ISO 27001 case study – the Deazy way to do it
Deazy has just been certified for ISO 27001 after taking part in the Securious ISO 27001 Academy. We’ve put together this case study outlining how Deazy approached the implementation of ISO 27001 because we believe they are a fantastic example of how to do it well.
About Deazy
Deazy connects enterprises, VC backed scale-ups and some of Europe’s biggest agencies with high-quality development teams. It works with handpicked teams comprising more than 3,000 developers, providing broad technical expertise and greater capacity and flexibility.
Deazy is now in the third year of its mission and the business is growing at an impressive rate. As of January 2022 Deazy also successfully completed Series A funding with an investment from Puma Private Equity. The whole team is based remotely (and has been since before the pandemic even hit), and all their systems are cloud-based.
The business wanted to achieve ISO 27001 to ensure they were handling all information securely. They decided the best way to do this was through the Securious ISO 27001 Academy.
What is ISO 27001?
ISO 27001 is the international standard for Information Security. It provides a framework for an information security management system, which enables organisations to manage the security of assets like financial information, intellectual property, employee details or information entrusted by third parties.
What is the Securious ISO 27001 Academy?
The Securious ISO 27001 Academy is a series of six collaborative sessions that gives members an understanding of the standard, its application and implementation. It also helps them build an information security management system manual (the core document required for ISO 27001).
The sessions can be delivered in person or entirely remotely, meaning there’s no loss of progress due to remote working. They can be bespoke sessions for attendees from a single business, or you can join a cohort of like-minded businesses also looking to achieve the standard.
Deazy went for bespoke sessions focused on helping them implement the ISO 27001 framework in a manageable way that would ensure their data was secure and that they were in a good position for achieving the certification when the time came.
Why Deazy wanted to achieve ISO 27001
Implementing scalable and robust processes and policies
Deazy first engaged with Securious in 2020, when they were keen to adopt the ISO 27001 framework to ensure that the processes and policies they were putting in place were robust and effective at keeping their data secure. They recognised that as a young, growing business, information management is the kind of thing that’s far easier to get right at the outset, rather than waiting for years to come, when an overhaul would be a far bigger, harder and more costly job. Deazy wanted to work with Securious to raise their information security standards and lay a solid foundation for future growth of their remote team.
By embedding the ISO 27001 framework early on, they’ve let good practice dictate the ways they work and scale, building robust systems from the base up that will develop and grow with the business. This reduces the likelihood of a security breach and any resultant damage to their brand or reputation.
Providing reassurance to current and future clients
Deazy always intended to achieve the ISO 27001 certification, but that in itself wasn’t the most important thing for them at the start of the journey (and this is one of the reasons why we believe they’ve been so successful). Another key goal was to ensure (and prove that) the business was operating in a robust and secure way, since they work with a number of large clients on digital projects and consequently process sensitive information.
Meeting requirements for client contracts
The Deazy team had already implemented many of the core systems for ISO 27001 through the Academy before they discovered they needed to achieve the ISO certification to win a new client contract. This meant achieving the certification wasn’t a huge task. Requirements could be quickly and successfully met with little disruption – thanks to the prior work they had done.
An additional benefit of achieving the certification is that in the future, Deazy will be able to quickly and easily complete any due diligence information security questionnaires for potential or existing clients because they have clear policies, procedures and working practises in place. Additionally, the framework helps support the information security risks of Deazy’s supply chain.
Why Deazy chose the Securious ISO 27001 Academy
“We primarily chose the Securious ISO 27001 Academy because of its focus on knowledge-sharing. We recognised that this would be hugely beneficial as we put new systems, processes and policies in place and built a solid foundation for our information security. The traditional consultancy approach could have worked, but the way the Academy gave us bite-size blocks for building our information security systems gave us flexibility around our workload and meant Securious were always on-hand to bounce ideas and generally support the implementation.
“Deazy used the ISO 27001 Academy for knowledge-sharing and to ensure that the processes and policies they put in place were robust and worked for the business. It also set us up for the next stage of implementation. It helped us understand the scope of the task, and plan accordingly.”
