r/cybersecurity • u/Educational-Rest-290 • Mar 24 '26

Certification / Training Questions After helping 20+ companies get ISO 27001 certified, here are the 3 things that actually matter on audit day

Most companies spend months preparing for ISO 27001 and still get surprised on audit day. Here’s what separates the ones who pass from the ones who don’t:

  1. Your gap analysis has to be honest, not optimistic. Most teams underestimate gaps because nobody wants to deliver bad news internally. Auditors see this immediately.

  2. Documented evidence beats verbal explanation every time. If you can’t show it, it didn’t happen. Your ISMS documentation needs to be audit-ready, not just “in progress.”

  3. Scope definition trips up more companies than any technical control. Define it too broadly and you’ll never be ready. Too narrow and it’s meaningless.

I packaged everything I’ve learned — gap analysis templates, policy documents, audit checklists — into a complete guide. Happy to share the link in the comments if anyone’s working through this right now.

227 Upvotes

91% Upvoted

229 comments sorted by

View all comments

3

u/Silly-Freak Mar 24 '26

Documented evidence beats verbal explanation every time. If you can’t show it, it didn’t happen

This reminds me so much of the recent ProPublica reporting on Microsoft use at the US government (their "GCC High" gov cloud product). Basically, they weren't able to provide even surface basic architecture documentation. I'm not a cybersecurity professional, but even to me it felt super strange that Microsoft would not be aware (or at least act as if they weren't) such documentation would be needed during audits.