Beyond ISO 27001: Building an ISMS That Evolves

The Myth of the Safe System

At 2:17 a.m., a login attempt failed. Then another. Then fourteen more — all from an IP address that didn’t belong anywhere near the company’s internal network. Nothing crashed. No alarms rang. And by morning, the flurry had faded unnoticed into the logs.

A week later, during a routine internal audit, an analyst named Laila caught the anomaly. The login attempts were probing a legacy application — a dusty internal tool used by just a few departments and patched inconsistently. No data was lost. But the risk was real.

Later that day, a buried note surfaced in an old audit file: the vulnerability had been flagged months earlier. A recommendation to deprecate the tool had been written, routed, then quietly dropped in priority.

The security system didn’t fail because its firewalls were weak or its encryption broken. It nearly failed because there was no process for following up. No rhythm of review. No memory of risk.

That, in essence, is what Clause 10 of ISO/IEC 27001:2022 aims to prevent.

The organization shall continually improve the suitability, adequacy and effectiveness of the information security management system^[1].ISO/IEC 27001:2022, Clause 10

Getting certified is no longer the goal. In today’s threat environment, it’s just the start. The real question — the one Laila’s company almost learned the hard way — is what comes after the audit ends.

Why Organizations Get This Wrong

An academic review published in Computers & Security, Alshaikh (2020)^[2] identified “lack of post-certification discipline” as one of the core reasons ISMS frameworks decay in real-world settings . This erosion is often gradual and difficult to detect — until a breach forces a review.

To understand where organizations go wrong, we can visualize the ideal continual improvement loop:

Each stage feeds the next. When this loop breaks — through delay or oversight — vulnerabilities build.

Rethinking Improvement as a Systemic Discipline

A strange thing happens when a company finally achieves ISO 27001 certification: a sigh of relief. Documents are signed, auditors are gone and there’s a temptation — subtle but powerful — to treat security as a solved problem.

But certification is not the summit. It’s the base camp.

To understand why continual improvement isn’t optional, consider the following five realities:

1. Threat Landscape Demands a Moving System

The digital threat environment changes faster than most organizations can track. According to IBM’s Cost of a Data Breach Report 2023, the average lifecycle of a breach — from attack to containment — is 277 days. In that time, attacker tactics can shift dramatically^[3].

Consider the rise of Living-off-the-Land (LotL) attacks, where adversaries use legitimate admin tools like PowerShell or WMI to move laterally through networks without detection. These tactics exploit trust and bypass traditional defenses.

If your ISMS was designed two years ago to defend against phishing and malware — and hasn’t evolved since — it won’t stop modern attackers using these fileless tactics.

2. Compliance Is Not a Static Destination

Maintaining ISO 27001 certification is widely recognized as a challenge, especially in dynamic or multi-jurisdictional environments. Without structured updates, controls can become misaligned — a phenomenon we may call a “certification drift”.

This drift is especially acute in firms operating across multiple jurisdictions. Take the European Union’s Digital Operational Resilience Act (DORA)^[4] — a sweeping regulation that comes into full effect in January 2025. Under DORA, financial firms and their ICT providers are required to implement stringent controls that address operational continuity and cybersecurity resilience — not just in principle, but in measurable, auditable ways.

In other words: compliance doesn’t rest. It moves with the landscape, and your ISMS has to move with it.

3. Human Behaviour

Security is often compromised by human behaviour. In fact, the 2024 Verizon Data Breach Investigations Report attributes 68% of breaches to human factors — including error, privilege misuse and social engineering^[5].

A firm may implement multi-factor authentication, encrypt endpoints, and install SIEMs — and still fall victim to a phishing link clicked by a well-meaning employee.

This is where continual improvement shifts from technical optimization to cultural evolution. Regular awareness campaigns, phishing simulations and anonymous feedback loops help surface blind spots in employee behaviour.

4. Security Reviews Reveal More Than Vulnerabilities

Improvement isn’t just about plugging holes. It’s about streamlining what already exists.

For example, a Fortune 50 healthcare company eliminated thousands of hours in manual vendor risk work by implementing Rsam’s platform, which helped them identify redundant assessments and unassigned controls across a sprawling supplier base^[6].

Quarterly ISMS reviews often reveal more than risk — they uncover waste, duplication and confusion.

5. Continuous Improvement Builds External Trust

Security is now a core brand attribute. Clients — especially in B2B SaaS, healthcare and finance — don’t just expect security. They expect proof of improvement. They want to see real-time dashboards, not annual badges.

Companies like Atlassian and AWS publish regular security updates, changelogs and audit logs as part of their public trust programs. This isn’t marketing — it’s assurance.

Tools of the Trade — The Operational Backbone of a Living ISMS

A common misconception in ISMS management is that once policies are written and controls assigned, the system will somehow maintain itself. In reality, an ISMS — like any other system operating under uncertainty — requires continuous feedback, adjustment and validation.

