r/ISO27001

Hi all, I was recently made redundant from a 19 year tech career. The last 10 years or so have been in leadership/director positions for a range of areas. Project/Program Mngt, Software engineering, SASS management, product etc. I’m feeling very generalist at the moment and thinking that I’d like to specialise in security. Most of my roles have some kind of contact with GRC but it’s not been my main role. I’ve done my ISO 27001 LI and should have 42001 done in the next couple of weeks. I’m looking for areas I can build up some more experience and also would love some mentorship. Posting on here in case anyone can help.

Australian SaaS team, just under 30 people, and we're trying to work out what ISO 27001 certification is realistically going to cost us.

I thought we'd get a few quotes, compare them, pick one and move on. instead every quote seems to be describing a slightly different project.

one assumes we already have most of the ISMS in place. another bundles a lot of prep but leaves the audit separate. another looks cheap until you start asking who writes the policies, who closes the gaps, who gathers the evidence and how much engineering time is still expected from us.

that's the bit making me nervous. I'm not even sure I'm comparing the same thing anymore.

the actual certification fee is almost the least confusing number in the spreadsheet. I'm more worried about signing something that looks reasonable, then finding out three months in that we're still doing half the work ourselves and paying separately for the rest.

right now I'm breaking everything out into platform or consultant, auditor, pen test, internal hours and ongoing maintenance because "all-in" seems to have a very flexible definition.

​

I've seen a big spread. Most firms ive seen report basically "conforming / nonconforming" or usually "met / not met" per clause and control with very little narrative.

Where I work, we document the evidence behind every clause (4-10) and every Annex A control: policies and procedures reviewed, ticket samples, interviews, inspections, etc.

Curious what everyone else sees:

Do you record evidence per clause and control, or only for findings?

Do you list the exact records and samples reviewed?

Does your report show how you tested the SoA and control applicability?

Have clients or certification bodies ever asked for more or less?

Is a bare "conforming" ever enough, or a red flag?

Auditors, implementers, and clients who've received reports, all welcome.

I recently cleared the LA exam by TUV SUD - CQI|IRCA certified- ISO 27001. Need to get some real world experience, new to this field. How do I approach this and what should be my focus for the next month or so in order to find a job?