3 ms·
Similarly, I remember at my last job management would start talking about the "ISO corner" each year, where all the forms that we never, ever touched sat. This
by exhilaration 6y ago
Similarly, I remember at my last job management would start talking about the "ISO corner" each year, where all the forms that we never, ever touched sat. This of course coincided with our ISO 9001 recertification. A few developers would be coached on what to say to the certifier, he'd be there for 2 days, and then we'd go back to business as usual.
- juskrey 6y agoBy the way, ISO organization does not endorse, check or enforce compliance of any of the certification providers, and can't basically do anything against someone who just sells ISO certificates in shiny bevel, even if they wanted. That said, all the ISO standards are corporate moonspeak and bullshit themselves and do not bear any practical sense. (All that, for example, looong document on infosec ISO 27001 says is "try to be secure, my friend")
- jacquesm 6y agoMixed bag. ISO27001 when taken seriously and implemented throughout a company that means well and has the resources to do so will at least guarantee some level of process to be present. This then needs to be backed up with actual IT and security knowledge to be effective, and that is more often than not where the problems are. So as a rule we treat an ISO 27001 certificate not so much as a checkbox item meaning we can skip certain parts of our audit, but as a nice-to-have which may help speed up the interview process because we at least know what terminology to use. In practice there is too little difference between companies with or without such certification to see it as anything other than a marketing tool.
- ajb 6y ago"all the ISO standards are corporate moonspeak" Bit of a generalisation there. ISO/IEC 13818-3 was quite useful, for example.
- juskrey 6y agoOkok, I mean all that corporate/org standards.