Working through the ISO 27001 process on a project for my current primary contract is fascinating. Even if we don't end up going all the way with the process. The questions it is raising about the business and some of what we are building is certainly going to make both more robust. There's some pain, and the cost isn't trivial (even with me discounting my rate significantly for this initial phase as a trial) but there is value in the exercise.