ISO/IEC 27001 in everyday work

From requirements to a functioning system

ISO/IEC 27001 defines requirements for an information security management system (ISMS). Protecting the confidentiality, integrity and availability of information requires risk management and maintaining and improving the system. The standard provides a framework; its application needs to reflect the organisation’s context.

This article presents my practical perspective on recognising gaps between documented rules and everyday work. I focus on workable procedures, communication between processes and employees’ understanding of the rules.

Procedures need to reflect reality

A procedure can look correct yet fail in practice. This happens when it describes ideal conditions rather than actual work, or overlooks organisational and technical constraints. When assessing rules, I therefore consider both their content and whether people can apply them.

In information security, this includes sharing data, obtaining access or reporting suspicious events. Staff need to understand what a situation requires and be able to carry out the intended action.

When a gap appears, it is necessary to establish whether the procedure, the way of working or the available resources need to change. Adapting rules to reality does not mean abandoning requirements. The aim is to find a workable way to meet them while taking risk into account.

The same information can mean different things to different people

At the boundary between processes, it is necessary to establish what one process passes to another, in what form and what the recipient expects. Sending information does not mean that both parties understand it in the same way.

Imagine the instruction: “Go to Paris and call when you arrive for further directions.” It sounds clear until it turns out that the sender meant a place in Poland called Paryż, while the recipient travelled to France. Both may believe they did their part correctly, even though a shared understanding of the destination was never established.

In an ISMS, similar ambiguity may concern the intended recipient of information, the scope of access or how to report an event. It is worth checking whether the recipient understands what they received, what they may use it for and what action is expected. This matters for preventing unauthorised access as well as keeping information accurate and available when needed.

Training should prepare people for different situations

I consider training and awareness fundamental to a functioning system. They should help staff recognise situations, understand their significance and take appropriate action.

As with emergency response exercises, there is value in using different scenarios. It is impossible to anticipate every event, but people can develop the ability to assess a situation and apply principles even when a problem differs from a familiar example.

Information security examples might include a suspicious message, a request to share data or the unavailability of a system needed for work. Such scenarios can help establish whether staff understand their role, know where to find support and when to escalate. These are suggested examples to adapt to an organisation’s tasks and risks.

Daily work reveals how the system functions

To assess whether a system works in practice, I observe processes and talk to employees. They are a key source of knowledge about difficulties, ambiguities and constraints in daily work. Their perspective should be considered alongside requirements, records and dependencies between processes.

I look at whether a person can explain what to do and show how they do it in practice. A difference between a document and an action is a starting point for understanding the cause. It may indicate unclear wording, a knowledge gap, a technical constraint or insufficient resources.

These observations complement audits and reviews. They help identify opportunities for improvement during everyday work, rather than postponing verification until preparations for the next audit.

Summary

For me, a functioning ISMS is one where requirements are reflected in how work is carried out. Procedures are workable, information exchanged between processes is understood, and staff can apply the rules in different situations.

The value of this approach lies in identifying and correcting gaps before they cause an information security problem. Documentation, training and process observation should work together towards that purpose.