I tried to open a conversation with an entity that issues ISO27001 certificates about the stuff I had found at a company they had recently certified. The response was such that I have lost faith in that entire industry. It's essentially a well dressed up pay-to-play.