4 ms·
By the way, ISO organization does not endorse, check or enforce compliance of any of the certification providers, and can't basically do anything against someon
by juskrey 6y ago
By the way, ISO organization does not endorse, check or enforce compliance of any of the certification providers, and can't basically do anything against someone who just sells ISO certificates in shiny bevel, even if they wanted.
That said, all the ISO standards are corporate moonspeak and bullshit themselves and do not bear any practical sense. (All that, for example, looong document on infosec ISO 27001 says is "try to be secure, my friend")
- jacquesm 6y agoMixed bag. ISO27001 when taken seriously and implemented throughout a company that means well and has the resources to do so will at least guarantee some level of process to be present. This then needs to be backed up with actual IT and security knowledge to be effective, and that is more often than not where the problems are. So as a rule we treat an ISO 27001 certificate not so much as a checkbox item meaning we can skip certain parts of our audit, but as a nice-to-have which may help speed up the interview process because we at least know what terminology to use. In practice there is too little difference between companies with or without such certification to see it as anything other than a marketing tool.
- ajb 6y ago"all the ISO standards are corporate moonspeak" Bit of a generalisation there. ISO/IEC 13818-3 was quite useful, for example.
- juskrey 6y agoOkok, I mean all that corporate/org standards.