ISO/IEC 27001 Certified. But Are You Actually Secure?

Why an ISMS Certificate Is Not a Security Strategy — and How Mature CISOs Define an Appropriate Security Level

By Eckhart Mehler for CISOsCISO — a perspective on cybersecurity leadership, governance and the decisions that determine whether organizations retain control.

A few years ago, I attended a discussion where a manager proudly announced:

“We are ISO/IEC 27001 certified now. Security is under control.”

The room nodded in agreement.

The statement sounded reasonable.

It was also wrong.

Not because ISO/IEC 27001 is unimportant. Quite the opposite. It is one of the most valuable frameworks available for building governance, accountability, and systematic risk management.

But there is a dangerous misconception that I continue to encounter across industries, governments, NGOs, and multinational enterprises:

Certification is often mistaken for security.

The two are related.

They are not the same thing.

The Question Nobody Wants to Ask

When an organization receives its ISO/IEC 27001:2022 certificate, an uncomfortable question emerges:

What security level have we actually achieved?

Most organizations struggle to answer.

Because the standard itself does not provide one.

There is no clause that says:

• Implement these 93 controls and you are secure.
• Achieve this maturity level and you are protected.
• Reach this score and your cyber risk is acceptable.

The standard deliberately avoids making such promises.

Instead, ISO/IEC 27001 provides a management framework that enables organizations to determine, implement, monitor, and improve their own security requirements.

This distinction is fundamental.

The standard defines how security should be governed.

It does not define how secure an organization must be.

Why This Matters

Consider two organizations.

Both are certified against ISO/IEC 27001:2022.

Organization A:

• No centralized detection capability
• Weak identity governance
• Limited cloud visibility
• Vulnerability remediation takes months

Organization B:

• Mature security operations center
• Strong cloud security monitoring
• Threat intelligence integration
• Regular adversary simulations
• Executive cyber crisis exercises

Both may pass the same certification audit.

Yet their ability to withstand a sophisticated attack differs dramatically.

The certificate tells us that an ISMS exists.

It does not automatically tell us whether the organization can resist ransomware, detect an insider threat, or recover from a cloud compromise.

This is not a flaw in ISO/IEC 27001.

It is simply not what the standard was designed to do.

The Real Meaning of “Appropriate Security”

One of the most frequently used terms in information security is “appropriate.”

Unfortunately, it is also one of the least understood.

Appropriate security does not mean:

• Maximum security
• Perfect security
• Zero risk

Nor does it mean:

• Implementing every available control
• Buying every security tool
• Following every industry trend

Appropriate security means:

Reducing the most significant risks to a level the organization consciously accepts.

This sounds simple.

In practice, it is one of the most difficult governance challenges a CISO faces.

Because appropriate security is not defined by technology.

It is defined by context.

Security Must Reflect Business Reality

A global development organization operating in 120 countries faces different risks than a bank.

A bank faces different risks than a manufacturer.

A manufacturer faces different risks than a cloud provider.

The appropriate security level depends on:

• Business objectives
• Threat landscape
• Regulatory obligations
• Data sensitivity
• Operational dependencies
• Geopolitical exposure
• Risk appetite

This is precisely why security cannot be reduced to a checklist.

The same control may be essential in one environment and largely irrelevant in another.

Mature CISOs understand this.

Less mature organizations often do not.

The Trap of Compliance-Driven Security

Many organizations unknowingly fall into what I call the Compliance Trap.

The logic is understandable:

1. Implement the standard.
2. Pass the audit.
3. Receive the certificate.
4. Assume risk has been addressed.

The problem is that attackers do not target compliance gaps.

They target security gaps.

Ransomware operators do not care whether your Statement of Applicability is complete.

Nation-state actors do not care whether your audit evidence is organized.

Threat actors exploit:

• Weak identities
• Misconfigured cloud services
• Unpatched systems
• Insufficient monitoring
• Poor detection capabilities
• Delayed incident response

None of these threats disappear because an audit was successful.

What Mature CISOs Do Differently

The most effective CISOs I have worked with rarely use ISO/IEC 27001 as their ultimate destination.

• They use it as a foundation.
• A governance system.
• A management system.
• A decision-making framework.

The actual security level is built on top of that foundation.

Typically through four complementary layers.

Layer 1: Governance and Compliance

This is where ISO/IEC 27001 excels.

• Policies.
• Risk management.
• Responsibilities.
• Audits.
• Management reviews.
• Continuous improvement.

Without governance, security becomes chaotic.

Without governance, investments become disconnected from business objectives.

ISO/IEC 27001 remains essential.

But it is only the first layer.

Layer 2: Risk-Based Protection

Mature CISOs focus on the risks that matter most.

Not the controls that are easiest to audit.

They ask:

• What could seriously disrupt our mission?
• What could significantly damage our reputation?
• What could threaten business continuity?
• What would attract sophisticated adversaries?

The resulting security architecture is driven by business risk, not by compliance checklists.

Layer 3: Detection and Response Capability

One of the biggest weaknesses I observe in many newly certified organizations is an overemphasis on prevention.

Prevention remains important.

But prevention eventually fails.

Every mature security leader understands this.

The real question becomes:

How quickly can we detect and contain an attack?

This requires capabilities such as:

• Security Operations Centers
• Detection Engineering
• Threat Intelligence
• Threat Hunting
• Incident Response
• Digital Forensics

These capabilities often determine whether a cyber incident becomes a minor disruption or a global crisis.

Layer 4: Organizational Resilience

Eventually, every organization experiences security failures.

The difference lies in recovery.

The strongest security programs increasingly focus on resilience rather than the illusion of perfect protection.

• Can the organization continue operating?
• Can critical services be restored?
• Can leadership make decisions under pressure?
• Can communications continue during a crisis?
• Can business processes survive a major disruption?

These questions often matter more than any individual technical control.

Security Maturity Is Not Measured by Control Counts

One of the most misleading metrics in cybersecurity is the number of implemented controls.

I have seen organizations with extensive control catalogs that remained highly vulnerable.

I have also seen organizations with fewer controls but significantly stronger security outcomes.

Why?

Because effectiveness matters more than quantity.

A mature CISO does not ask: How many controls have we implemented?

A mature CISO asks: Which risks have we actually reduced?

And even more importantly: Which risks remain insufficiently addressed?

The Future of Security Leadership

As cyber threats become more sophisticated, the role of the CISO is evolving.

The future does not belong to security leaders who merely maintain compliance.

It belongs to those who can translate risk into business decisions.

Those who understand that governance and security are related but distinct concepts.

Those who can explain to executives why a certificate is valuable, but not sufficient.

And those who recognize that security is ultimately not a documentation exercise.

It is a resilience capability.

Final Thought

ISO/IEC 27001:2022 is one of the best management frameworks available for governing information security.

Every serious organization should consider it.

But certification should never be mistaken for the end state.

It is the beginning.

The organizations that truly achieve an appropriate security level are not the ones asking: “Have we implemented every control?”

They are the ones asking: “Can we withstand the threats that matter most to our mission?”

That is the question mature CISOs never stop asking!

Publication Note & Disclaimer
This article was originally published on LinkedIn on June 3, 2026 and may have been edited or updated for publication on this site.

It reflects my personal professional perspective and does not represent the official policy or position of my employer. Drafting and editorial refinement may have been supported by commercially available AI-assisted tools. The analysis, conclusions and final curation are entirely my own.

For information regarding image credits, copyrights, trademarks and other intellectual property rights, please refer to the Imprint.