific leadership activity that is missing rather than saying 'management commitment is lacking'.
Treating risk assessment and risk treatment as one-off project activities performed before certification and then archived, and failing to recognise the requirement for planned intervals and when significant change triggers a re-assessment.
Transition projects are run as time-boxed programmes, so the assessment gets scheduled once. Candidates then answer 'annually' as a fixed rule, which is neither required nor sufficient.
What to do instead
Frame the answer around defined criteria and planned intervals set by the organisation, plus a trigger for significant change. Be able to give a concrete trigger example (new cloud service, merger, new regulatory obligation, major incident) and state that the output feeds the risk treatment plan and SoA updates.
Confusing the information security policy with the ISMS scope statement, or writing a policy answer that describes systems and locations rather than commitments and direction.
Both are short, top-level documents approved by management, and in small organisations they are sometimes combined. Questions that ask 'what must the policy include' attract scope content and vice versa.
What to do instead
Anchor the policy to commitments: appropriate to purpose, include information security objectives or the framework for setting them, commitment to satisfy applicable requirements, commitment to continual improvement. Anchor the scope to boundaries and applicability, including interfaces and dependencies. Draft one sentence of each from a sample scenario and check they are not interchangeable.
Ignoring the organisation's context when answering planning questions, so that risk criteria, objectives and the scope are presented as generic best practice rather than as derived from external and internal issues.
Context is the first clause and feels like scene-setting, so candidates skim it and jump to risk. Examiners use context to test whether later decisions are traceable.
What to do instead
For any planning question, open with a one-line context link: which external or internal issue drives this objective, criterion or scope boundary. Practise taking three issues (for example a sector regulator, a remote workforce, a key supplier dependency) and showing how each changes a risk criterion or an objective.
Describing information security objectives without the attributes the standard requires, such as being measurable where practicable, monitored, communicated, and supported by plans answering what, who, when and how.
Candidates write objectives as aspirations ('improve security culture') because that is how objectives are often stated in real organisations, and they forget the planning clause requires a plan to achieve each one.
What to do instead
Use a template for each objective: statement, metric or measurable criterion, owner, resources, timeframe, method of evaluation, and where results are reported. Convert one vague aspiration into a compliant objective and attach the four planning elements, then reuse the pattern in scenario answers.
Assuming competence and awareness are the same requirement, and answering awareness questions with training completion rates or answering competence questions with awareness campaigns.
Both sit under support and both involve people, and many organisations discharge both with a single e-learning module, so the distinction blurs in practice and in candidates' minds.
What to do instead
Separate the two: competence is about persons doing work affecting security performance having appropriate education, training or experience, with evidence retained; awareness is about all persons under the organisation's control knowing the policy, their contribution and the implications of non-conformance. For a scenario, decide which of the two the gap actually is before choosing the response.
Answering operational questions with 'the procedure exists' rather than describing execution under planned conditions, control of outsourced processes, and the treatment of planned changes and unintended changes.
Documented information is visible and auditable, so candidates equate having a document with having control. Operational planning and control questions deliberately probe the gap between a written procedure and a performed one.
What to do instead
For operation questions, state the criteria for the process, the resources and the person who performs it, the evidence of performance, how outsourced or externally provided parts are controlled, and how planned changes are reviewed and unintended changes corrected. When a scenario says a supplier performs the activity, address the retained responsibility explicitly.