Articles
My articles across various subject – all for you to review.
-
ISO 9001:2026 – The new version is here, and what it means to you.
Find out what ISO 9001:2026 version means to your business. What’s different, and what you need to do by when. Everything explained.
ISO 9001:2026 · Guide By Fiona Parker, ISO 9001 Certified Lead Auditor, Iseo Blue ISO 9001:2026 was published on 16 September 2026 and replaces ISO 9001:2015 as the current edition of the standard. Certified organisations have a three-year transition period, so certificates issued against the 2015 edition remain valid until September 2029, subject to formal confirmation … Read more
-
The Cyber Security Breaches Survey 2025/2026: what the numbers really say about small business security
What the official 2025/2026 survey really says about small business cyber risk: the £0 median cost, the backslide on basics, and the supplier squeeze coming.
43% of UK businesses were breached or attacked in the last year £0 median cost of the most disruptive breach, but it’s a lottery 38% experienced phishing – far ahead of anything else 19% ran any staff training or awareness activity Every spring, the government publishes a snapshot of UK cyber security: the Cyber Security … Read more
-
ISO 27001 for Accountants and Financial Services Firms
ISO 27001 for Accountants and Financial Service Firms Financial services and accountancy firms face relentless pressure to protect sensitive client information, maintain regulatory compliance, and demonstrate robust information security. The Financial Conduct Authority, the Information Commissioner’s Office, and professional bodies including the ICAEW and ACCA have set high expectations for how firms must safeguard data. … Read more
-
ISO 27001 Recertification: What Happens After 3 Years
My guide on what happens around ISO 27001 recertification. Learn the key elements and what to prepare for.
Achieving ISO 27001 certification is significant. Maintaining it is the longer game — and one that catches organisations off guard more often than the initial certification does. The three-year certification cycle is structured so that certification bodies can maintain reasonable confidence that certified organisations continue to operate their ISMS effectively between audits. But the structure … Read more
-
ISO 27001 Certification for SaaS Companies: Your Questions Answered
I get a lot of clients that are launching their SaaS products to the market and want to get ISO 27001. So, here I’ll answer some common questions.
SaaS companies pursuing ISO 27001 certification tend to arrive at the process with a specific set of questions — some of which differ meaningfully from those asked by traditional enterprises. The nature of SaaS businesses creates particular scoping considerations, supplier dependencies, and commercial drivers that shape how certification works in practice. This guide addresses the … Read more
-
Can You Self-Certify for ISO 27001? (And Should You?)
Can you self certify for ISO 27001? Yes. Should you? That requires some consideration.
The short answer is yes — you can self-declare conformity with ISO 27001 without engaging a certification body. The longer answer is… that self-declaration and third-party certification are different things that serve different purposes, and which is appropriate depends entirely on why you want the certification in the first place. This distinction matters because organisations … Read more
-
ISO 27001 Audit Findings: How to Respond to Nonconformities
Learn how to manage ISO 27001 audit findings: how to log, process and resolve nonconformities.
Receiving a nonconformity from your ISO 27001 auditor is not a crisis. It is a structured event with a defined process, a clear timeline, and a straightforward set of requirements. Most organisations that respond well to nonconformities achieve certification — or maintain it — without significant difficulty. Most organisations that struggle do so not because … Read more
-
ISO 27001 Certification Without a Consultant: Is It Possible?
Can you implement ISO 27001 without a consultant? Short answer: Yes. But here I’ll explore the potential benefits and pitfalls.
The short answer is yes — many organisations achieve ISO 27001 certification without engaging an external consultant, and some of them do so efficiently. The longer answer is that whether you should depends on what you already have in-house, how much time your team can commit, and what you are willing to learn as you … Read more
-
ISO 27001 Certification: UKAS vs Non-UKAS — Does It Matter?
Explore the differences between UK certifications: UKAS vs Non-Accredited certificates. How the differ, and does it matter?
When you are choosing a certification body for ISO 27001, one of the first things you will encounter is the question of accreditation. Some certification bodies hold accreditation from UKAS — the United Kingdom Accreditation Service, or its equivalent in other countries. Others do not. The difference in cost can be significant. Whether the difference … Read more
-
ISMS Document Control: How to Manage It Properly
How to manage your ISMS documentation. Read my guide on how to implement ISO 27001 document control and meet the requirements of the standard.
Document control is one of those requirements that organisations either over-engineer into a bureaucratic nightmare or under-deliver on to the point where an auditor cannot find what they need. Both failure modes are common. The right approach sits between them: a consistent, proportionate system that keeps your ISMS documentation accurate, accessible, and trustworthy — without … Read more