The security team's risk assessment and ERM use different scales. How does the CRO merge two maps into one?
Article 18 of the TWSE Risk Management Best Practice Principles for Listed Companies lists information risk as one of the risk categories. The 27001 audit focuses on the consistency of the risk assessment method and the reasonableness of the SoA, which is exactly where the CRO can step in: if security uses different impact and likelihood scales from ERM, the board sees two maps that cannot be compared.
Winners builds the assessment framework in ERM risk language so the 27001 risk register connects with the enterprise-level risk map; one build serves both levels. The principles cover listed companies; companies that are not public companies are not covered and can use them voluntarily.
Security belongs to the CISO. How far does the CRO's role in ISO 27001 go?
One way to split it: security control design and day-to-day operation are led by the CISO and the dedicated security unit (see the CISO role page); the CRO brings information risk into one method, one risk map and one board report.
Concrete touchpoints:
- Article 15 of the principles: the promotion unit reports at least once a year — fold 27001 audit results and KRIs into the same report
- Article 14: the acceptance of information risk matches the risk appetite approved by the committee
- Article 28: new risk governance content goes into the existing disclosure
Some of the 93 controls are excluded. How does the CRO check that the exclusions hold up?
Not all 93 controls have to be implemented: applicability is decided by the risk assessment and recorded in the SoA, with reasons for any exclusion; what matters is consistent logic and auditable evidence, not covering everything. Auditors and customer due diligence look closely at whether each excluded control is justified.
The CRO can review the SoA exclusions as a record of risk acceptance: whether they rest on the same risk assessment, and whether they match the risk appetite approved by the committee.
What does ESG indicator S-12 require for the bonus point?
S-12 (same wording in the 2026 and 2027 editions, A+ item, assessed on the annual report): a disclosed cybersecurity risk management framework, policy, concrete programmes and resources invested. One extra point overall for ISO 27001, CNS 27001 or another information security management standard or system of equal or greater effect, with third-party certification.
The ESG evaluation covers listed companies; companies that are not public companies are not covered and can use it voluntarily.
Which version applies now, and how long does implementation take?
Always ISO/IEC 27001:2022; the transition period for 2013 certificates ended on 31 October 2025. Annex A was reorganised from 114 controls to 93, with 11 new ones; organisations with the old system map controls and close gaps rather than starting over.
Timeline as listed on the service page: depending on scope and maturity, typically 4–8 months (gap analysis → system build → internal audit and management review → stage 1 and stage 2 certification audits); existing IT governance shortens it noticeably.
We also plan 22301, 27701 and 42001. How should the CRO sequence them so each certificate is not a separate system?
27001 is the foundation most standards attach to: 27701 (privacy), 22301 (business continuity) and 42001 (AI management) all share its management system skeleton. Getting 27001 right first sharply lowers the incremental cost of each later certificate; that is the core logic of sequencing certifications.
For example, 22301 and 27001 share the Annex SL structure, and 27001 A.5.29/5.30 (security during disruption, ICT readiness) connect directly with 22301, so an integrated implementation can share documents and audits.
How does Winners Consulting help CROs with ISO 27001?
- Scope first: confirm security requirements from customers, tenders and regulators, and define the certification scope
- One scale: build the assessment framework in ERM risk language and decide controls and the SoA
- Outsourced internal audit: for certified organisations, the internal audit can be outsourced to Winners
- Who leads: vice-president and director-level consultants lead personally end to end, never outsourced; the team holds ISO lead auditor qualifications
- Named clients: MPI Corporation (旺矽科技), 訊光資訊科技 (InfoLight), 卓元科健 (Cho Yuan), Hypercore Fitness Center, Taiwan Stock Exchange (TWSE), Joint Credit Information Center (JCIC)
ISO 27001 consulting, Choosing an ISO 27001 consultant. Request a free mechanism diagnosis
How other roles see this service
Other services for this role
- ERM for CROs: how do you build the risk map, KRIs and board reporting?
- ISO 22301 for CROs: how do scenarios, RTOs and exercises enter the risk report?
- ISO 37001 for CROs: how do you manage bribery scenarios and overseas exposure?
- Trade secrets for CROs: how do you set leak scenarios, reasonable measures and KRIs?
- AI risk for CROs: what to decide first on ISO 42001 and the EU AI Act?
- GDPR for CROs: how to assess fines, intra-group transfers and breach scenarios?
- NIS2 for CROs: how to assess scope, fines and management body duties?
- EU CRA for CROs: how to handle market access risk, reporting and oversight?
- CRO and DORA: where do ICT third-party and operational resilience risks go on the risk map?
- CRO and AI transformation: putting AI risk into the risk map, KRIs and board reports