# iso27DIY Brand values

Primary:
* **A**uthenticity
* **C**larity
* **E**mpowerment

Secondary:
* Value Creation
* Organizational Alignment
* Context-Driven Intelligence
* Practicality Over Bureaucracy
* Inclusivity

## Based on: Our thoughts and beliefs on current practices

I created iso27DIY because I think / believe …
- The core principles of the ISO 27001 are often overlooked in implementations and audits. These are that, when implementing the ISO 27001’s ISMS and Controls, informed decisions should be made based on risks, context, and the means and capabilities of the organization.
- Furthermore, the ISMS must be implemented in such a way that it is helpful in realizing organizational goals, mitigates risks the organizations faces in achieving these, and promote seizing opportunities, especially with regard to information security.
- Current implementation approaches take the letter of the standard instead of the spirit, and force the business into adapting overly complex procedures and building an artificial paper reality.
- ISO 27001 is a Framework, not a prescriptive checklist.
- Checklist-based approaches are not effective, because they lack internal cohesion, connection to organizationals goals, risk- and context awareness. They do not implement security in a way that contributes to an organization’s mission and negate the organization’s capabilities for making intelligent choices based on context, risk and proportionality.
- This makes ISO 27001 impopular with management and workfloor, causing it to become ineffective.
- The language and structure of the ISO 27001 standard is hard to comprehend because of the formalistic language, internal cross references, and duplications of elements at different levels. This creates a certain mystique that forces organizations to hire a ‘priest’ (i.e. consultant) to help them understand what to do. 
- SMEs think they lack adequate time, trained personnel, and budget to manage the implementation process effectively

## The ISO27DIY way

- iso27DIY tells the story of ISO 27001 and 27002 in such a way, that you will understand the essence of the standard, and are able  to make informed and compliant choices based on context, risk and proportionality.
- iso27DIY helps you identify security practices already in place in your organization, and enhance, translate and document them in such a way that comliance requirements are met. (‘control mapping’)
- iso27DIY lets you implement the ISMS and controls in such a way that they actually improve the organization’s security posture, create value at all levels of the organization, and create a culture of security.
- iso27DIY does not force you to adopt contra-productive security procedures and maintain unnecessary documentation. 
- We believe in your capability to do it yourself!




