The Honest Guide to ISO 27001
The complete plain-English field guide to ISO 27001 — written by the guy who was being audited, not selling you a platform.
SERIES
Five field guides + one free bonus
Each book stands alone, but they're designed as a set — cross-referenced, consistent, and following the same company the whole way through.
The Honest Guide to ISO 27001
How the standard actually works — first principles, no jargon.
The Honest Guide to Risk Assessment
The hardest part, done properly — risk that holds up under audit.
The Honest Guide to Internal Audit
The audit you run on yourself — find the gaps before the auditor does.
Where Your ISMS Lives
Tooling, artefacts and cadence — where the ISMS actually runs day to day.
The Honest Guide to Your First Audit
Certification, demystified — what stage 1 and stage 2 are really like.
Worked Statement of Applicability
A complete, worked SoA you can learn from — free with the bundle.
FREE BONUSWhy this is different
Most ISO 27001 content is written to sell you a platform. This is written from the seat being audited.
No FUD. No vendor pitch. No padding. Just the plain-English path through the standard — what each control actually means, what an auditor is really looking for, and how to build an ISMS that holds up instead of one that looks good in a slide deck.
Every book follows one fictional company — PayEngine — all the way from 'we're not certified' to passing its certification audit. You see the risk assessment, the internal audit, the Statement of Applicability and the certification audit happen to a real-feeling business, not in the abstract.
Written by Ashley Knowles — CISSP, ISO 27001 Lead Auditor, and founder of Securitribe. The guide I wish I'd had.
Built for the person actually doing the work
First-time ISMS owners
You’ve been handed ISO 27001 and need to actually understand it.
Small teams
No GRC budget, no compliance department — just you and the standard.
Founders facing certification
A customer or a deal needs the cert, and you need it to be real.
Anyone tired of FUD
You want the honest mechanics, not another scare-driven sales page.
Honest answers
Is this a template pack or a book?
Do I need a GRC platform to use this?
Will this get me certified?
Who wrote it, and why should I trust it?
Go from “we’re not certified” to certified
The complete five-book path through ISO 27001, in plain English, with nothing padded — plus a free worked Statement of Applicability.