From a Bureaucratic ISMS to an Operational Model: Live Evidence with OSCAL

The ISMS and ISO 27001 are often perceived as bureaucratic processes disconnected from day-to-day cybersecurity operations. This talk proposes a different approach: integrating the ISMS into development and operations pipelines until it becomes part of the operational model. The key is to build systems that generate structured, signed evidence, traceably linked to policies, standards and legal requirements. OSCAL provides a common layer to continuously track the implementation and effectiveness of each control. The result is a shift from preparing for audits as one-off exercises to demonstrating an ongoing, living process. When facing an ISO 27001 audit or a customer request, traceability, evidence and the evolution of each control are already in place.