For IT service providers, a certified information security management system (ISMS) in line with ISO 27001 is more important today than ever. Introducing one brings not only challenges but also new opportunities – for more structure, security and trust. In this article, we look back on our own journey and openly share what we would do differently today.
At Netstream, the introduction of our information security management system (ISMS) in 2022 was more of a rush job. Nevertheless, we managed to implement the ISMS in just under three months. After our first recertification audit – which takes place every three years – we look back and ask ourselves: would we do it the same way again today? Not quite.
Our original expectations were anything but optimistic. When we first considered ISO 27001 certification, we assumed costs in the six-figure range – and expected a project duration of one to two years. No wonder the topic was initially shelved again.
With growing market demand and rising requirements for information security, we finally decided to tackle the topic proactively. Our goal was clear: to implement ISO 27001 certification efficiently and sustainably – in a way that suits us as an SME.
Steps in building our ISMS: implementation and insights
1. Estimate the budget realistically
To be honest, at the start we had no clear idea of the costs that introducing an ISMS would actually involve. Earlier projections seemed clearly too high to us. So we opted for a pragmatic approach: instead of working with a fixed budget, we considered what the step towards ISO 27001 certification was fundamentally worth to us – and continually questioned this benchmark.
For many, starting a project without a fixed budget may seem daunting. But with a small team and short decision-making paths in particular, this flexible framework helped us invest in a targeted way – without losing control.
2. Accept help
It was clear to us from the outset: without professional support, it would be difficult. So we looked for a consulting partner who understood our situation and would help us build an ISMS that suits us – pragmatic, efficient and workable day to day.
3. An ISMS of the right size
We did not want to create a system that is convincing on paper but hardly workable in practice. That is why, right from the start, we made sure our ISMS stayed pragmatic – without losing the aim of meeting the ISO 27001 requirements seriously and traceably.
4. Involve the team – don’t just inform it
Don’t make the mistake of simply throwing the decision to introduce an ISMS over the fence. Ultimately, it is the employees who have to live the system.
That is why it was important to us to involve key people early on rather than just informing them. We talked openly about fears and reservations, but also took up ideas from the team and integrated them into the implementation.
5. Clarify tools and structure early
Our first version of the ISMS was scattered across a wide range of tools and platforms: Word, Excel, Confluence and countless folders.
Specialised software is not strictly necessary, but it can be an enormous help, especially for topics such as risk management or policy management.
Today we rely on a central ISMS solution but supplement it in a targeted way with tools such as Confluence and Jira – because they have proven themselves in our day-to-day work. What also helps: a clear and simple guideline for employees on where to find which content.
6. Define the scope deliberately
What actually belongs to our ISMS? To be honest, at the beginning we had no clear answer.
Today we know: a well-defined scope simplifies not only the documentation but the entire certification process. Back then, we felt our way forward step by step.
7. Capture risks properly – without drowning in them
Our first risk analysis was a confusing Excel monster that regularly gave us headaches. We were often not sure ourselves what we were actually assessing.
It quickly became clear: we needed a solution that would help us capture risks in a structured and traceable way – while keeping the necessary overview.
Moving away from Excel took more effort than expected, but it was worth it. Today we work with a specialised SaaS tool that supports us both in assessing and in tracking risks.
8. Develop policies that can actually be lived
A policy is quickly written, but that does not automatically make it helpful.
We realised early on that it is crucial to ask about every policy: is it really relevant? Is it understandable? And above all: can we implement it day to day?
The risk of getting bogged down is high, and in the end you create a system that is formally correct but that nobody really lives. So our goal was always: as much as necessary, as little as possible.
9. Document, document, document
A central but also tedious aspect of the ISMS. If documentation is not considered from the outset, it will come back to haunt you later. In the end, auditors want to see evidence.
ISO 27001 does not prescribe how to document – and that is precisely where the opportunity lies. We chose a way that suits how we work: today we rely on Jira, supplemented by Confluence, and document right where we work anyway. That saves time and provides an overview.
10. Not everyone needs to know the Cryptographic Policy
One of the biggest fallacies when introducing an ISMS: that everyone now has to know everything. They don’t. Instead of distributing entire collections of policies, we thought carefully: who needs what knowledge? A well-placed piece of information achieves more than 40 pages of policy that nobody reads.
11. An audit without panic? Preparation helps.
Our first audit in early 2022 had everything going on at once: a pandemic, an online audit and half the team off sick. The audit was conducted by video call – with screen sharing, spontaneous questions and the expectation that all documents could be found instantly. We had stored everything somewhere, but searching for specific evidence in the moment was… let’s say: challenging.
Today we know what helps: put together all relevant evidence, policies, reports and links in advance – ideally sorted by chapter of the standard. That keeps your pulse down, even when the camera is rolling.
12. After certification is before certification
Once you have the certificate in your hands, you might think: done. But strictly speaking, that is when the work really begins.
Since our initial certification, we have completely overhauled our ISMS more than once – rethought, reorganised, rebuilt. Not for fun, but because we realised: an ISMS has to fit the company, not the other way round.
Today we take a more relaxed view: the ISMS is not a completed project but a living part of our operations. And if you tackle it the right way, even a pretty useful one.
Conclusion
Our entry into the world of information security was rather bumpy – with lots of questions, a few detours and some spontaneous decisions.
Today, three years later, we have an ISMS that suits us: workable, effective and continuously evolving.
What have we learned? That perfection should not be the goal. An ISMS can grow, adapt and even be rethought from time to time – as long as it remains practical.
And yes: the investment was worth it. Not only because we are now certified, but because we understand risks better, have structured our processes more clearly – and the trust of our customers and partners has been strengthened.
For anyone facing the decision: start pragmatically, stay flexible – and see the ISMS not as a compulsory exercise but as an opportunity to put the company on a better footing.
