“ISO 27001? It’s just an expensive piece of paper.”

I hear this phrase more often than I’d like during initial consultations. And it highlights the exact problem: Most CEOs are familiar with ISO 27001—but don’t understand what it could really mean for their company.

Five myths I hear time and again:
First: “That’s an IT project.” No. ISO 27001 is a management system. It starts with senior management—not with the server.

Second: “We’ll get the certificate in three months.” Maybe. But a certificate obtained in three months usually means documentation without substance. In a real emergency, that’s completely useless.

Third: “Once we’re certified, we’re safe.” No. The certificate validates a system. Whether that system is actually put into practice on a daily basis is another matter entirely.

Fourth: “This slows down our day-to-day operations.” The opposite is true—if it’s implemented correctly. Clear processes speed up decision-making. Less uncertainty, less ad-hoc action.

Fifth: “Only the big companies need this.” Wrong. NIS 2 has massively expanded the circle of affected companies. ISO 27001 helps with the implementation of NIS 2 requirements. And even without regulatory pressure: customers and partners are now asking for proof. Those who don’t have it lose contracts.

What concerns me most in these conversations is not the myths themselves, but the missed opportunity behind them. Those who view ISO 27001 merely as a requirement end up creating a paper-based system. Those who see it as a management tool build true resilience.

Which of these myths do you encounter most often?