This is where tools become essential. Not for their logos or interfaces, but because they enable three fundamental security functions:

• Monitoring: Seeing the system as it evolves
• Measurement: Knowing where it’s falling short
• Action: Automating or documenting the response

The below table examine some categories of tools that support continuous improvement, backed by examples, practical use cases, and direct implementation strategies. The goal isn’t to have all the tools — it’s to use the right ones for your scale, maturity and risk exposure.

Internal Auditing as Practice and Ethics

Internal audits often carry a bureaucratic reputation. They’re seen as scheduled obligations — forms to complete, logs to check, policies to revisit. But in a well-functioning ISMS, audits are something more. They are the pulse check of the system. And sometimes, they are its conscience.

At their core, internal audits serve a dual purpose: to verify alignment with ISO/IEC 27001 and to uncover areas of risk, inefficiency, or misjudgement before they escalate. This means they require more than technical skill. They require ethical clarity and operational independence.

The ISO/IEC 27001 Perspective on Audits

Clause 9.2 of ISO/IEC 27001:2022 mandates internal audits as a routine, structured activity that must:

• Be performed at planned intervals
• Evaluate conformity with the organization’s ISMS and the ISO standard
• Be conducted by independent, impartial parties
• Include documentation of findings and corrective actions
• Report results to top management

The organization shall ensure that the audit programme(s) take into consideration the importance of the processes concerned and the results of previous audits.ISO/IEC 27001:2022, Clause 9.2

The purpose is not only to catch failures — but to improve future resilience through analysis of near misses, process drift, or control fatigue.

Anatomy of an Effective Internal Audit

As illustrated in the below figure, an effective audit is neither rushed nor improvised. It follows a defined process that produces repeatable, defensible outcomes.

Here’s a structured model:

• Step 1: Identify which assets, systems, or departments will be audited. Cross-reference this with the Statement of Applicability, a key document listing which ISO controls are implemented.
• Step 2: Collect policies, control logs, incident reports and risk assessments. Schedule interviews with control owners and document system access where applicable.
• Step 3: Compare observed evidence against intended control objectives. Look for misalignment, partial implementation, or undocumented exceptions.
• Step 4: List non-conformities clearly: what was found, where, why it matters. Tie each to a clause in ISO/IEC 27001 and suggest corrective actions.
• Step 5: Present findings to leadership. This is critical. ISO requires that top management remains accountable for closing gaps and tracking improvements.

Tools That Support Auditing

Auditing doesn’t happen in isolation. Several platforms streamline or support internal audit functions:

Managing Change Without Chaos

In most cybersecurity incidents, the breach doesn’t start with a brilliant hacker. It starts with a change.

A system update goes live untested. A developer disables logging and forgets to re-enable it. None of these changes are malicious. But they’re disruptive. And if unmanaged, they create vulnerabilities that linger unnoticed until it’s too late.

The ISO/IEC 27001:2022 framework recognizes this. Clause A.8.32 requires that information security be considered in the management of change. That doesn’t mean preventing change — it means organizing it.

What Change Looks Like in an ISMS Context

Change can come from anywhere:

• Upgrading enterprise software (e.g., moving to Microsoft 365)
• Reorganizing staff or access groups
• Migrating infrastructure to cloud platforms
• Revising business processes or vendor contracts

Every time you migrate systems or reshuffle team access, you’re reshaping your risk landscape. And that risk landscape is exactly what your ISMS is there to guard — the confidentiality, integrity and availability of your information.

Components of a Strong Change Management Process

A resilient ISMS incorporates structured change management as a control layer — not a roadblock. The following flowchart illustrates a typical ISO 27001–aligned change governance model. It highlights how decisions, risk analysis and implementation steps should be structured — including what happens if a proposed change fails testing or approval:

At a minimum, this structure should include a clear policy that defines what qualifies as a change (routine, emergency, strategic), and a Change Advisory Board (CAB) that brings together IT and business leaders to assess risk from multiple angles. Impact assessments quantify what could go wrong — from system downtime to data exposure — while testing and rollback protocols give teams the confidence to proceed safely.

Most importantly, every change must leave a trail: what was changed, why, who approved it, and how it was verified. These records aren’t just helpful in audits — they’re what make learning from change possible.

Common Mistakes in Change Handling

Below are some of the most common mistakes organizations make in handling change within an ISMS, along with the risks they quietly introduce:

An ISMS doesn’t fail when a system changes. It fails when change occurs without planning, evaluation, or documentation.

ISO 27001 expects change to be controlled because change is inevitable. Mergers, new tech, staffing shifts — all impact information security. Organizations that succeed are those that turn change into a governed process, not a surprise.

The Ethical Framework for Monitoring — Protecting Without Overreaching

It begins with a good intention.

A company wants to prevent data leaks. So, it installs user activity monitoring software — screen capture, keystroke logging, IP tracking. At first, it seems reasonable. After all, protecting client data is non-negotiable. But weeks in, an employee discovers the scope of the surveillance. It feels invasive. There’s no transparency. Morale drops. Resignations follow.

The irony? The security controls worked. But trust broke down. And with it, the organizational integrity that security is meant to uphold.

This scenario isn’t hypothetical. It plays out, in various forms, across industries — particularly in high-risk, data-sensitive environments. And it highlights a key tension at the heart of information security: the balance between control and respect.

