ISO/IEC 27001
All 18 isidaten articles on ISO/IEC 27001, newest first.
An attestation is not a certificate
Basic terms, part 8: The supplier questionnaire says "ISO 27001 certified", "C5 attestation", "BSI-tested" or "accredited". Four answers that sound alike and mean different things. Who checks, who checks the checker, and what ends up on paper: certification, accreditation and attestation, with the passages from EU law, the BSI Act and the BSI's C5.
Read more
Evidence does not belong in an email attachment
Before the audit comes the request list, and then exports, ZIP files and sharing links go to the audit body. After the audit, nobody knows where the copies are, which version was presented or who saw it. IT-Grundschutz module DER.3.1 requires the opposite: auditors do not intervene, access is withdrawn afterwards, and only authorised people can reach the documents.
Read more
A metric without a calculation method measures nothing
In clause 9.1, ISO 27001 does not simply ask for metrics but for decisions: what is measured, by which method, when, by whom, and who evaluates the results. The method should produce comparable and reproducible results. Why many security metrics fail exactly there, and how to recognise a number that only counts activity.
Read more
An audit date is not yet an audit programme
Many internal ISO 27001 audits are a date in November, shortly before the surveillance audit, carried out by the person who also runs the ISMS. Clause 9.2 of the standard asks for something else: a programme that derives frequency and scope from the importance of the processes and the results of previous audits, and auditors who are objective and impartial. What that means in practice in a small organisation.
Read more
The standard does not start at Annex A
In many organisations ISO 27001 means "the 93 controls". Annex A, however, is only the list against which you check your own risk treatment. What gets certified is the management system in clauses 4 to 10: context, scope, leadership, risks, objectives, audit, management review. Why that is exactly where the gaps are, and how to tell whether a clause is evidenced or merely ticked.
Read more
What the agent never does
A service running as SYSTEM on every device is the most powerful piece of software in the building. The isidaten agent appeared in four of the last six articles, always as a tool. This one is about the agent itself: five things it never does, and why a stolen database therefore does not control the fleet.
Read more
There is no expiry date for .de
DENIC publishes neither expiry date nor transfer lock for .de domains, while the registry returns both for .com. What that means for renewal reminders, and why an empty date field deliberately triggers no due date but is counted as a gap of its own.
Read more
The locking system only knows today
Who can unlock a door today is in the system. Who could yesterday, and why that ended, is not. Why a withdrawn authorisation is revoked rather than deleted, and why a deleted record proves nothing in an audit.
Read more
Who sends mail in your name
A phishing mail with your sender address does not hit you, it hits your customers, partners and applicants. Whether that is possible is decided by a handful of DNS records. Why the most common mistake is not a missing DMARC but an existing one that only watches, and what isidaten now checks per domain.
Read more
The break-in that looks like a working day
For the first time in 19 years, stolen credentials are no longer the most common way into a network; exploited vulnerabilities have overtaken them. That sounds like relief for identity security, and it is not: across the full attack chain, credential abuse remains the most pervasive technique. Why a valid login raises no alarm, and only behavior gives it away.
Read more
The certificate nobody renewed
An expired TLS certificate blocks a service for every browser, loudly and instantly. Until now a manageable nuisance, because a certificate lasted about a year. But the CA/Browser Forum is cutting the maximum lifetime in stages from 398 to 47 days. Why manual certificate upkeep reaches its end, and what takes its place.
Read more
Awareness is not measured in attendance
The mandatory training is completed, the attendance rate looks good, the auditor is satisfied. And still, part of the workforce clicks on the next simulated phishing mail. Why attendance rate and click rate tell two different truths, and how simulation, findings and targeted training become a loop instead of a box-ticking exercise.
Read more
The first AI ransomware walked in through an open door
In early July, Sysdig documented the first ransomware campaign an AI agent ran on its own, from reconnaissance to encryption. The unsettling part is not the AI: entry came through a known vulnerability, a second one from 2021 and default credentials. Why the fundamentals still defend against attackers moving at machine speed.
Read more
An asset inventory is not a device list
Most asset inventories are really device lists: hostname, IP, serial number. But an auditor rarely asks whether a device exists, they ask who is responsible, where it stands, what software runs and who accesses it. Why an inventory is a web of relationships, and why the most reliable source for it usually already sits in IT operations.
Read more
Containers in the asset inventory: the platform counts, not the pod
A pod often lives for minutes. Whoever inventories every single one produces noise; whoever leaves the container layer out entirely has a blind spot exactly where production runs. Why the right question is not whether but at which level, and what belongs in the inventory for good.
Read more
Why half the CVE list is a waste of time
A scan against one exposed host finds 672 known vulnerabilities, from 2009 to today, critical ones next to scoreless ones. Patching by pure CVSS means chasing the theoretically worst holes instead of the truly dangerous ones. Three questions that turn a CVE into a real risk, and why prioritization without asset context stays blind.
Read more
You don't type an asset inventory, you let it be scanned
A hand-maintained inventory has two flaws: it ages faster than you can type, and it only contains what someone entered. The dangerous part is what was forgotten. Why a living inventory is discovered rather than recorded, and why a single source is never enough.
Read more
isidaten implements new ISO Standard 20153:2025 with vulnerability management module
With the brand-new ISO/IEC 20153:2025 standard, isidaten implements state-of-the-art CSAF-compliant vulnerability management.
Read more