Building the Resilient Enterprise: An ISO/IEC 27001 and ISMS Implementation Playbook

They lack a management system that connects those tools, the people who run them, and the decisions of leadership into something they can defend to an auditor, a customer, a regulator, or their own board.Building the Resilient Enterprise is a practitioner's playbook for designing, implementing, and sustaining an Information Security Management System (ISMS) built on ISO/IEC 27001:2022. It is written for people who have to do the work: writing the policy, running the risk assessment, briefing leadership, and sitting across from an auditor.Inside the book:- The business case for an ISMS, and what certification does and does not prove- Clauses 4 to 10 explained step by step, from context and scope through risk treatment, the Statement of Applicability, internal audit, management review, and corrective action- All 93 Annex A controls across the Organizational, People, Physical, and Technological themes, with a practical implementation sequence- Stage 1 and Stage 2 certification audits, working with certification bodies, common nonconformities, and surviving surveillance and recertification- Integration with ISO 9001, ISO 22301, and the standalone ISO/IEC 27701:2025 privacy standard- Cloud and data centre environments, regulated sectors, and regional alignment across the GCC, EU, UK, US, and Asia- Extending the ISMS to AI systems, including ISO/IEC 42001- Two composite case studies, a certification readiness checklist, and ready-to-use templates for the risk register, Statement of Applicability, audit programme, and moreThe book is framework-led, not law-led. GDPR, the Saudi PDPL, and other regulations appear as examples of how legal obligations map onto ISMS controls, so it is equally usable for compliance officers, CISOs, auditors, and founders in any market.About the author: Rashid Hussain is a legal and technology governance professional with more than fifteen years of senior in-house experience in cloud, data centre, and telecommunications environments. He holds CISA, CRISC, CDPSE, PECB Certified Data Protection Officer, and PECB ISO/IEC 27001 Lead Implementer credentials.