– Gus Chadney, CTO at Deazy
Implementation of ISO 27001
Policy, process and management system development
Deazy started off by looking at their asset and risk registers, ensuring they were up to date and they had processes in place to maintain them. These are major elements of ISO 27001 and it was a good decision to get them in place from the start, to provide a solid foundation for the implementation of the rest of the standard.
Deazy used the Securious ISO Template Pack so they could be confident that all mandatory documentation was in place to cover the key areas of ISO 27001. If anything felt like it wouldn’t work for them, they’d bring it to the Academy and we’d discuss it and find a solution together. Deazy were keen to create policies and processes which worked for their internal team and partners, as they knew this would ensure security standards were kept in check.
Deazy then created their own bespoke, online process for due diligence and onboarding new suppliers.
Supply chain due diligence
Deazy recognised that supply chain due diligence is particularly important because it opens up a whole area of risk that’s out of their control. This means they had to ensure their suppliers were taking information security seriously, so they established the level of risk for all project information flows, ensuring the classification of data shared was adequately protected.
They then designed an onboarding questionnaire on the Deazy platform for all new suppliers, so they could establish what measures they had in place to protect their data (like whether they have a risk or asset register or have achieved ISO 27001).
Internal culture
Deazy’s internal attitudes toward achieving the standard were also important factors in their success. It was seen as a priority internally, being driven by the leadership team with full support from the CEO.
Having two influential staff fully involved from the outset all the way through, sharing everything as they went, really helped. It’s one of the reasons it went so smoothly, with two people to bounce ideas and Securious on-hand to help where needed.
Ultimately, it was Deazy’s project – we were just there to facilitate and make sure it happened, ensuring it fulfilled the ISO standard and suited the Deazy environment, along with helping with any questions or lack of understanding. Their willingness to learn, and improve their business was a great asset for the implementation as a whole.
Awareness training
Deazy created their own awareness training for suppliers and the internal team. It was based on the Academy, with a slide set for internal security awareness using the knowledge gained from the Academy to share the key areas of risk management for staff and suppliers.
Cloud systems
Deazy had to adapt their infrastructure policies to work with their cloud based network infrastructure rather than a traditional, on-premise corporate network. This also affected how they approach backups, business continuity, technical security reviews of remote staff devices, and their acceptable use policy.
Deazy and Securious on working together in the ISO 27001 Academy
Darren Grey, Operations Manager at Securious, comments:
“From the initial meeting, it was a pleasure to work with Deazy. They were clearly intending to use the journey of implementing ISO 27001 as an improvement to the organisation’s information security resilience.
“Deazy took on the implementation and knowledge sharing via the Securious ISO Academy with enthusiasm, identifying and challenging how various security procedures or risk management would work best in their own environment of cloud-based, remote working operations with the supply chain being a key consideration.
“It was encouraging to see that Deazy understood ISO 27001 as a tool for improvement and were always keen to talk through best practice with Securious, while owning this project from the outset. As ISO 27001 Lead implementers, we always encourage an Information Security Management System (ISMS) to be ‘business as usual’ and not another task to tick boxes.
“Throughout the successful journey to certification, Deazy ensured they made decisions that were correct for them to reduce risk, with the support and knowledge of Securious throughout.
“Experiencing the knowledge growth of the Deazy ISMS team of ISO standard and Risk Management, through our easy to digest Academy steps, building from foundation to operation and knowing that Securious were able to play a role in this growing company’s security practices that will only become stronger, was a delight.
“We wish Deazy the very best for their future endeavours and hope to continue our partnership over the coming years.”
Jack Brooks, Head of Operations at Deazy, adds:
“Working with Securious has been very valuable! Working with Darren, Nigel and Roz has been great fun. Some see the world of information security as a bit ‘boring’, but they continually relate it to genuine business problems, and how important it is to get right – this is key when setting up a system to work across Deazy.
“Securious quickly understood our challenges, and helped coach us through the fundamentals of information security and beyond. They also helped us apply the ISO 27001 framework to a relatively complex set up for a growing business. They also provided us with a set up for practical solutions that will continue to be effective as we grow. Furthermore they assisted in running an internal audit so we could continually improve how we operate, particularly for information security management.”
Interested in achieving ISO 27001?
Just fill out a contact form below and one of our team will be in touch to discuss your situation. Alternatively, check out some related blogs: