ISO/IEC 27001 and 27701 Built into Agile Delivery for a Field Service Software Company
Certified to both standards with no nonconformities, and security controls now ship as part of the definition of done.
Client name withheld by agreement- Client
- Field service management software company, 480 employees
- Region
- Princeton, New Jersey
- Year
- 2023
- Duration
- 20 weeks
- Scope
- 14 Scrum teams · 1 hosted platform · ISO/IEC 27001:2022 and 27701
- Practice
- AI, Cloud & Digital Trust
The challenge
What was at stake.
A field service management software company schedules technicians and stores site details, signatures and photos for utilities, HVAC contractors and equipment makers. Enterprise buyers in Europe and Canada wanted ISO/IEC 27001 certification, and several also asked for the ISO/IEC 27701 privacy extension.
The company ran 14 Scrum teams on two-week sprints. A management system built as a separate compliance project would have sat outside the way the company actually works, and been forgotten by the second surveillance audit.
What we did
The approach, step by step.
- 01
Risks owned by product teams
Each product area assessed its own security and privacy risks in a facilitated workshop, and treatment actions entered the normal product backlog with estimates and owners.
- 02
Controls in the definition of done
Threat modeling for new features, dependency scanning, peer code review and a privacy check for new personal data fields became acceptance criteria that every team applies.
- 03
Management system on the planning calendar
Internal audit topics, security metrics and management review were scheduled into quarterly planning, giving the management system a cadence the company already keeps.
- 04
Certification audits supported
We ran an internal audit and pre-assessment, prepared staff for interviews and supported both stages of the audit with the accredited certification body.
Outcomes
What changed, in numbers.
- 0
- nonconformities at Stage 2
- 14
- Scrum teams with security in the definition of done
- 2
- certificates from one audit cycle
- 93%
- of risk treatment items closed in their planned sprint
Security stopped being a separate track. It is just part of how a story gets to done.
Services delivered
Related engagements
More work in AI, Cloud & Digital Trust.
-
Boston, Massachusetts · 16 weeks
AI, Cloud & Digital Trust · 2024SOC 2 Type II with Evidence Built into ServiceNow Change RecordsAn unqualified Type II report with zero exceptions, and change-management evidence that now collects itself.
-
New York, New York · 20 weeks
AI, Cloud & Digital Trust · 2026 · OngoingISO/IEC 42001 and Adversarial Testing for a Commercial Underwriting AI PlatformDoctored broker submissions no longer steer risk rankings, and an AI management system is on track for its certification audit.
-
Pittsburgh, Pennsylvania · 22 weeks
AI, Cloud & Digital Trust · 2025Multi-Cloud Security Guardrails for a Regional Health SystemClinical imaging and analytics in two clouds under one set of guardrails, with no change to how radiologists read studies.
Let’s talk about your version of this.
Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.