An ISO 27001 certificate proves that a set of controls was documented and evidenced on a particular set of dates. It does not prove those controls hold on a Tuesday in November when a third-party integration starts failing open.
Where the gap opens
Point-in-time evidence. Auditors sample. Attackers do not. A control that works during the sampling window and drifts afterwards passes the audit and fails in production.
Scope boundaries. The certified scope is frequently narrower than the actual blast radius. The systems excluded from scope are, reliably, the ones with the weakest controls.
Documented versus operating. A policy stating that privileged access requires approval is a control on paper. Whether the approval is ever refused is the operating question, and it rarely appears in evidence.
Using compliance well
None of this makes certification worthless. It is often the only budget lever available, and the discipline it imposes is genuinely useful. The trick is to treat the framework as a checklist floor and layer real assurance on top:
- Continuous control monitoring rather than annual evidence collection
- Threat modelling that ignores scope boundaries entirely
- At least one exercise per year where you assume a control failed and see what happens
If your security programme would collapse without the audit deadline, the deadline is the programme.