Getting ISO certified

Agiledrop recently went through the process of obtaining the ISO/IEC 27001:2022 certification, and I would like to share what the entire process looked like and what were the biggest lessons learned. Hopefully, this will help readers also considering the ISO certification more confidently make the decision.

ISO/IEC 27001:2022 is the international standard for information security management. It sets out how an organisation identifies its information security risks and manages them across people, processes and technology.

The key word here is system: it isn’t just a folder of policies, but something that has to run day to day, and an independent body audits it to confirm that it actually does so.

We started with the certification process a little over a year ago, as we observed how big of an impact AI is having on information security and how that consequently affects trust in client relationships.

AI has changed how fast data moves and how many tools sit in everyone's workflow. The risks have grown with it, as did – naturally – client expectations as well. The expectations enterprise clients now have from a development partner are simply higher than they were two years ago, and we wanted to meet this new bar.

We have always been doing a lot of the right things when it comes to security, just not formally up to that point. Getting the certification was the way to turn those habits into a real system, and to stop rebuilding our security answers from scratch for every new client questionnaire.

The certification process itself was a process in the truest sense of the word. I started thinking of it as a long walk: you set off, you keep meeting situations you didn’t plan for, you watch how the controls hold up in practice, and you adjust as you go. The certificate is a milestone on that walk rather than the destination.

The year also forced a lot of honest self-reflection. We had to separate what actually works from what only looked good on paper, and rethink some of our own processes along the way. That actually turned out to be as valuable as the certificate itself. The two hardest parts were making a large, formal standard fit a company our size, and maintaining momentum once the first push was over.

Now that the process is behind us and we’ve successfully obtained the certification, I have to highlight how valuable the experience was, despite the challenges.

Most of all, the certificate is independent proof of how seriously we take information security, tested against a recognised international standard rather than just taken on our word. This is real assurance for our clients: they are working with a partner that has been audited, not one that simply self-declared their commitment to security.

One benefit that is less immediately obvious is that the process of getting certified also made us better internally, not just more credible externally. We found gaps that we didn’t know we had – and successfully closed them. Our clients benefit from that whether or not they ever read the certificate, or even know that we have it at all.

To conclude, I would like to share some specific tips for anyone also considering or just starting the process of getting ISO certified:

• Get leadership behind it early. Without a real mandate, budget and visible support, the effort stalls when it competes with day-to-day work.
• Treat it as a chance to fix real processes, not just as paperwork. The companies that gain the most close real gaps. The ones that gain the least produce beautifully written policies that no one follows.
• Make it safe to ask questions. In our case, we set up an anonymous Q&A form and turned the answers into a shared knowledge base. It surfaced the real doubts which people had and helped far more than another policy document would have.
• And finally – expect self-reflection, and lean into it. You will be forced to look hard at what works and what only looks good on paper. That’s where a lot of the real value sits but is often missed without such a thorough process.

Agiledrop has always strived to be a reliable development partner to our clients. They trust us with access to their systems and their data, and the ISO/IEC 27001:2022 certification lets us show, on record, that we handle that responsibility properly.