About ISMS Premortem

ISMS Premortem was created by Brian Colborne, a deployment and systems delivery engineer who has worked inside real production environments where systems are implemented, tested, handed over, audited — and sometimes broken under external scrutiny.

The platform exists for a narrow and practical reason:

To detect governance and evidence chain failures before an external auditor documents them.

Not to teach compliance theory.
Not to sell templates.
Not to run workshops.

To test whether evidence survives sampling pressure.

Why This Exists

Across real audit-exposed environments, a consistent pattern shows up:

Organizations rarely fail because they lack policies.

They fail because their traceability chain breaks under sampling.

• Risk doesn’t link to control

• Control doesn’t link to execution

• Execution doesn’t link to evidence

• Approvals don’t reconcile

• Records don’t align across systems

Dashboards say green.
Sampling says otherwise.

ISMS Premortem was built specifically around those collapse patterns.

Founder Background

The methodology behind ISMS Premortem comes from 20 Years hands-on work in:

• systems deployment

• integration and delivery

• testing and QA

• operational handover

• audit-exposed environments

• evidence and control verification

• risk and governance traceability

That background creates a different bias:

Not toward how controls are described —
but whether they can be proven under pressure.

Not checklist compliance —
but artifact linkage survival.

Why This Is Different

Most compliance providers operate from a consultant model:

• readiness reviews

• maturity scoring

• advisory workshops

• template frameworks

ISMS Premortem operates from an operator model:

• artifact testing

• traceability verification

• sampling simulation

• binary verdict logic

No comfort language.
No advisory padding.
No theater.

Diagnosis first. Repair decisions second.

Who This Is Built For

This is built for:

• already certified ISO 27001 environments

• teams facing surveillance or recertification audits

• accountable ISMS / GRC / security leaders

• organizations with real artifact trails

This is not built for:

• first-time certification builds

• template-only systems

• advisory-led programs without operational evidence

Why “Premortem”

A premortem asks what will fail — before it fails publicly.

Applied to ISMS governance, it means identifying where evidence chains will collapse under sampling before those breaks are written into an audit report with names attached.

That is the purpose of this platform.

How To Use This Platform

If you carry audit accountability:

1. Run the exposure self-check

2. Identify where traceability fails

3. Decide whether deeper diagnostic is required

No registration.
No calls.
No sales process.

Just signal.

Run the self-check here: