I worked at a place which got ISO27001 yet had its proprietary source code available unauthenticated from an old CVS server, including over HTTP. You just needed to connect to the wifi or plug in any Ethernet cable into any device. The company just did the magic “accept the risk” and moved on. Anecdotal but I can’t help but feel it would be common for other orgs which are bad at security getting certified anyway. https://youtube.com/watch?v=9IG3zqvUqJY

> You will not pass the independent audit if you're bad at security.

I wouldn't agree with that. What I would say is that to pass the audit you must appear to be good at security. More to the point, you must appear to be doing many things that most companies don't actually want to do.

> It seems like you've never tried to get it

I have. What I wrote was based on personal experience working for an ISO 27001 certified company and being very involved in the (successful) audit and recertification.

> You will not pass the independent audit if you're bad at security.

Incorrect. You will pass if you have all required processes documented and have documentation that show you follow those processes. Whether you actually do follow the processes is irrelevant, the auditor just needs to think you do.

Also, you can be incredibly bad at security and still be ISO 27001 certified. For example:

Process: Describes that employees use an encrypted password vault for secret management. Keys in the vault are rotated each year and when employees leave.

Reality: Keepass database is sent through email, the password is "CompanyNameVault2023!", which is shared in the same email. Keys are never rotated because it's annoying.

This will 100% get you ISO certified, in my experience at least.

[dead]