ISO 27001 Audit: a Case Study on ISO 27001 Audit Preparation

Read case study: Gart’s Expertise in ISO 27001 Compliance Empowers Spiral Technology for Seamless Audits and Cloud Migration

Why Businesses Need ISO 27001 Certification?

In the ever-evolving digital landscape, ISO 27001 certification is not just a choice; it’s a necessity for businesses aiming to fortify their defenses against cyber threats, adhere to regulatory standards, build trust with stakeholders, and ensure the robust protection of sensitive information. ISO 27001 certification isn’t merely a symbol; it’s a strategic imperative for organizations committed to securing their operations, fostering resilience, and thriving in an era where information security is paramount.

• Fortify against cyber threats
• Adhere to regulatory standards
• Build trust with stakeholders
• Ensure robust protection of sensitive information

About the Client — Spiral Technology

At Spiral Technology we are creating Spector, a Hololens 2 platform for industrial automation. Spector allows the creation of accurate quality records in manufacturing of the large structures. The location of the defect is recorded in Augmented Reality together with the picture and other characteristics such as type, size, and part number. The platform also provides automated quality assurance by analyzing pictures of the surface with machine-learning models

This helps to reduce cycle time due to higher accuracy of the inspection data, transparency of the inspection and repair status, and fewer quality escapements.

• A trailblazer in augmented reality for industrial inspections.
• Pioneering cutting-edge solutions to transform inspection processes.
• Headquartered in the vibrant tech hub of Boston, Massachusetts.
• Strategically positioned for innovation and collaboration in the technology landscape.

Client’s Challenge

• Preparing for ISO 27001 audits while launching a crucial product.
• Aligning DevOps and ensuring compliance — no easy feat.
• Navigating the complexities of cloud migration.

ISO 27001 Compliance Tasks Categorization

Gart demonstrated precision in tackling over 55 pending compliance tasks. These tasks were systematically categorized into key areas:

• Infrastructure and Cloud Security
• Personal Security
• Code Security

Cloud Security Enhancements

Assessment of GCP, configuration of security groups, and firewalls
SSO integration with Google Workspace for centralized control
MFA implementation for all GCP access

Infrastructure Security Measures

Data encryption for database security
Restriction of external access to application endpoints
Backup strategies and Disaster Recovery plan with a 40-minute SLA

Personal Security Focus

Centralized system for managing and controlling development devices
Curated list of approved software for secure development practices

Code Security Measures

Secure configuration of GitLab repository
Enforced branch protection and introduction of DAST and vulnerability scans

Results and Achievements

Tangible outcomes: completion of 55 ISO 27001 compliance tasks
Successful migration from GCP to Azure
10 hours of high-quality IT infrastructure advisory
Client testimonial on Clutch from Spiral Technology’s CEO

“It was a pleasure to speak on calls when we were knocking down tasks, cracking jokes, and telling personal stories.”