From Zero to ISO 27k Compliance

The talk opens with a sales story. A large healthcare prospect asked a small security software company for ISO 27001 evidence it did not hold, and the deal was lost. That loss pushed the company to pursue certification. The speakers explain why ISO 27001 was chosen over SOC 2 for a small organization: it is more objective, it covers legal and regulatory requirements, and its attestation cost is far lower.

The middle section covers the method. Rather than treating each framework as a separate audit, the team used the Secure Controls Framework, a free common-control catalogue mapped to more than 200 standards, to avoid audit fatigue. They loaded it into an open-source GRC platform, filtered it down to the relevant controls, and scored maturity levels instead of a simple pass or fail. Generative AI helped draft policies, procedures and test objectives, and free diagramming software covered process flows. On AWS, native services such as Inspector, Security Hub, GuardDuty, CloudTrail and CloudWatch served as evidence sources, although the presenters noted that much of their output needs manual filtering.

The closing part covers next steps. The team was looking for an auditor with small-company, AWS and CI/CD experience, and it was aiming for an audit the following year. The main takeaway is that mapping existing practices to a common control set and documenting them can cut effort, but the result still needs human review and expert judgment.