Digital Trust Starts With You: Why ISO 27001 Isn’t Just for IT
Oct 13, 2026Digital TrustInformation Security Is Everyone’s Responsibility
Information security is no longer just an IT responsibility. It is a business priority that affects leadership, governance, employees, customer relationships and organisational resilience. While ISO/IEC 27001 is often associated with IT departments and technical controls, an effective Information Security Management System (ISMS) also depends on how an organisation manages risk, establishes responsibilities and builds security awareness across its operations.
The discussion also looks at continuous improvement through the Plan-Do-Check-Act cycle and the relevance of ISO 27001 for organisations of different sizes, including SMEs. For business leaders, information security professionals and teams across the organisation, the message is clear: information security must be embedded in business practice rather than treated as a one-time IT project.
Who should watch the Video?
Business leaders and board members, CISOs and information security managers, compliance and risk teams, HR and Learning & Development professionals, SMEs, and sales and supply-chain teams. The discussion is also relevant to employees whose everyday decisions contribute to protecting organisational information.
Key Takeaways from the Panel
- ISO 27001 is a business enabler, not just an IT project. It helps organisations manage information security risks systematically and connect security practices with business objectives.
- Certification can support confidence and business relationships. An ISO 27001 certificate can provide customers and business partners with evidence of a structured approach to information security and may help address security requirements in sales and supply-chain processes.
- People are an important part of the security system. Awareness and training can help employees recognise social engineering, phishing and deepfake-related manipulation.
- Security is a shared responsibility. Leadership, IT teams and employees all contribute to protecting information through decisions, processes and everyday behaviour.
- Information security requires continuous improvement. ISO 27001 is based on an ongoing management-system approach, including checking performance and improving controls as risks change.
- Organisations of different sizes can benefit. The framework can be applied by organisations of different sizes and across sectors, with the scope and implementation adapted to their context.
Meet the experts
Ra-eesa Khan | Marketing Manager | Moderator
Moderates the discussion, connecting the business, governance and people-related perspectives on information security and the wider Digital Trust conversation.
Moderates the discussion, connecting the business, governance and people-related perspectives on information security and the wider Digital Trust conversation.
Dražen Morog | DEKRA Chief Information Security Officer
Brings the information security leadership perspective, exploring the importance of governance and embedding security into organisational practices.
Brings the information security leadership perspective, exploring the importance of governance and embedding security into organisational practices.
Giammarco Cirillo | Global Business Line Manager for AI, Cyber and Information Security
Brings the business and service perspective on AI, cyber and information security, including the relevance of ISO 27001 to organisations.
Brings the business and service perspective on AI, cyber and information security, including the relevance of ISO 27001 to organisations.
Graham Stanforth | Head of Information Security Training
Brings the training and awareness perspective, including the role of employees in recognising threats and developing a stronger security culture.
Brings the training and awareness perspective, including the role of employees in recognising threats and developing a stronger security culture.