Review the governance, policy, risk, asset and training foundations that reduce friction before an ISO 27001 programme begins.