ISO 27001 Certification Readiness For A B2B SaaS Provider

We began with a detailed gap analysis against all 93 controls in ISO 27001:2022. Interviews with leadership, engineering, HR and operations showed which good practices already existed informally and where important gaps remained. Every department contributed openly and honestly to the review.

The company was stronger than it expected in technical areas like encryption, backups and secure development, but had almost nothing documented. Supplier management, asset classification, incident response and business continuity were the largest gaps, alongside the formal management processes that ISO 27001 requires every certified organisation to run.

The gap analysis produced a realistic nine-month plan with clear priorities and owners. It showed leadership exactly how much effort certification would take, which helped secure the right people and budget from the very beginning of the project. It also highlighted quick wins that improved security immediately, building early momentum across the company.

The information security management system is the backbone of ISO 27001. We designed one that matched the company's size and culture, avoiding the heavy, bureaucratic approach that often makes these systems fail in smaller, fast-moving organisations. It needed to be simple enough to last for years.

We defined the scope, security objectives and roles, and set up a light but effective rhythm of monthly security meetings and quarterly management reviews. Documents were stored in the tools teams already used every day, so keeping the management system current felt like part of normal work rather than a separate chore owned by one person.

The ISMS gave the company a clear structure for making and recording security decisions. Leadership now reviews information risk regularly, and the system has continued to run smoothly since certification without needing constant outside support to keep it alive. Surveillance audits since certification have gone smoothly, confirming the management system works as intended.

The company needed 22 policies to meet the standard, and most did not exist. We wrote them together with the people who would follow them, so each one reflected how the business actually worked rather than a generic template. Staff were involved in drafting every single one of them.

Policies were kept short and practical, using plain language and clear examples. Covering topics from acceptable use and access control to supplier security and incident response, each one had a named owner, a review date and a short summary so staff could quickly understand what was expected of them in their day-to-day roles.

All 22 policies were approved by leadership and published internally within the first three months. Because they were written with staff rather than for them, adoption was high, and auditors later praised how well the policies matched real practice. Policies are reviewed every year, and staff can suggest changes whenever something no longer fits.

Risk management is at the heart of ISO 27001. We helped the company identify and classify its information assets, from customer data and source code to laptops, cloud accounts and key suppliers. Every team helped identify the assets most important to them.

In total, 140 assets were recorded and assessed for the risks they faced, considering both likelihood and business impact. Each risk was given an owner and a treatment decision, whether to reduce, accept, transfer or avoid it, creating a clear and defensible record of how the company was managing information security risk across the business.

The risk register is now reviewed every quarter and updated whenever new products, suppliers or systems are introduced. It gives leadership a clear view of where the biggest risks sit and helps guide security investment decisions for the year ahead. The register also helps answer customer due diligence questions quickly, supporting the sales team in enterprise deals.

With risks identified, we helped the company implement the controls it was missing. The focus was always on practical measures that genuinely reduced risk, not on creating paperwork purely to satisfy an auditor. Each control was matched to a real, clearly identified risk.

New controls included formal access reviews, supplier security assessments, an incident response plan, business continuity testing and secure offboarding. A compliance automation platform was connected to the company's cloud, identity and HR systems, collecting evidence continuously so that audit preparation no longer meant weeks of screenshots and spreadsheets gathered by hand.

By the end of the implementation phase, all 93 applicable controls were in place and working. The company's actual security improved significantly along the way, with faster offboarding, better supplier oversight and a tested plan for handling security incidents. Continuous evidence collection means the company is always audit-ready, not just in the weeks before a visit.

ISO 27001 requires every employee to understand their security responsibilities. Before the project, most staff had never received any formal security training, and few knew how to report a suspected incident or phishing email. The goal was lasting behaviour change, not simple box-ticking.

We delivered short, engaging training sessions tailored to different roles, supported by bite-sized online modules and regular phishing simulations. Security topics were also added to onboarding, so new starters learn what is expected of them from day one rather than months later, when poor habits have already had time to form.

All staff completed the training before the certification audit, and phishing click rates dropped steadily over the following months. Employees now report suspicious emails quickly, and several real phishing attempts have been caught early because staff knew what to look for. Security awareness is now part of the company culture, with teams regularly sharing tips and examples.

Certified organisations must audit their own management system regularly. The company had no audit experience, so we trained a small internal audit team and guided them through three full audit cycles before certification. Their skills would be needed long after certification was achieved.

Each cycle tested different parts of the ISMS, finding gaps and improvement opportunities that were fixed well before the external auditors arrived. The internal auditors learned how to gather evidence, interview colleagues and write clear, constructive findings, building skills that the company will rely on long after the certification audit is over.

The internal audit team is now certified and runs the audit programme independently. This means the company can maintain its ISO 27001 certification year after year without depending on outside consultants for every surveillance and recertification audit. Findings from each internal audit feed directly into management reviews, driving steady, measurable improvement.

In the final stage, we prepared the company for its external certification audit. Mock audits, evidence reviews and interview practice made sure everyone knew what to expect and felt confident speaking to the auditors. Preparation was thorough, but it never overwhelmed the small team.

During the stage one and stage two audits, our consultants were on hand to support the team, while staff answered the auditors' questions themselves. Evidence was ready instantly through the compliance platform, which impressed the auditors and kept the process smooth, efficient and well within the time originally planned for the audit.

The company achieved ISO 27001:2022 certification on its first attempt, with zero non-conformities. Six blocked enterprise deals worth around £3 million moved to close within 90 days, and the certification now features prominently in every sales conversation. The company is now pursuing further certifications, building on the same management system and its confidence.