One year at Northwind Foods, in 90 seconds.
A narrated walkthrough of a fictional 200-person food distributor, from switching on ISO 27001 to passing Stage 2 and sharing its Trust Center. Press play, turn on narration, or jump to any chapter.
Northwind Foods
Goal: ISO 27001 certified in under a year.
| Ref | Control | Status | Maps to |
|---|---|---|---|
| 5.15 | Access control | Implemented | SOC 2 CC6 |
| 8.24 | Use of cryptography | Implemented | GDPR Art. 32 |
| 5.23 | Cloud services security | In progress | RBI |
| 8.30 | Outsourced development | Not applicable | Justified |
| Ref | Risk | Inherent | Residual | Controls |
|---|---|---|---|---|
| RSK-018 | Ransomware on file server | 20 | 8 | 8.13 |
| RSK-024 | Vendor data exposure | 12 | 6 | 5.19 |
| RSK-031 | Credential phishing | 15 | 4 | 6.3 |
| RSK-027 | Laptop theft | 6 | 3 | 8.1 |
Branch protection disabled on main
Root cause and CAPA follow, with an effectiveness check a month later.
Nine Clause 9.3 sections · notes per item · locked minutes as PDF
Narration uses your browser's built-in AI voice. Northwind Foods, its people and figures are illustrative.
What Northwind had to show for it
The numbers its auditor and its largest customer actually saw.
Every chapter, and where to see it for real
Prefer reading? Here is the full narration, with a link to the page behind each chapter.
Northwind Foods is a 200-person food distributor. Its largest customer wants ISO 27001 within the year, and today the program lives in spreadsheets and shared folders.
Priya, the compliance manager, switches on ISO 27001. All ninety-three Annex A controls arrive ready to edit, grouped by theme and already mapped.
The team scores twenty-eight risks with one method. Each risk links to the controls that treat it, so residual risk falls as controls go live.
AWS, GitHub, Okta and Intune connect with read-only access. Every day, one hundred and thirty-two checks run and attach their results as evidence.
One morning, branch protection is switched off. CompliLens drafts a nonconformity, and a person accepts it before anything is raised.
Every employee gets four-minute lessons for their role. Phishing simulations test the lessons, and the human risk score falls from sixty-four to twenty-two.
A phishing email leads to mailbox access. One incident runs two clocks: six hours for CERT-In and seventy-two for GDPR. Both are reported on time.
The internal audit samples six of thirty records and raises two minor findings. Leadership reviews everything in one live management review.
In November, Stage 2 passes. Northwind sends its largest customer a Trust Center link instead of a forty-page questionnaire.
That is a year of compliance at Northwind. Book a demo, and we will show you the same workspace with your frameworks.
What Northwind did, month by month
The same year in more detail. Scroll to follow the line.
Scope and context
Wrote the scope statement, listed interested parties, opted into DPDP and GDPR.
Activated ISO 27001
93 controls provisioned; marked 8.30 not applicable with a justification.
Policies approved
Twelve policies through the approval workflow; acknowledgements assigned to all staff.
Risks assessed
28 risks scored and linked to controls, assets and vendors.
Cloud connected
AWS, GitHub, Okta and Intune syncing daily; evidence completion reached 84%.
Baseline phishing test
A third of staff clicked. Role-based training started the same week.
Internal audit
Audit plan distributed, 6 of 30 NCRs sampled, two minor findings raised.
Incident handled
CERT-In reported inside 6 hours; CAPA verified effective a month later.
Management review
Nine inputs reviewed with a live snapshot; minutes locked and exported.
Certified
Stage 2 passed. The Trust Center link went to their largest customer.