ISO 27001 is not a checklist. Yet many organizations treat it like one.
Why an effective ISMS starts with risk and proportionality, not with ticking off all 93 controls in Annex A.
At Norvault, we work with a range of security, AI and quality standards, including ISO 27001. Across implementations, audits and the ongoing management of existing ISMSs, we repeatedly encounter the same misconception: ISO/IEC 27001:2022 is treated as one large checklist. Annex A contains 93 controls, so organizations quickly assume that 93 separate things must be done. The result is often a collection of spreadsheets, monthly checks, separate meetings and policy documents that exist mainly because "ISO requires it". That is not how ISO 27001 works.
ISO 27001 is about establishing and maintaining an information security management system in which risk management is the starting point. The question is not which Annex A control needs to be ticked off today, but which risks the organization faces and what is needed to manage them properly. That distinction may sound theoretical, but in practice it determines whether ISO 27001 becomes part of normal operations or an administrative system that is dusted off shortly before the annual audit.
Proportionality is often overlooked
A company with 25 employees does not need an ISMS designed for 2,500 people. Yet this is where smaller organizations regularly go wrong. A template is adopted, twenty different policies appear, someone builds a risk register containing sixty risks and a separate activity is created for every control. Naturally, evidence then has to be collected for each of those activities. A year later, nobody can clearly explain why half of them exist, but they are maintained because they have become part of the system.
That is not a sign of a mature management system. More often, it is a sign that the system has become too large for the organization it is supposed to support. A software company with 25 employees can certainly face serious security risks, but it does not need the same governance as an international enterprise with several security teams and hundreds of suppliers. A good ISMS should fit the organization and remain proportionate to its risks, complexity and size.
If there are five important suppliers, supplier management can be organized relatively simply. If access rights are already managed effectively through existing IT processes and there are no structural deviations, there is no reason to create a second "ISO process" alongside them. If patch management is already part of normal operations, somebody does not need to tick a spreadsheet every month merely to prove that patch management exists. ISO should therefore be integrated into normal work wherever possible, rather than becoming a parallel process.
One question helps surprisingly well: why?
Every recurring activity within an ISMS should be able to answer one simple question: why do we do this? If the activity manages a relevant risk, addresses a concrete customer requirement or fulfils a legal or regulatory obligation, the reason is clear. "Because we did it last year" or "because an auditor once asked about it" is far less convincing.
In established management systems, we regularly find activities whose original purpose is no longer clear. They are still performed every quarter or every year because they once became part of the ISMS. At that point, compliance starts to sustain itself. The same thing can happen after audits: an auditor asks a question that cannot immediately be answered, and the response is to add a new form, register or recurring check. That may be the right solution, but not every audit question needs to result in a new process. The auditor assesses the management system, but the organization remains responsible for its design.
ISO 27001 does not have to be simple. It does have to be proportionate.
An organization with complex risks may need a complex ISMS. Some controls inevitably take time, and certain activities must demonstrably take place. But more documents, more checks and more hours do not automatically produce better information security. A good ISMS manages the relevant risks without unnecessarily building a second organization alongside normal operations.
If ISO 27001 consistently consumes a great deal of time, the first question should not be how to perform all those activities faster, but why they exist in the first place.