We – a team that carries out ISO 27001 audits every day, writes ISMS concepts, advises others and regularly explains how information security is done “properly” – had ourselves certified in July 2025.
“And suddenly we were no longer the engineer – but the building being tested for stability.”
The beginning: the moment of decision
We knew: if we want to stay credible, we have to be certified ourselves. Not because we have to. But because we want to lead by example. Because we must not only “talk the talk”, but also “walk the talk”.
So in spring 2025 we made the decision – we would build our own ISMS and get certified – and not just “somehow”, but by a certification body accredited by DAkkS for ISO/IEC 27001 [1].
The reality: auditors don’t much enjoy auditing themselves
And then the self-experiment begins. We, who normally stand behind checklists and risk matrices, suddenly sat in the meeting ourselves, asking:
- “How do we document this process in a meaningful way?”
- “Why do we actually do it this way?”
- “Is this enough for the auditor?”
- “Or is it too little… or too much?”
Spoiler: our biggest opponent was not the technology. It was our own standards.
The challenges: processes that are overlooked day to day – and decisive in the audit
Our most important insights came from places where processes had long been taken for granted:
- Onboarding of new team members that assumes knowledge but secures nothing
- Risk analyses for tools that have “grown organically”
- Routine communication that was never documented because “it has always worked”
After our own audit, we know: process maturity does not show in complexity, but in whether a process is workable in everyday business and is actually lived.
That is why we integrated all policies and processes for our daily work into our WIKI. We even moved the external publication of our policies directly into our WIKI.
This not only avoids the effort of switching back and forth between different worlds (SharePoint, Google Drive, Confluence, etc.), but also increases employee participation.
What we deliberately excluded
Not every Annex A control is applicable to every company. Each company has to decide this for itself based on its processes, activities and risks. That is why, in our Statement of Applicability (SoA), we classified some Annex A controls as not applicable, with justification:
- Physical security – As a remote-first company, we left out several of the physical controls.
- Software development – Since we do not develop software, we removed the technical controls for software development from the scope.
We work transparently – so it was important to us to also tell you what we did not include. Because clarity matters, especially in audits.
This was our path – from the gap analysis to the certificate.
6 months later: certificate in hand
After 6 months of intensive work, many discussions, new routines and a few errors in thinking (yes, there were some of those too!), we can proudly say:
We are certified to ISO/IEC 27001:2022 – by a DAkkS-accredited certification body.
And a certificate is not a one-off event: in June 2026 we also passed our first surveillance audit – the best proof that our ISMS does not just exist on paper, but works in everyday business.
The certificate does not just hang on the wall – it changes the way we work. Because now we too know again what it is like to fight your way through policies, to weigh documentation against productivity – and to ask yourself: “What exactly are we doing this for again?”
For trust. For clarity. For lasting security.
Our learning: every serious consultant should be certified
When you are looking for information security consulting, please do not only ask: “How many clients have you supported?” But also: “How do you live information security yourselves?”
Because information security is not theory. It is a daily, sometimes tedious, but extremely effective process. And believe me: the certificate on the wall is only the symbol. The real value lies in the resilience of the organization.
Certification is not an end in itself.
It forces you to take an honest look.
And that is a good thing.
We now know even better how information security feels in practice – and we pass this experience on to our clients in our ISO 27001 consulting.
PS: If you are currently thinking about an ISO 27001 certification (in German) yourself – we know how that feels. Feel free to get in touch – no buzzwords, no PowerPoint battles. We would rather talk about what really works.
Want to get started on your own first? Our ISO 27001 checklist gives you an overview of the most important steps.
About the Author
Can Adigüzel is co-founder and managing director of 360 Digitale Transformation GmbH, a consultant for TISAX® and ISO 27001 Lead Auditor with more than 200 audits. He has worked in IT project management since 2012 and in information security since 2019. He helps SMEs implement information security pragmatically.
Sources:
[1] DAkkS: Accreditation certificate of Proks Certification GmbH, annex D-ZM-21201-01-02 (ISO/IEC 27001) (in German).
Last updated: August 4, 2026