On Monday I start another ISO 27001 Lead Implementer class. One week, one room, and a group of people I mostly haven’t met yet.
Before every class I do the same thing. I open the participant list and read it slowly. I’m not really looking at the names. I’m looking at the job titles and the companies, trying to picture who will be sitting in front of me. The standard I teach doesn’t change. But the examples I pick do change. So do the questions I should expect, and the parts of the lecture where I’ll slow down a bit.
This time the list made me smile. It’s a really good mix. There are IT people who build and run systems every day. There’s a risk manager who thinks in terms of likelihood and impact. There’s the Chief Information Security Officer (CISO) of a large bank, someone who already carries the weight of security decisions in a real company. There’s someone who wants to become a consultant. And there’s a student. She’ll come in with fresh eyes and none of the habits the rest of us have picked up along the way.
Looking at that list reminded me of something I don’t say often enough. I give a lot in these classes. But I always take something home too.
What I bring is easy to describe. I’ve spent about twenty years with this standard, on both sides of the table. I’ve helped companies build their systems, and I’ve audited them for certification. So I can tell people what looks good on paper and what still holds water when certification time comes.
What I take home is harder to describe, but it’s real. Every person brings their own experience and the challenges from their own company. And quite often, one of them makes me stop and think.
It usually starts with a question like: “Can we do it this way instead?” The idea that follows is sometimes a bit unusual, because that’s not how things are normally done.
Over the years I’ve learned not to dismiss these ideas too quickly. ISO 27001 is a surprisingly open standard. It tells you what you need to achieve, and it mostly leaves the “how” to you. So quite often the unusual idea works. And sometimes the whole room picks it up, and together we turn it into something better than any of us had at the start.
One moment stays with me. We were talking about documentation. I was explaining something I repeat in every class. Documentation is not the goal of implementing the standard. It’s there to ensure consistency and to record what you do and how. It should work for you. You shouldn’t become a slave to bureaucratic document production.
Then one participant raised his hand. “We’re a software company. We live in Git. Can our management system documentation ‘live’ there too?”
I almost said, “Wait a minute, that’s not really how…” Then I stopped… I thought about it for a good minute, and said: why not?
My reasoning was simple: “The standard doesn’t care where your documents live. It only cares that they’re under control, and Git already does that. Heck, probably even better than a shared folder full of Word files.”
He left with an idea for his company. I left with a better example for my next class.
That’s the part of this job I like most.
Which brings me back to this week’s list. Looking at all those different roles, I had an idea.
In a real company, an implementation never happens among people who think alike. IT, the risk people, management and the consultant all look at the same requirement and see different things. Half of the implementation work is getting them to understand each other.
So this time I might try something new. This week, I could organize the class as a small company. At first, everyone gets a role close to the one they have in real life. Then, from one exercise to the next, the roles switch. The IT person becomes the risk manager. The CISO plays the consultant. The student might end up as top management.
I have no idea how it will go. Some of it will probably get messy. But I suspect people will learn more from defending someone else’s point of view for an afternoon than from any slide I could show them.
Messy or not, it’s worth a try. That’s it. Come Monday, I’m handing out roles. Worst case, we’ll have a good laugh.