Secure & Simple

The episode delivers practical, actionable insights about what certification auditors actually look for during ISO 27001 audits, with specific examples like risk treatment plan approval and scope documentation failures. However, it relies heavily on well-known findings (missing approvals, undocumented policies, scope issues) that experienced practitioners likely encounter in standard guidance, and contains notable filler including podcast boilerplate at the end and some repetitive questioning that doesn't advance substantive understanding.

“something that's very common in a stage one to observe...you need to get two acceptances or two approvals. You need to get an approval for your risk treatment plan, which is often omitted. You need acceptance for the residual risks”

“the most important part of an audit is the proof or the evidence that what you write in your policy is actually carried out in practice”

While the guest offers some genuinely useful reframes - notably distinguishing between auditing for conformity versus hunting for non-conformities, and explaining the inherent gap between an ISO 27001 certificate and actual security posture - most of the core content recycles standard audit frameworks and well-documented compliance patterns. The insight about SOC2 tools being poorly adapted to ISO management systems is valuable but niche. Overall, the thinking is sound but not particularly fresh or contrarian.

“I don't enter the audit with the mindset of I have to find something today...I'm tasked to assess the conformity”

“we are technically on the wall, 2,000,000,000 corporation has the same ISIS certificate hanging on the wall than the five person startup from around the corner”

Aron Lange is a relevant practitioner with substantial hands-on experience: founder of GRC Lab, certified auditor with multiple dozen ISO 27001 certification audits completed, trainer, and recently expanded to ISO 27007 audits. He brings real audit-floor perspective rather than pure theory. However, he is not a C-level operator, major enterprise CISO, or someone who has built security programs at scale, which limits the depth of strategic insight.

“he works as a certification auditor for TUV or TÜV SÜD certification body and has already performed couple of dozen certification audits for 27,001”

“I mean, I know you are very well known for your expertise in the ISO management system world”

The episode provides several concrete examples: specific policy approval failures, risk treatment plan findings, recovery point objective mismatches with backup frequency (one week vs. 24-hour RPO), and password complexity rules (8 vs. 12 characters). However, these examples are somewhat generic illustrations rather than named case studies with actual numbers, dollar figures, or timeline data. The guest avoids naming specific companies or sharing quantified metrics on audit failure rates or costs, limiting evidence density.

“Let's say you have a system that is backed up once a week, but the system belongs to a process that has a recovery point objective of twenty four hours”

“you realize the password minimum length is eight characters. And you feel like, well, practice, 12 characters at least would be better”

The host asks solid foundational questions that draw out actionable insights (e.g., how auditors collect evidence, the difference between non-conformities and opportunities for improvement, where the line between auditing and consulting lies). Some follow-ups are sharp and probe assumptions, such as the question about whether verbal confirmation alone is sufficient or whether written evidence is always needed. However, the host occasionally allows repetitive circling (e.g., multiple restatements of the same point about written vs. verbal evidence) and misses opportunities to push the guest on harder contrarian claims, such as deeper exploration of the 'absurdity' of certifying management systems rather than security posture.

“So what can actually a company do in this kind of a situation if the auditor is pushing something that is really not required?”

“Where is this line between auditing and consulting? So how far can you go with these suggestions as an auditor without doing the consulting work?”