We're implementing ISO 27001

At Igasoft we've begun the process of implementing the ISO 27001 standard to strengthen our information security management.

We've been working for a while now on implementing the ISO 27001 standard within Igasoft. We want to share this simply: this isn't an announcement of a certificate already achieved, but rather a process that's already underway and that we think is important to share with those who trust us or are considering doing so.

What ISO 27001 is

It's the international reference standard for information security management systems. It doesn't define a specific product or tool, but rather a working framework: how we identify risks related to the information we handle, how we address them, what controls we put in place, and how we review that everything keeps working over time.

Why we're doing this

As a software company, we constantly work with client information, code, system access, and data that isn't ours but is entrusted to us so we can do our job properly. Implementing ISO 27001 is a way of organising and making explicit something any client takes for granted: that this information is handled with care, through clear procedures and not just good intentions.

What the process involves

Implementation means reviewing how we work internally in quite some depth:

• Identifying which information assets we handle and what risks are associated with them.
• Documenting security policies and procedures that until now may have lived more in people's heads than on paper.
• Defining access controls, backups, incident management, and other technical and organisational aspects.
• Establishing periodic review mechanisms, because security isn't something you fix once and forget.

This work affects different parts of the organisation, not just the technical team. It takes time, and it requires everyone to understand why things are done a certain way.

What this means for those who work with us

We're still in the process, so we won't talk about certification as if we already had it. What we can say is that this work is already changing how we document and review our own internal processes, and we're doing it with the aim of giving more guarantees to those who entrust us with their projects and their data.

We'll keep sharing how this process progresses as we have concrete news to report.