ISO/IEC 27001 Certification for a Supply-Chain Software Company
Certified on the first audit with zero nonconformities, major or minor.
Client name withheld by agreement- Client
- Supply-chain planning software company
- Region
- Atlanta, Georgia and Amsterdam
- Year
- 2022
- Duration
- 18 weeks
- Scope
- 2 offices · 340 employees · 1 hosted platform
- Practice
- AI, Cloud & Digital Trust
The challenge
What was at stake.
A supply-chain planning software company with offices in Atlanta and Amsterdam was losing European manufacturing prospects at the vendor assessment stage. Every one asked for an ISO/IEC 27001 certificate, and the company had never run a management system.
With 340 employees and a small security team, it needed a system people would actually maintain after the auditors left.
What we did
The approach, step by step.
- 01
Scope tied to revenue
The scope covered the hosted planning platform and the teams that build and support it, which is what prospects needed the certificate to cover.
- 02
Risk assessment the team owns
Product, engineering and operations leaders scored their own risks, so the Statement of Applicability reflected real decisions.
- 03
Management system in the normal calendar
Internal audit, management review and security metrics were folded into existing quarterly business reviews.
- 04
Certification audits prepared
We ran a pre-assessment, prepared staff for interviews and supported both stages of the audit with the accredited certification body.
Outcomes
What changed, in numbers.
- 0
- nonconformities, major or minor
- 18
- weeks from kickoff to certification audit
- 2
- offices in one certificate scope
- 4
- European deals closed within two quarters
The certificate got us through procurement. The management system is what keeps us out of trouble.
Services delivered
Related engagements
More work in AI, Cloud & Digital Trust.
-
Denver, Colorado · 15 weeks
AI, Cloud & Digital Trust · 2025SOC 2 Type II for a Legal E-Discovery PlatformAn unqualified Type II report covering Security and Confidentiality, delivered before the Am Law 100 renewal cycle.
-
Seattle, Washington · 22 weeks
AI, Cloud & Digital Trust · 2026 · OngoingISO/IEC 42001 and Adversarial Testing for a Contact-Center AI ProviderVoice agents that can no longer be talked into reading back card numbers, and an AI management system heading for certification.
-
Houston, Texas · 24 weeks
AI, Cloud & Digital Trust · 2024Cloud Security Platform for a Genomics LaboratoryPetabytes of patient genomes locked behind one set of guardrails, with no slowdown in sequencing turnaround.
Let’s talk about your version of this.
Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.