By Russell Lawson, ISO consultant, lead auditor and founder of The Compliance Companion - the practical platform that helps businesses build ISO 9001, ISO 14001, ISO 45001 and ISO 27001 systems using real-world templates, AI-powered tools and guided support. Through years of consultancy and audit work, Russell has seen how the strongest management systems are the ones that stay practical, current and closely aligned to real business risk.
For a long time, many organisations treated cyber security as a technical issue. Something for IT to handle quietly in the background. Something to revisit when a client questionnaire landed in the inbox or when renewal time came around for Cyber Essentials, cyber insurance or ISO 27001.
That approach is looking increasingly outdated.
In April 2026, the UK government published an open letter to business leaders warning that every business in the UK has a role to play in responding to AI-driven cyber threats, and that attackers will target ordinary companies of every size, in every sector, wherever defences are weakest. The letter makes the point very clearly: the basics still matter, but leadership attention matters just as much. Cyber security is no longer something to delegate and forget.
At roughly the same time, the NCSC refreshed its guidance for smaller organisations and stated that 1 in 2 small businesses suffer a cyber incident every year. That is a striking figure, especially for smaller businesses that still assume they are too small to attract attention.
This is exactly why ISO 27001 feels more relevant in 2026 than it did even a couple of years ago.
The AI threat is new. The response is not.
One of the most useful points in the government’s April 2026 letter is that the steps organisations should take against AI-driven cyber threats are the same cyber hygiene measures recommended for traditional threats. That matters because it cuts through a lot of noise. Businesses do not need to panic and reinvent everything overnight. They do, however, need to get much better at doing the basics consistently.
That is where ISO 27001 comes in.
In my experience, one of the biggest misunderstandings about ISO 27001 is that people think of it as a document set. A bundle of policies. A project to complete. In reality, the businesses that get the most value from it use it as a way of deciding what matters most, assigning ownership, checking whether controls are actually working, and reviewing threats regularly.
That becomes even more important when AI starts changing the pace and scale of attacks.
A phishing email written badly used to be easier to spot. A scam message full of spelling mistakes was often enough to raise suspicion. AI changes that. It helps attackers produce cleaner language, more convincing messages, and a higher volume of tailored attempts. The underlying risk may still be phishing, credential theft, malware or fraud, but the attack surface gets wider and the quality of the social engineering improves. The answer, though, still comes back to the same questions I ask clients when helping them build or audit an ISMS: do you know your main risks, have you assigned sensible controls, and can you show that those controls are alive?
This is where many smaller businesses still struggle.
They may have backups, but no one has checked whether recovery really works. They may have MFA, but not across all important systems. They may have an access control policy, but no routine review of leavers, movers and joiners. They may have an incident response procedure, but no one has rehearsed what would actually happen if a ransomware event hit on a Monday morning.
The UK government’s recent message to boards was not especially complicated. It said leaders should take cyber security seriously at the top of the organisation, use the Cyber Governance Code of Practice, get the basics right with Cyber Essentials, and follow NCSC guidance such as the Early Warning Service. Those are practical actions, not abstract principles.
That lines up closely with what a good ISO 27001 system should already be doing.
A good ISO 27001 system should force the right conversations. What are our important information assets? Where are the biggest vulnerabilities? Which suppliers create exposure? What happens if a key cloud service fails? How quickly could we recover? Which risks are acceptable, and which need treatment now?
That is why I often say ISO 27001 is most useful when it is not treated as an audit exercise. It should be a management tool. Something that helps leadership make better decisions when the threat environment shifts.
And the threat environment is shifting.
The government’s Cyber Security and Resilience Bill is still progressing through Parliament, and the published summary says it will reform and expand the existing Network and Information Systems regime. The bill is intended to strengthen protections for essential and digital services, and the government has stated that the expanded framework will include data centres and managed service providers. Even for businesses outside formal scope, the wider direction of travel is obvious: stronger cyber governance, clearer accountability and more pressure on supply chains.
That last point matters a lot.
Even if a smaller business never falls directly into a regulated category, it may still be asked by clients to demonstrate stronger controls. I am seeing this more often in audits and client work. Larger organisations are under pressure themselves, so they pass those expectations down to suppliers. The result is that basic cyber governance, documented risk assessment, supplier due diligence, backup assurance and incident planning are becoming normal commercial expectations rather than niche security requirements.
That is why now is a good time to review your ISO 27001 system, or to start building one properly if you have been delaying it.
Not because AI has magically changed every control overnight. It has not. But because it has made weak controls easier to exploit and slower-moving organisations easier to target.
If I were advising a business right now, I would start in three places.
First, review the risk assessment. Not the version written to satisfy the auditor last year, but the real one. Does it reflect current threats, current systems, current suppliers and current ways of working?
Second, review the basics. Patching, MFA, backups, access reviews, phishing awareness, incident reporting and supplier security. The official guidance is very clear that these are still the foundation.
Third, review leadership involvement. If cyber security is still treated as an IT issue rather than a business risk, the system is weaker than it looks.
If you want a natural internal link in this article, I would link the phrase “review the risk assessment” to your ISO 27001 risk assessment template article, because it fits this topic directly and supports the reader with a practical next step.
The real takeaway here is simple. AI-driven cyber threats may be the headline, but disciplined information security management is still the answer. Businesses do not need more panic. They need clearer ownership, better risk thinking, and systems that are used in practice.
That is exactly where ISO 27001, done properly, earns its keep.