More Work Than Expected, More Value Than Expected
The BlueMinds Case Study
A software company that develops custom applications for SMEs and provides display solutions to corporate clients knows better than anyone how important a reliable and secure IT environment is. But how do you make sure that ISO 27001 does not become a paperwork exercise for a small team, but actually connects to day to day practice?
In this case study, Ivo Roes, owner of BlueMinds, explains how his organization achieved ISO 27001 certification and what the process meant in practice.
About BlueMinds
BlueMinds is a software company that develops custom software applications, mainly for SMEs. The company deliberately focuses on connecting the application to the business process, with a strong emphasis on user friendliness. Its customer base is broad, ranging from webshops to financial institutions.
In addition to BlueMinds, there is the sister company Summit DIS, which provides digital signage solutions: screens that customers can centrally manage for internal communication, advertising, or visitor information. Summit DIS mainly serves the corporate market and public spaces, with customers such as the Van Gogh Museum and TivoliVredenburg.
BlueMinds and Summit DIS are two independent sister companies that operate as one team from a single office and fall under the same certification. In total, the organization has five employees.
The reason
The demand for ISO 27001 at BlueMinds mainly came from the market. Where the standard initially appeared only occasionally in tenders, it increasingly became a hard requirement, including among existing clients.
“We are seeing that it is increasingly being made a hard requirement. At that point, you can no longer simply say: we work in line with it, or we are working on it.”
Ivo Roes, Owner of BlueMinds
BlueMinds did not participate in many tenders itself, but noticed that customers were increasingly asking for the certificate. In addition, the organization saw that competitors without certification were increasingly being eliminated from customer selection processes. Formalizing something that BlueMinds believed was already largely well organized would make it easier to build trust.
The Approach
For BlueMinds, choosing Protify was an easy decision. The company had known Protify for some time through a shared IT service provider and had already had positive experiences with the collaboration.
“For me, it was basically a no brainer from the start that Protify would do this. And throughout the entire process, it also proved that this really added value.” Ivo said.
Still, the scope of the process was more demanding than expected in terms of workload. Especially making explicit and documenting processes that previously took place implicitly and naturally took more time than I had expected.
Some decisions related to ISO certification also had financial consequences that we had not anticipated in advance. To comply with the standard, BlueMinds had to replace outdated hardware and switch to more expensive software packages and licenses, because free or cheaper versions did not include functionalities such as single sign on or properly arranged data storage.
Within the small team of five people, Ivo himself and the security officer, a role performed alongside regular duties, took the lead. The team deliberately kept day to day operational work as separate as possible from policy development: the sessions with Protify were held with a small team, after which the outcomes were shared with the rest of the team.
The response within the team differed by role. Developers, who are naturally used to structure and frameworks, found it relatively easy to document ways of working. Among project managers, the process created more resistance, especially where the standard requires periodic sampling for matters that already occur in practice, but are not secured in a fixed schedule.
Why Protify
For BlueMinds, the combination of advice and sessions from Protify with the ProActive Compliance Tool, PCT, made the difference. The sessions provided context around the standard and concrete guidance. The PCT then helped structure and document it.
“If you just study the standard itself, you really have no idea. It was precisely the concrete guidance from the sessions and the reference matrix in the PCT that helped us enormously in translating the standard into what it actually means for us.”
Ivo Roes, BlueMinds
That reference matrix, which links standard clauses to sections in the PCT, also proved valuable during the audit. An auditor often speaks in terms of clauses, and the matrix enabled BlueMinds to quickly make that translation.
Protify also provided a strong starting point. According to Ivo, Protify’s translation of the conversations into texts was already well developed, but the specific details of processes and infrastructure still had to be completed by BlueMinds itself. That also matched the expectations that Protify had clearly outlined in the proposal beforehand.
For an SME organization like BlueMinds, the support in defining functions, roles, and stakeholder management proved especially valuable. In a small team with only a few people wearing multiple hats, these responsibilities are often less clearly assigned than in a large corporate organization. The sessions with Protify and the PCT helped capture this in a structured way and in line with the standard.
Results
The ISO 27001 certificate now functions as a hygiene factor for BlueMinds in customer conversations: it has become part of the daily way of working, rather than something separate from it.
“It is becoming more and more normal. As an organization, I am not spending all day on ISO certification, but the PCT does help us keep performing the tasks and documentation in the right way.” Ivo Roes, BlueMinds
The process also gave BlueMinds more insight into its IT infrastructure: from the registration of IT assets and acquisition dates to the question of which equipment is critical. These were matters that previously mainly existed in employees’ heads, but are now documented in a structured way. The process also forced BlueMinds to engage more often with its own IT service provider and suppliers, which further increased the level of information within the organization. As a next step, a penetration test of its own infrastructure is now planned.
The internal audit carried out by Protify was particularly valuable: it proved to be more critical and more thorough than the eventual external audit, and ensured that BlueMinds entered the external audit well prepared.
“I would always advise others to have Protify conduct the internal audit. You may take quite a beating, but that is exactly what you need to make sure everything is in order for the external audit.” The external audit itself then went relatively smoothly: partly due to the thorough preparation through the internal audit, there were no surprises.
Take-away
What Ivo wants to share with other SME organizations:
“Do not underestimate the amount of work, both in terms of time and costs. Many things that you already do well implicitly still need to be documented explicitly in order to make them demonstrable. And above all, have a thorough internal audit performed: that is the best preparation for the external audit.”
Do You Also Want to Achieve ISO 27001?
And do you want to approach this in a practical and workable way?
Are you considering taking the step toward ISO 27001 and do you want to approach it in a practical and workable way?
Feel free to contact us for a a no obligation introductory meeting. Together, we will make sure your organization works on information security in a demonstrable and sustainable way.
