I work in the K-12 education sector. In basically all jurisdictions this industry is not specifically regulated, but there’s an increasing trend of B2B customer

I work in the K-12 education sector. In basically all jurisdictions this industry is not specifically regulated, but there’s an increasing trend of B2B customers enforcing these standards as contractual requirements. This is usually at the behest of their controlling authority, which is often a government, but it’s not out of the ordinary for non-government / private school systems to do the same. Contractual obligations can get quite onerous, just as you’d expect from B2B engagements in other sectors. This blindsided our then-little edtech startup. Thus I’ve been reading ISO 27001, legislation, and all manners of utterly deranged security questionnaires since way back when I was much to green behind the ears to have any right doing so, often with little oversight. On the odd occasion where we have called in external help, supposed specialist consultants have had absolutely zero idea what they’re talking about. I don’t expect that a typical junior engineer or even mid-level engineer, even working in a highly regulated industry, could possibly be expected to, say, understand ISO 27001. Perhaps understanding their organisation’s operationalising of compliance? But I doubt the standard itself. There a whole lot of big-picture thinking, discretion, understanding how organisations work, etc, to operationalise ISO 27001 well. An organisation that does a good job of this would definitely need some sort of cross-functional team, as there are wider organisational implications. That’d certainly include someone/s with a level of technical understanding. I’m a pretty good fake lawyer, a good reader / writer, read legislation for fun, etc. I tend to be pretty good at the bigger picture stuff. Yet I can’t in a hundred years imagine attempting to ingest ISO 27001 without doing so in service of an immediate goal (e.g. implementing it). It’s so incredibly abstract by itself, that I’d be truly impressed if an engineer ‘self-taught’ to increase their worth to a future employer. You’d need to truly have your head in the clouds to be in a mindset where you’d get anywhere.