A Big Step Forward for Our Security: ISO 27001:2022 Certification

Go Wombat is now ISO 27001:2022 certified. ISO 27001 is the international standard for information security management.

Certification took months of work and involved every department. Below is what the standard requires and how we prepared for it.

What ISO 27001:2022 Means

ISO 27001:2022 is not a one-off checklist. It requires a working information security management system, so that data protection is planned and managed rather than left to chance.

The standard sets out requirements for an Information Security Management System (ISMS). In practice, the ISMS is our set of policies, processes, tools and responsibilities for protecting information.

Responsibility is not limited to management. Engineers, HR, sales and anyone else who handles information are responsible for security.

ISO 27001 is built around three principles: confidentiality (only authorised people can access data), integrity (data stays accurate) and availability (data is accessible when needed). As a certified company, we have controls, procedures and monitoring in place for all three.

At Go Wombat, the standard gives us an internationally recognised framework for preventing data leaks, insider incidents, breaches and other cyber threats. It also makes our operations more predictable: teams follow documented procedures and keep them in line with current practice.

Behind the certificate is the ISMS itself: people, processes, technology and risk management working together. ISO 27001 sets out the main management requirements and a catalogue of security controls covering access management, cryptography, supplier oversight, secure development, business continuity and more. Not every control is mandatory: each organisation selects the controls that fit its risk profile, so our set reflects how Go Wombat actually works.

How We Achieved ISO 27001

These were the main steps:

• Defined the scope and got leadership on board

• Mapped out all the regulatory, contractual, and industry-specific requirements

• Ran a full company risk assessment

• Chose and implemented the right security controls

• Made sure everyone understood their responsibilities

• Prepared and formalised all the needed documentation

• Trained every employee, including onboarding sessions for newcomers

• Created a plan for risk treatment and reporting

• Set up monitoring, auditing, and ongoing improvement for the ISMS

Our certificate was issued by Tempo Audits. We are grateful to them and to Mykhailo Bentza, our technical auditor, for their help throughout the process.