Insights
Building, certifying and running an information security management system: scope, risk, the Statement of Applicability, controls and evidence.
Certification is not one audit but a two-stage event inside a three-year cycle. Stage 1 checks whether the ISMS is ready and documented; Stage 2 tests whether it actually operates. Here is what a certification body looks for at each step.
16 Oct 2026 · 7 min read
The certificate clears the first filter, but enterprise buyers dig into scope statements, access-review evidence, and pen-test recency. Here is how to prepare a posture summary before due diligence begins.
8 Oct 2026 · 6 min read
Vague SoA justifications are one of the most common nonconformities at certification stage. Learn what strong inclusion and exclusion rationale looks like, and what auditors reject.
14 Sept 2026 · 6 min read
Engineering teams running CI/CD pipelines already produce the change management evidence ISO 27001 needs. The challenge is identifying it, connecting it to the right controls, and presenting it coherently.
8 Sept 2026 · 6 min read
A green integration in Vanta means the platform can read your user lists. It does not mean anyone has decided who should have access. Auditors need evidence of human judgement and sign-off, not a connected status.
24 Aug 2026 · 6 min read
Law firms buying legaltech products want documented evidence that client-matter data cannot bleed across matters or tenants. ISO 27001 access reviews, need-to-know controls and DMS sub-processor records are the artefacts that answer the question.
21 Aug 2026 · 6 min read
Regulators and ISO 27001 auditors both want to see the same things when it comes to DSAR handling and data retention in credit and collections: an audit trail, a working schedule, and destruction evidence. This guide covers what that looks like in practice.
9 Aug 2026 · 7 min read
Collections firms hold call recordings containing personal and financial data that regulators and ISO 27001 auditors both scrutinise. This guide covers the access, retention, and disclosure controls that close the governance gap.
6 Aug 2026 · 7 min read
PSP security reviews are not a one-time gate - they are a recurring obligation. This guide explains the evidence pack an online casino must maintain to satisfy PSP, scheme, and regulator demands across the relationship lifecycle.
31 Jul 2026 · 6 min read
Scoping an ISMS for a PSP is harder than it looks. Drawing the boundary around settlement, routing, KYC, and sponsor bank connections without going too broad or too narrow is where most firms stumble.
25 Jul 2026 · 7 min read
A certificate or an attestation report - they answer different customers. When you need ISO 27001, when you need SOC 2, when you need both, and how to avoid paying twice for the same evidence.
16 Oct 2026 · 4 min read
PCI DSS and ISO 27001 share meaningful common ground in access control, change management, and incident logging - but the gaps are real and specific. Here is the honest map.
22 Jul 2026 · 6 min read
MT4 and MT5 admin credentials are among the highest-risk access points in any FX broker. Here is the ISO 27001 evidence gap that appears in almost every readiness review.
16 Jul 2026 · 7 min read
A CySEC-regulated FX broker is not a standard SaaS company. Here is what an ISO 27001 auditor looks for first - and where most brokers fail Stage 1.
13 Jul 2026 · 6 min read
A practical, end-to-end guide to getting a SaaS company genuinely ready for ISO 27001 - scope, risk, SoA, evidence, control ownership and the operating rhythm that survives an audit.
3 Jul 2026 · 10 min read
Certification audits reveal problems that were visible months earlier. Here is what auditors find, why teams miss it, and how to run your own review before the stakes get high.
1 Jul 2026 · 3 min read
Compliance platforms collect evidence beautifully. They cannot decide whether your scope, risks, Statement of Applicability, control ownership and evidence quality make sense. Here is the gap - and how to close it.
1 Jul 2026 · 7 min read
The SoA is the map between your controls and reality. This guide shows how to review it the way an auditor will - applicability, justification, evidence and consistency with your risk assessment.
28 Jun 2026 · 9 min read
Policies describe intent. Controls produce evidence - but only when a named person owns them. Here is how to assign ownership that keeps an ISMS alive.
13 May 2026 · 3 min read
For SaaS teams, your CI/CD pipeline, code review and change approvals already produce most of the audit evidence ISO 27001 expects. The gap is usually proving it, not doing it.
22 Apr 2026 · 3 min read
A concrete countdown for the last 90 days before Stage 2, focused on what must already be true and cannot be manufactured at the last minute.
15 Apr 2026 · 3 min read
ISO 27001 can open doors or stall your team, depending on how you scope and sequence it. Here is what to know before you start.
18 Mar 2026 · 3 min read
For payment companies, ISO 27001 evidence has to reflect how money and cardholder data actually move. Generic SaaS evidence rarely covers it.
4 Mar 2026 · 3 min read
Scope is the most consequential early decision in ISO 27001. Fintechs tend to draw it too narrow or too vague, and pay for it later.
25 Feb 2026 · 3 min read
ISO 27001 for SaaS is not a documentation exercise. Product-led GRC connects security governance to how the product is actually built and sold.
18 Feb 2026 · 3 min read
From gap assessment and implementation to internal audit and ongoing ISMS support - scoped to where your system actually is.