Articles
My articles across various subject – all for you to review.
-
How to Handle a Data Breach Under ISO 27001
How to create an ISO 27001 Data Breach Procedure in order to handle incidents within the scope of your ISMS
A data breach does not announce itself. It might surface as an unusual login alert at 11pm, a supplier calling to say they have received a strange email from your domain, a member of staff reporting that they sent a client file to the wrong person, or a ransomware notification on a Monday morning. In … Read more
-
ISO 27001 Myths Busted: 10 Things People Get Wrong
ISO 27001 is widely misunderstood — too big, too expensive, too IT-focused. We bust 10 of the most persistent myths with facts, figures, and plain English.
ISO 27001 has a mythology problem. Over the years a set of persistent misconceptions have taken hold — that it’s only for large enterprises, that it’s a purely technical exercise, that it takes years and costs a fortune, and that once you’ve got the certificate you can forget about it. Most of these myths have … Read more
-
ISO 27001 and AI: What Organisations Need to Consider
AI tools like ChatGPT and Microsoft Copilot create new information security risks. Here’s how ISO 27001 and AI relate — and what you need to document.
Generative AI tools have moved from novelty to mainstream workplace tool in an astonishingly short time. ChatGPT, Microsoft Copilot, Google Gemini, and dozens of specialist AI tools are now in regular use across organisations of all sizes — often with little formal governance around how they’re used or what data is being shared with them. … Read more
-
ISO 27001 vs GDPR: How They Relate
ISO 27001 and GDPR are often mentioned together, but they’re very different things. This guide explains how they relate, where they overlap, and requirements.
ISO 27001 and GDPR are two of the most frequently mentioned compliance frameworks in the UK — and they’re often confused with one another, or assumed to be interchangeable. They’re not. This guide explains what each one is, how they differ, where they overlap, and what the practical implications are for organisations that need to … Read more
-
ISO 27001 Password Policy: How to Write One
Learn what an ISO 27001 password policy must contain, what auditors look for, and how to write one that works in practice — not just on paper.
The password policy is one of the most practically important documents in your ISMS — and one of the most commonly done poorly. Either it sets unrealistic requirements that no one follows, or it’s so vague it provides no real guidance. This guide explains what ISO 27001 requires for password management, how to write a … Read more
-
ISO 27001 for Law Firms: What You Need to Know
Law firms hold some of the most sensitive data imaginable. This guide explains how ISO 27001 applies to legal practices, what clients expect, and how to get certified.
Law firms occupy a uniquely sensitive position in the information security landscape. You hold client matter files, commercially sensitive documents, personal data, financial information, and in some cases material covered by legal professional privilege — all of which are of significant value to cybercriminals, competitors, and hostile state actors. The legal sector has also seen … Read more
-
How to Prepare for an ISO 27001 Stage 2 Audit
How to prepare for an ISO 27001 Stage 2 audit; what evidence auditors examine, and how to make sure your team is ready on the day.
The Stage 2 audit is the one that matters most. It’s the evidence-based assessment where your auditor moves beyond reviewing documents and starts looking at whether your ISMS is actually operating. Pass Stage 2 and you’re certified. Walk in unprepared and you risk major nonconformities that delay your certificate. This guide on hor to prepare … Read more
-
ISO 27001 vs PCI DSS: Which Do You Need?
ISO 27001 vs PCI DSS — both relate to information security but they serve very different purposes. This guide helps you work out which one you need.
ISO 27001 and PCI DSS are both security frameworks, and both can appear in customer questionnaires and compliance requirements. But they’re designed for very different purposes, they’re managed by different organisations, and compliance with one doesn’t automatically mean compliance with the other. This ISO 27001 vs PCI DSS guide explains what each one is, how … Read more
-
ISO 27001 Management Review: A Complete Guide
Learn what an ISO 27001 management review is, who must attend, what it needs to cover, and how to run one that satisfies auditors.
The management review is one of those ISO 27001 requirements that many organisations treat as a box-ticking exercise: a meeting that happens because the standard says it must, producing minutes that nobody reads. Shelfware. That’s a mistake. Not just because auditors can usually tell when a management review has been done properly versus written up … Read more
-
How to Prepare for an ISO 27001 Stage 1 Audit
Learn what happens in an ISO 27001 Stage 1 audit, what the auditor is looking for, and how to be ready on the day so you can move confidently to Stage 2.
If you go through an accredited certification process (for example, in the UK, a UKAS-certified body like BSI), you’ll undergo a two-stage audit for your ISO 27001 certification. The Stage 1 audit is the first (surprise!). It’s sometimes called the “documentary review” or the “readiness review” — and it’s the point at which your documentation … Read more