From audit to ISO 27001 certification for a 100‑person IT services company

The challenge

An IT services company of about a hundred people, which itself sells cybersecurity services, had to prove the strength of its own practices to clients and partners: achieve ISO 27001 certification and prepare for its PASSI qualification. No critical in-house software development, but a multicloud environment and many SaaS services.

• Define a clear, realistic certification scope, and share evidence between the two frameworks.
• Align security practices that differed from one department to another.
• Embed the management system without slowing the company down.

What we did

Governance: a complete, living management system

• Scoping with the sponsors and a named contact for each business capability and support function.
• Risk analysis, treatment plan and security policy.
• A 105‑document information security management system, with a statement of applicability that justifies every non-applicable control and anticipates 13 of them if the scope changes.
• Formal governance: security committee, management review, planned internal audits.

Architecture: security rolled out in stages

• Security architecture blueprint and integration patterns.
• Identity and access: single sign-on, MFA on every sensitive access, just-in-time privilege elevation, periodic access reviews.
• Endpoints and servers: EDR, device management, encryption, hardening and configuration drift control.
• Exposure: WAF and CDN in front of exposed services, filtering DNS, administrative access through ZTNA.
• Vulnerabilities: recurring scans, prioritisation by exposure, fix deadlines by severity.
• Encrypted, immutable backups, planned restore tests, centralised logs and incident response playbooks.
• Incremental rollout: quick wins first (MFA, EDR, backups), then reinforcement (WAF, SIEM, ZTNA).

What changed

• ISO 27001 certification achieved; cyber maturity recognised by the auditors of the client’s PASSI qualification.
• Internal audits passed, backed by structured evidence sets.
• Tooled processes, clear responsibilities and faster incident response.

Three offers in sequence, from Organise to Orchestrate: Trusted Organisation for governance, Trusted Architecture for design and Trusted Integration for delivery.