🔍 Context

The agency was a fully remote team of 30+, with people working across the world, serving clients in aerospace and defense manufacturing. That client base meant the data moving through the agency was highly confidential, and those clients needed assurance it was handled to a recognized standard.

ISO 27001 was the answer, the international standard for information security management. The agency had solid working practices already, but not in the form a certification audit requires. Someone had to turn how the team actually worked into a documented, auditable information security management system, and coordinate the whole certification through to a pass. That was me.

🧩 Snapshot

• Client type: 30+ person remote agency, global team, aerospace and defense clients
• Standard: ISO 27001 (information security management)
• Timeline: ~2023, roughly one to two months of active coordination through to certification
• My role: Sole owner of the certification process, from documentation through the external audit

📈 Results (at a glance)

• Passed the ISO 27001 certification audit on the first attempt
• Turned existing SOPs and working practices into the documented policies an audit requires
• Mapped every relevant process into ISO format
• Coordinated directly with the certification body through requirements and review
• Left the agency with a maintainable information security system, held for years after

🔥 The problem

The agency worked to a real standard day to day, but "we do it properly" is not something an auditor can certify. The gap was structure:

• SOPs existed, but not as the formal, mapped policies ISO 27001 requires
• Confidential client data (aerospace, defense) moved through a fully remote, globally distributed team, which raises the bar on access and handling