ISO 27001 Controls

Most data breaches are not caused by clever external hacking. They happen because someone inside or connected to the business had access they simply did not need. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations treat access as a default entitlement or […]

Source code is not just technical material. It is your organisation’s intellectual property, operational logic, and security enforcement mechanisms all wrapped into one. Over my 30 years in governance, risk, and compliance, I have seen far too many businesses treat source code repositories like open digital filing cabinets, granting blanket

Authentication is the front door to your information systems. If it is weak, every single security control behind it is completely exposed. Over my 30 years in governance, risk, and compliance, I have seen far too many businesses spend heavily on advanced firewalls and encryption, only to get compromised because

Security incidents are not always caused by clever external attackers. Many are caused by systems simply running out of capacity. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations treat capacity as a routine IT performance issue, right up until a database disk

Malware rarely announces itself. It blends into everyday emails, innocent file downloads, compromised software updates, and routine maintenance until systems stop working, files are encrypted, or data is quietly exfiltrated. Over my 30 years in governance, risk, and compliance, I have seen far too many businesses place blind, absolute faith

No system is ever completely vulnerability-free. The real risk comes from not knowing what weaknesses exist, or reacting too slowly when you do. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations treat vulnerability management as an occasional, reactive firefighting exercise. They run

Most security weaknesses are not exotic, zero-day exploits. They are simple misconfigurations that quietly accumulate over time. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations spend a fortune on advanced threat detection tools while leaving default passwords active, unneeded ports open, or

Information that is no longer needed is not harmless. It is unmanaged risk waiting to be exposed. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations hoard decades of legacy customer files, old database dumps, and forgotten cloud snapshots under the excuse that

Not everyone who needs data should be able to identify people or see sensitive financial details. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations hand full, raw production databases over to developers, support staff, or third-party analytics partners just so they could

Most data loss does not involve clever hackers breaking into your network. It involves sensitive data quietly leaving through normal business channels that nobody was watching. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations spend a fortune on firewalls, only to lose

Backups are not about convenience. They are about survival when something goes wrong. Over my 30 years in governance, risk, and compliance, I have seen far too many businesses take comfort in a green dashboard checkmark showing a “successful backup,” only to discover during a real ransomware attack or server

Availability is not achieved by hope. It is achieved by designing systems that continue to operate when something fails. Over my 30 years in governance, risk, and compliance, I have seen far too many businesses suffer catastrophic downtime because they assumed their systems were redundant simply because they were in

If you cannot see what is happening in your environment, you cannot protect it. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations treat logging as a passive technical by-product, something that sits quietly in the background accumulating dust until a major incident

Security incidents rarely arrive without warning. The warning signs are almost always there inside your systems—if you are actually looking for them. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations collect millions of system log lines every single day, only to store

When system clocks disagree, the truth becomes hard to prove. Over my 30 years in governance, risk, and compliance, I have seen far too many security investigations completely collapse because system logs differed by just a few minutes. Imagine trying to piece together a cyber attack timeline when your firewall

Utility programs are powerful by design. That power is exactly why they need tighter control than ordinary software. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations leave administrative utilities, system diagnostics, and low-level disk tools sitting openly on production servers for “convenience.”

Most serious production outages do not start with clever external attackers. They start with uncontrolled software changes inside live environments. Over my 30 years in governance, risk, and compliance, I have seen far too many businesses let well-meaning engineers or staff apply “quick updates,” unapproved utilities, or untested patches directly

Networks are where information moves, and where attackers look first. If your network is not controlled, every single device connected to it is completely exposed. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations treat their network as a background transport layer, focusing

Networks are only as secure as the services running on them. If your network services are weak, protected systems quickly become irrelevant. Over my 30 years in governance, risk, and compliance, I have seen far too many businesses spend heavily on perimeter firewalls, only to leave directory services, email routing,

Once an attacker gets a foothold in your network, they do not stop at a single system. They move sideways until they find your core databases, domain controllers, or financial tools, unless the network stops them. Over my 30 years in governance, risk, and compliance, I have seen far too

Encryption is not a “nice to have”. Used properly, it is one of the single most effective controls for protecting your information. Used poorly, it creates technical fragility, operational risk, and false confidence. Over my 30 years in governance, risk, and compliance, I have seen far too many businesses flip

Most software vulnerabilities are not caused by clever attackers. They are designed in, long before code ever reaches production. Over my 30 years in governance, risk, and compliance, I have seen far too many businesses treat security as a final checkbox or a last-minute penetration test right before go-live. The

Applications are where your data lives, where decisions are made, and where money changes hands. Over my 30 years in governance, risk, and compliance, I have seen organisations deploy state-of-the-art firewalls and hardware encryption, only to get completely ruined because their core web application lacked basic security rules. If your

Most security failures are not caused by missing security tools. They are caused by poor design decisions made early and never revisited. Over my 30 years in governance, risk, and compliance, I have seen far too many businesses bolt expensive security appliances onto a fundamentally flawed network design, only for

Most application vulnerabilities are not sophisticated. They are basic coding mistakes repeated at scale. Over my 30 years in governance, risk, and compliance, I have seen far too many businesses spend fortunes on firewalls and penetration testing while their development teams write hardcoded passwords, ignore input validation, and copy-paste unvetted

Most security failures are discovered after deployment, when fixing them is slow, expensive, and disruptive. Over my 30 years in governance, risk, and compliance, I have seen far too many organisations run comprehensive tests on software functionality, only to go live with massive security holes because no one bothered to

Outsourcing development does not outsource your risk. Over my 30 years in governance, risk, and compliance, I have seen dozens of companies buy expensive custom software from external agencies, only to find out during an audit or a security incident that the developers built massive security flaws right into the

Many major security incidents are not complex, external cyber attacks. They are simple, accidental changes made in the wrong environment. Over my 30 years in governance, risk, and compliance, I have seen developers accidentally drop a database or release unverified code simply because they thought they were connected to a

Most security incidents are not caused by sophisticated new threats. They are caused by poorly controlled changes. Over my 30 years in governance, risk, and compliance, I have seen countlessly well-meaning IT staff push a quick fix or configuration tweak, only to bring down the whole network or accidentally expose

Test environments are essential for building reliable software. But taking a copy of your live database and dumping it straight into a test environment without controls is one of the fastest ways to cause a major data breach. Over my 30 years in governance, risk, and compliance, I have seen

Audits are supposed to reduce risk. Handled badly, they create it. Over my 30 years in governance, risk, and compliance, I have seen plenty of well-meaning auditors accidentally cause system outages or extract sensitive data without proper controls. Uncontrolled audit testing is a security incident waiting to happen. ISO 27001:2022

Most cyber attacks do not break through your front door with brute force. They get invited in through a normal web browser. I see this all the time in real-world audits. An employee clicks a link, visits a bad site, and suddenly your business is dealing with a major incident.