This text is particularly important for companies that process customer data, employee data, or are part of the supply chain of larger organizations. In such cases, information security ceases to be merely a technical issue and begins to be an element of organizational responsibility.

ISO 27001 is often associated with a large amount of documentation, formalities, and certification primarily done "for clients." We too, when considering ISO 27001, initially viewed this topic from a public relations perspective - as a way to show that we take information security seriously. It was only during the preparations that it turned out the certification brought about significantly more organizational changes than we had expected.

We are neither a training nor an auditing company. We look at ISO 27001 from the perspective of an organization that had to implement the standard's requirements in its everyday work and then operate with them.

What ISO 27001 is in practice

ISO 27001 is a standard that describes an information security management system aimed at ensuring the confidentiality, integrity, and availability of data. In practice, it is not about individual technical safeguards, but about a holistic approach to processes, responsibilities, and controls within an organization.

It is also a change in mindset: from reacting to incidents to consciously managing risk.

Risk assessment - previously intuition, today a process

Before implementing ISO 27001, security-related decisions were primarily made based on experience and intuition. Risk, of course, existed, but it was not named, described, or assessed systematically.

The certification process enforced the introduction of formal risk assessment. This meant:

• identification of assets,

• defining potential threats,

• assessing consequences and probabilities,

• making informed decisions about which risks to accept and which to mitigate.

The difference before and after was significant. Risk assessment ceased to be a one-off exercise and became an element of everyday decision-making.

Low-level example: equipment, documentation, and responsibility

A good example of a practical change was the process of issuing equipment to employees. Previously, equipment was recorded in inventory systems, but there was no formal element of receipt. Information existed in the system, but there was no clear, official confirmation from the user's side.

After implementing ISO 27001, a simple, formal document confirming the receipt of equipment was introduced. Interestingly, the change was not solely of an audit nature. It turned out that the act of signing the document:

• gives the situation a formal character,

• strengthens the sense of responsibility,

• realistically influences the treatment of entrusted equipment.

This is a small example, but it well illustrates that standards often organize not only processes but also behaviors.

Standardization of documentation and organizing information

ISO 27001 forced the organization of documentation and a clear specification of where information is located, who is responsible for it, and how it is maintained. During the certification, document and procedure templates were created, which over time we began to develop and adapt to the real needs of the organization.

At the same time, it became evident that it is easy to fall into the trap of excessive documentation. A major challenge was finding a balance between meeting the requirements of the standard and maintaining work efficiency.

Implementation is a cost - primarily of time

The process of implementing ISO 27001 takes time and, in the initial period, realistically slows down work. It is necessary not only to prepare documentation but primarily to change the way the organization operates.

One of the challenges was to achieve certification objectives without getting "buried" in paperwork. Auditors often prefer paper documentation, while our goal was to maximize the transfer of control mechanisms into information systems. In practice, this meant:

• logging actions performed in systems,

• using logs as audit evidence,

• translating and confirming that the system data are a legitimate part of the audit.

This required additional work, but allowed for a healthy balance between formalism and efficiency.

Does ISO 27001 always make sense?

ISO 27001 is not a universal solution. For very small organizations or companies that do not process significant data, full implementation of the standard may be excessive. In such cases, it is worthwhile to first organize basic processes and only then think about certification.

What can be gained from this, even without a certificate

Even if an organization does not plan to certify ISO 27001, the thinking process imposed by the standard can be very valuable. It is worth asking oneself questions:

• do we know where our data is and who is responsible for it,

• can we assess risk instead of just reacting to problems,

• do processes work because "someone remembers," or because they are documented.

ISO 27001 turned out for us not to be an end in itself but a tool that organizes the organization. The greatest value came not from the entries in the certificate, but from the changes in the way of thinking and acting.