ISO 27001 is the gold standard for information security management — but getting certified is often easier said than done.
Maybe you’ve started the process, scoped your environment, and drafted a few policies. But now the project has slowed… or stopped. No one’s updating the risk register. The internal auditor moved teams. The executive sponsor is asking for a timeline — again.
If that sounds familiar, you’re not alone.
At FirstCall Consulting, we’ve helped dozens of companies rescue or restart ISO 27001 initiatives. Here are the most common reasons these projects stall — and how to fix them without starting from scratch.
An Information Security Management System (ISMS) is more than documents and checklists. It’s supposed to reflect how your business actually works — not a theoretical version of it.
Too often, ISO 27001 gets delegated to one person or siloed to IT, without cross-functional buy-in from HR, Legal, Ops, or Product.
The fix:
Reframe the ISMS as a shared business asset. Identify key stakeholders for each control category, and build a governance rhythm (e.g, quarterly review meetings) to keep it active.
The risk assessment is the foundation of your ISO controls. But many companies either skip it, overcomplicate it, or treat it like a one-time exercise.
Without a clear understanding of your real-world risks, you can’t justify controls, scope your Statement of Applicability, or demonstrate maturity to auditors.
The fix:
Create a simple, business-aligned risk register. Link risks to people, processes, and systems, and update them at least quarterly.
Some teams go overboard with 80-page policy documents. Others just wing it and assume “the way we work” will speak for itself. Neither approach holds up during an audit.
The fix:
Use fit-for-purpose documentation. Create policies that are specific, usable, and enforceable. Lean on prebuilt templates to reduce writing time — but tailor them to your real practices.
ISO 27001 isn’t meant to sit on a shelf. You’ll need evidence of ongoing compliance — like user access reviews, incident logs, and training records.
If those things aren’t built into your team’s normal workflows, they’ll get skipped — and you’ll scramble to recreate them before audit.
Getting stuck doesn’t mean you’ve failed. It just means your ISO program needs a clearer strategy, better alignment, and the right support.
At FirstCall Consulting, we help clients:
🎯 Want to see how close you really are to ISO 27001 readiness?
Book a free strategy call →
📋 Prefer to self-assess first?
Download the ISO 27001 Readiness Checklist →
🎧 Coming soon: ISO in Action: How to Make Your ISMS Stick – Available on Spotify