The ISO 27001 Episode

Introduction to the Guest and Topic:

Host Allie Krings introduces Joseph Kirkpatrick, Founder and President of Kirkpatrick Price. The conversation focuses on ISO 27001 and what it takes for organizations to achieve certification. Joseph shares his background and experience, explaining how his firm has worked alongside clients to guide them through complex audits and help them strengthen their information security programs.

What Is ISO 27001?:

ISO 27001 is an internationally recognized information security standard published by the International Organization for Standardization (ISO). It provides a framework for building and maintaining an Information Security Management System (ISMS).

The standard is widely regarded as one of the foundational frameworks in cybersecurity and focuses on managing risk and implementing controls to protect an organization’s information assets.

What Does ISO 27001 Look Like Up Close?:

For Organizations: ISO 27001 requires organizations to establish a structured system for managing information security. This includes defining policies, assessing risks, implementing controls, and continuously improving the program.

For Teams: Achieving certification is a collaborative effort. It involves multiple departments such as IT, HR, leadership, and operations, all working together to implement and maintain controls across the organization.

What Are the Biggest Gaps in Compliance?:

A common gap is focusing too heavily on checking off requirements rather than understanding the bigger picture of risk management. Organizations that treat ISO 27001 as a checklist often miss the purpose of protecting the business and its data.

Another gap is insufficient documentation. As Joseph emphasizes, if controls and processes are not documented, they are considered not to exist from an audit perspective.

How Should Organizations Assess Their Risk?:

Risk assessment is the foundation of ISO 27001. Organizations must identify their risks, evaluate their impact, and determine how to address them through appropriate controls.

Rather than applying every control universally, organizations should select controls based on their specific risks. This approach makes the process more practical and aligned with real-world needs.

What Does the ISO 27001 Process Look Like?:

Stage One Audit: This phase focuses on reviewing documentation and determining whether the organization is prepared for certification. Auditors evaluate policies, identify gaps, and provide feedback.

Stage Two Audit: This is the formal certification audit where organizations must demonstrate that controls are not only documented but actively implemented and operating effectively.

Nonconformities: Findings are categorized as either minor or major. Minor issues are typically fixable gaps in documentation or process, while major issues can prevent certification if core requirements are not met.

What Are the Key Areas Auditors Focus On?:

Internal and External Issues: Organizations must identify factors that can impact their security program, such as regulatory requirements, industry risks, and internal challenges.

Interested Parties: Companies need to define stakeholders—such as customers, regulators, and partners—and understand their expectations regarding security and compliance.

Risk Assessment: Auditors place significant emphasis on how organizations identify, evaluate, and respond to risks, including how frequently assessments are conducted and updated.

Management Review: Leadership involvement is critical. Executives must actively oversee the program, review findings, and ensure that risks and issues are being addressed.

What Are the Biggest Lessons from Real Audits?:

A key lesson is that certification is not just about passing an audit—it’s about building a strong, sustainable security program.

Organizations often discover gaps in areas like management oversight or communication, which require redesigning processes to ensure leadership is informed and actively involved.

How Should Companies Prepare for Certification?:

Start with Risk: Focus on understanding your organization’s risks rather than trying to tackle every requirement at once.

Define Scope Clearly: Organizations must determine which parts of the business are included in the certification and document which controls apply.

Practice Before the Audit: Going through an independent review helps organizations prepare for the certification audit and avoid surprises.

Who Needs to Be Involved?:

ISO 27001 is not a one-person effort. Successful implementations involve cross-functional collaboration:

• IT teams manage technical controls
• HR handles personnel-related controls
• Facilities teams oversee physical security
• Leadership ensures governance and oversight

This shared responsibility ensures that security is integrated throughout the organization.

How Can Companies Ensure Compliance?:

Compliance begins with a strong foundation in risk management. Organizations must continuously evaluate their risks, implement appropriate controls, and adapt to changes in their environment.

Leadership involvement, clear documentation, and ongoing monitoring are essential to maintaining compliance and achieving long-term success.

Ultimately, ISO 27001 is not just about certification—it’s about building a resilient security program that protects the organization and its stakeholders.