The Compliance Work Your Tech Stack Can't See

Why ISO 27001 compliance goes beyond technical monitoring, and the critical role of people, processes and governance.

Businesses have never had more technology at their disposal to monitor and manage cyber security.

From cloud security monitoring and vulnerability scanning to endpoint protection and automated configuration checks, organisations have an increasingly sophisticated toolkit for identifying weaknesses, detecting threats and maintaining oversight of their technical environments.

And as the threat landscape evolves, these capabilities are becoming more important than ever.

Just this week, Hicomply's CEO, Mark, joined BoxPhish for a discussion on how AI is reshaping phishing and cyber fraud, and what organisations can do to strengthen their resilience.

One of the key themes that emerged was that while AI is changing the sophistication of cyber threats, the fundamentals of good cyber security remain the same.

Of course, that means having the right technology in place.

But it also means ensuring employees understand their responsibilities, risks are actively managed and governance processes work when they're needed.

Why?

Because visibility into your technical environment isn'tthe same as visibility into your compliance posture.

And ISO 27001 provides a useful reminder of why.

The 63% problem.

Of the 93 controls outlined in ISO 27001:2022 Annex A, just 34 are classified as technological.

The remaining 59, approximately 63%, fall across three other control categories:

• Organisational: How information security is governed including policies, responsibilities, supplier relationships and incident management
• People: How employees understand and fulfil their security responsibilities, from awareness training to confidentiality and reporting security events
• Physical: How organisations protect their premises, equipment and physical information assets

These aren't secondary considerations. They're fundamental to establishing and maintaining an effective ISMS.

And their importance becomes particularly clear when we look at today's cyber threats.

Take phishing, for example.

The latest Government Cyber Security Breaches Survey found that 38% of businesses had experienced phishing attacks in the previous 12 months.

Technical controls play an important role in detecting suspicious emails, restricting access and preventing malicious activity.

But what happens when a convincing phishing attempt reaches an employee?

• Do they know how to recognise it?
• Are they confident reporting it?
• Does the organisation have a clear process for responding?
• Are those procedures regularly reviewed and tested?

These questions sit beyond what technical monitoring alone can demonstrate.

They depend on employee awareness, clearly defined human responsibilities, effective policies and ongoing governance.

Technology can help identify a threat. But it's the people and processes behind it that determine how effectively an organisation responds.

What your tech stack can't tell you

The gap between technical visibility and effective governance becomes particularly important when something goes wrong.

The same Government survey found that just 25% ofbusinesses had a formal incident response plan in place.

This serves as a reminder that while organisations may invest in technology to identify and detect threats, the processes needed to respond aren't always as well established.

A security tool might detect compromised credentials or flag suspicious activity.

But can it demonstrate that employees know how to escalate an incident? That responsibilities are clearly assigned? Or that lessons learned are translated into improvements?

These are the areas where human oversight becomes essential.

And they're just as important to maintaining ISO 27001 compliance as the technical controls organisations monitor every day.

Because compliance isn't simply about proving that a control exists. It's about demonstrating that it works in practice, with clear accountability for maintaining it.

Why this becomes a problem at audit time

For many organisations, gaps in non-technical controls don't become obvious until an audit approaches.

Technical evidence is relatively accessible. Dashboards can be exported, configurations checked and reports generated.

But demonstrating the effectiveness of organisational and people controls often requires a different approach.

Suddenly, teams are chasing policy acknowledgements, locating risk review records, confirming responsibilities and trying to establish whether actions agreed months earlier were completed.

The problem isn't necessarily that the work hasn't happened.

It's that the evidence is scattered across different systems, departments and individuals, with no consistent way to demonstrate what's been done.

And that creates a familiar cycle: periods of limited visibility followed by an intensive effort to prepare for the next audit.

For organisations managing multiple frameworks, the challenge becomes even greater. The same policies, processes and evidence may support several compliance requirements, but without a joined-up approach, teams can end up duplicating work.

Connecting technical visibility with whole-business compliance

The answer isn't to move away from technical monitoring.

It's to put that monitoring into the wider context of your compliance programme.

Technical integrations can provide valuable, up-to-date evidence about the state of your systems. But that evidence needs to sit alongside the policies, risks, responsibilities, processes and activities that demonstrate how information security is managed across the organisation.

This is where a whole-business approach makes a difference.

By bringing technical and non-technical controls into one place, organisations can establish a clearer view of their compliance posture, understand where gaps exist and maintain accountability for the actions required.

Automation and AI have an important role here, too.

They can reduce the administrative burden of collecting and maintaining evidence, identifying changes and tracking progress. But they shouldn't replace the judgement and ownership needed to make compliance effective.

After all, a tool can flag that evidence is missing. It takes someone who understands the business to determine what that means, whether the control is operating effectively and what needs to happen next.

The goal isn't to automate responsibility away. It's to give people better visibility and more time to focus on the work that matters.

Compliance needs to reflect how your business actually operates

ISO 27001 was never intended to be a technical checklist.

It's a management system designed to help organisations understand their information security risks, establish appropriate controls and continually improve how those risks are managed.

And as cyber threats become more sophisticated, that whole-business approach is only becoming more important.

Technology can help organisations identify vulnerabilities, monitor configurations and maintain evidence. AI can help reduce administrative effort and surface information that might otherwise be overlooked.

But neither removes the need for human judgement, accountability and oversight.

At Hicomply, that's why we believe compliance needs to connect the whole business. Bringing together technical monitoring, risk management, policies, people and evidence into one continuously maintained picture.

Because the strongest compliance programmes don't just demonstrate that technical controls are working.

They demonstrate that the people, processes and governance behind those controls are working too.

Your tech stack can tell you a lot about your security. But it can't tell you everything about your compliance.

And knowing the difference is what helps organisations move beyond certification towards continuous assurance.