The Board's 'All Controls' Mandate
A 900-person insurance broker has completed its first gap assessment against ISO/IEC 27001. The board reads that ISO/IEC 27002:2022 contains 93 controls and directs the CISO to implement all of them before the next surveillance audit in six months, citing 'full compliance' as the goal. The CISO has a budget of EUR 250,000 and a team of four. A risk assessment identifies 14 high risks concentrated in claims data leakage, ransomware on claims-processing servers, and supplier onboarding. Two controls in the standard are estimated at EUR 180,000 combined and address risks rated low because the related systems are being decommissioned in nine months. The sales director wants a marketing claim that the company 'complies with all 93 controls.' The CISO asks for guidance on how to respond.
1. Is the board's instruction to implement all 93 controls sound? Explain the role of ISO/IEC 27002:2022 and the correct mechanism for deciding which controls to implement.
Read the worked answer
ISO/IEC 27002:2022 is guidance, not a certifiable standard, and it does not require 'all 93' to be implemented. ISO/IEC 27001 requires a risk-based ISMS: the organization identifies risks, selects controls, and records them in a Statement of Applicability (SoA) with justification for inclusion or exclusion. Controls are a reference set, not a maturity checklist. Implementing every control regardless of risk would divert the EUR 250,000 from the 14 high risks, and two expensive controls protect systems being retired in nine months. The correct mechanism is the risk treatment plan plus SoA, with management approving residual risk. The board can set risk appetite and deadlines; it should not dictate control-by-control implementation.
2. How should the CISO respond to the board and to the sales director's marketing claim?
Read the worked answer
Reframe the request in risk language. Present the risk register heat map and show which of the 14 high risks each proposed control reduces. Allocate the budget first to claims data leakage, ransomware and supplier onboarding; defer or exclude controls where the risk is low, documenting the rationale and the decommission date. Offer a phased roadmap with measurable milestones. For the sales claim, do not use 'complies with all 93 controls': 27002 has no compliance status, and the claim would be unsubstantiated. If certification is desired, pursue ISO/IEC 27001 and make only claims supported by the certificate scope. Record board acceptance of residual risk in minutes so accountability is clear.
3. What should be done about the two controls addressing soon-to-be-decommissioned systems?
Read the worked answer
Do not implement them just to satisfy a count. Perform a cost-benefit and risk review, document in the SoA that they are not applicable or not justified because the systems will be decommissioned in nine months, and apply temporary compensating controls-network segmentation, monitoring and restricted access-until retirement. Set a review date and assign an owner to confirm decommissioning. If the board insists, explain that spending EUR 180,000 on low risks creates an opportunity cost and may reduce funding for higher risks. Revisit if decommissioning slips.