$500K on ISO 27001 with no real tangible contracts results to work on. They probably spent that again on the preparing the tenders themselves!