[Grikbdl]

> In theory, being ISO27001 means that you're environment follows best practices and has a somewhat sane security posture.

Nah, it just means you have defined, documented processes and document that you stick to them. They actual processes can be shit and maybe you also have something on the side the auditors don't get shown, but ultimately the certification is a total joke. Source: Worked at a place that got certified despite being a security joke.

[johannes1234321]

> ultimately the certification is a total joke.

Yes and no. Even if it is a joke there is one thing it qualifies: You at least spent time looking at the process. This already is a gain over complete wild west.

[1oooqooq]

that makes absolutely no sense at all.

do you mean you rather be lied to than not be lied to?

[quicksilver03]

That looks more like SOC2 than ISO-27001 though.

[lima]

It's the same with ISO27001. A bad actor can always weasel their way through.