What ISO 27001 Says — and Doesn’t Say — About Ethics

Clause A.6.1.5 (Information Security in Project Management) and A.8.16 (Monitoring Activities) reference the need for policy-level controls, but stop short of addressing deeper questions:

• Who gets monitored — and who decides?
• Are employees aware of what’s collected?
• Is consent assumed, implied, or explicitly given?
• How long is behavioural data stored?
• Can users challenge what’s recorded?

These aren’t technical questions. They’re governance and culture issues — and they determine whether an ISMS strengthens or erodes internal trust.

Ethical Principles for Responsible Monitoring

To address this gap, organizations can embed ethical review into the ISMS lifecycle. Here’s a framework based on interdisciplinary research in cybersecurity governance:

1. Legitimacy: Monitoring must have a clear, justifiable purpose — tied to legal compliance, risk management, or safety. It should never be conducted “just in case.”
2. Transparency: Transparency transforms surveillance into accountability. Employees and stakeholders should understand:
   1. What is monitored
   2. Why it’s monitored
   3. Who has access to the data
   4. How long it’s retained

3. Proportionality: The scope of monitoring should match the level of risk. Monitoring all user activity to prevent low-risk errors is disproportionate and breeds resentment.
4. Informed Consent: Especially in regions governed by GDPR, CCPA, or other privacy laws, informed consent is not optional. Policies must be communicated clearly — ideally through onboarding, refreshers and policy acceptance forms.
5. Challenge and Redress: Employees should have the ability to challenge data collected about them, especially if it influences disciplinary action or performance review.

Ethical Risks Hidden in Security Controls

Security teams often deploy tools without full awareness of their surveillance capabilities:

Case Study – Amazon’s Living ISMS

Most companies treat ISO 27001 as a milestone. Amazon treats it as infrastructure.

At Amazon, information security is not a department—it’s an integrated function spanning logistics, cloud services, device manufacturing and customer trust. But what sets Amazon apart isn’t just its scale. It’s the way it designs and evolves its ISMS continuously, as part of everyday operations.

For a deeper look into Amazon’s approach, this short video explains how the company became one of the most security-forward organizations in the world.

ISO 27001 as a Competitive Advantage

Amazon has long maintained ISO 27001 certifications across key business units, particularly within Amazon Web Services (AWS). In 2023, Amazon advanced further by certifying its Buy with Prime and Multi-Channel Fulfilment (MCF) services to the ISO/IEC 27001:2022 standard, just months after the updated version was released^[7].

This rapid adoption demonstrates a core mindset: compliance should never lag behind risk. At Amazon, updates to security frameworks are viewed not as disruptions, but as catalysts for alignment and strategic trust-building.

DevSecOps and Continuous Testing

Amazon embeds DevSecOps principles across its product teams, ensuring that security is considered during design, development and deployment — not retrofitted afterward.

Each code deployment triggers:

• Static code analysis
• Dependency vulnerability scans
• Configuration drift detection
• Automated rollback protocols

Security controls are tied directly into CI/CD pipelines via tools like AWS CodePipeline, GuardDuty and third-party integrations.

Risk Monitoring and Response at Scale

Amazon’s ISMS includes real-time threat intelligence feeds, risk heatmaps and structured decision pathways for responding to zero-day vulnerabilities.

When a critical vulnerability called Log4Shell (CVE-2021-44228)^[8] was discovered, Amazon:

• Identified affected services within hours using centralized inventories
• Launched auto-remediation scripts across AWS
• Issued continuous customer communications outlining mitigations

This wasn’t just good crisis response. It was evidence of a resilient system, where real-time inventory, change control and cross-functional teams were already in place.

Privacy, Ethics and Transparency

While Amazon has faced privacy scrutiny, its ISMS practices in areas like data masking, role-based access control and incident disclosure reflect a clear operational commitment to ethical design.

Security bulletins, detailed whitepapers and dedicated compliance pages offer customers real-time visibility into:

• Data residency
• Encryption protocols
• System incident reports

This external transparency mirrors Clause 10’s guidance on continual improvement: customers should not only be protected, but informed.

What Other Organizations Can Learn

You don’t need Amazon’s resources to follow Amazon’s mindset. Here’s how smaller firms can adopt scaled versions of these practices:

Free tools like OpenVAS, OSQuery and MITRE ATT&CK Navigator can provide valuable automation and threat modeling without enterprise-level costs.

When Security Becomes Culture

ISO/IEC 27001 gives organizations the framework. But it doesn’t tell them how to live it.

Organizations that embrace continual improvement treat every audit as a feedback loop. Every policy review as a strategic calibration. Every minor vulnerability as a chance to learn before an attacker forces them to.

In doing so, they build more than compliance. They build confidence — within their teams, among their clients and across every layer of their digital environment.

At Laila’s company, the incident became a turning point. She led a team to rebuild their ISMS — with monthly reviews, real-time dashboards and a policy to close every audit loop. Not because they had to. But because they nearly didn’t make it in time.

That is what an ISMS should be: a living system that gets smarter, faster and stronger over time.