Most of this stinks of ISO27001 “by the book”, using some horribly rigid off the shelf ISMS to gain certification rather than creating something compliant that

Most of this stinks of ISO27001 “by the book”, using some horribly rigid off the shelf ISMS to gain certification rather than creating something compliant that actually works for the org. Been there, done that, red swingline stapler.