We are particularly proud to announce that Data Guardians has obtained ISO 27001 certification. Beyond the legitimate satisfaction that comes with this type of recognition, this milestone is important for several reasons: for us as an organisation specialised in information security, for our clients, our partners and our employees.
In this article, we look at what this certification actually represents, its limitations — because there are some — and why not all ISO 27001 certifications are equal.
Why is this certification such an important milestone for us?
Obtaining ISO 27001 certification is, above all, about building an ecosystem of trust. This international standard is now the benchmark for demonstrating that an organisation has established structured information security governance: risk identification, risk treatment measures and continuous improvement.
This foundation is increasingly becoming a minimum expectation, in a context where cyberattacks are multiplying and becoming more sophisticated. The acceleration driven by artificial intelligence — whether used to automate phishing campaigns, generate malicious content or industrialise target reconnaissance — is changing the scale of the threat for all organisations, regardless of their sector. In this constantly evolving digital environment, having formalised governance is no longer an option; it is a necessity for every organisation.
A certification consistent with our business
Our methodology is structured around five main phases, and we followed them for ourselves exactly as we do for our clients, because we did not want to be “the shoemaker whose children go barefoot”:
The initial assessment consists of a comprehensive review of our organisation against the requirements of ISO 27001. This gap analysis results in a diagnostic report and a prioritised action plan, including an estimated timeframe for achieving certification.
It was at the end of this stage that we selected our certification body, a decisive choice for what followed; we will come back to this point below.
Next came the compliance phase: the concrete implementation of the necessary measures, processes and policies, with a pragmatic approach and without unnecessary documentation overload — the same approach we apply with our clients.
The audit preparation phase followed: document review, internal mock audits, team training and simulated interviews with external auditors, in order to maximise our chances of obtaining certification during the first audit.
Once certification has been obtained, the work does not stop there: we now ensure the ongoing maintenance of our management system through our own DPO, CISO & ISMS Manager services, annual surveillance audits, regulatory monitoring and continuous improvement of our management system.
Is ISO 27001 certification sufficient to guarantee a good level of security?
This is a legitimate question, and the honest answer is: not entirely, on its own.
The ISO 27001 standard requires organisations to establish governance that enables them to identify and assess their information security risks. This is already a major step forward for many organisations. However, the standard leaves significant room for decision-making by management or the board of directors, which can choose to accept high risks rather than address them.
In other words, ISO 27001 structures the risk management approach, but:
- it does not impose a minimum level of security maturity;
- it does not define specific mandatory technical measures.
This is an important distinction compared with other, more prescriptive frameworks, such as the Swiss Cyber-Safe label, or recognised frameworks such as the NIST Cybersecurity Framework and the CIS Controls, which detail specific technical and organisational controls to be implemented. ISO 27001 is more focused on governance and risk management than on a technical checklist approach.
For this reason, we often recommend that our clients consider ISO 27001 as a solid foundation, to be complemented by more operational frameworks depending on their context and level of maturity.
Along the same lines, this foundation naturally calls for an extension into the field of artificial intelligence. ISO/IEC 42001, published in December 2023, is the first international standard dedicated to AI management systems. It provides a framework for the responsible development, deployment and operation of these technologies, applying the same principles of governance and risk management as ISO 27001, this time to the specific risks associated with AI. Several of our clients have already embarked on this journey once their ISMS has been stabilised — an evolution we are following closely and towards which we are also moving.
Are all ISO 27001 certifications equal?
No, and this is a point that is too rarely explained to organisations. The value of an ISO 27001 certification depends directly on the rigour of the certification body that carried out the audit, and especially on the organisation that accredited the certification body itself.
In Switzerland, accreditation of certification bodies is carried out by the Swiss Accreditation Service (SAS), which is part of the State Secretariat for Economic Affairs (SECO). The SAS is responsible for the assessment and accreditation of certification bodies and other conformity assessment bodies, and makes its accreditation decisions independently and sovereignly, in accordance with the applicable national and international requirements. Being accredited by the SAS therefore provides a strong guarantee of the certification body’s professionalism, technical competence and impartiality.
However, some organisations turn to certification bodies, particularly foreign ones, whose audit requirements may be significantly less stringent than those imposed on SAS-accredited bodies. The result carries the same name — “ISO 27001 certified” — but does not necessarily reflect the same level of audit rigour or credibility.
This is precisely why we are particularly proud to have undergone our audit with SQS (Swiss Association for Quality and Management Systems), a Swiss certification body accredited by the SAS. Beyond the accreditation itself, what made the difference for us was the profile of the SQS auditors: experts who are equally comfortable with the organisational and documentary aspects (policies, procedures, governance) and the technical aspects (architecture, configurations, concrete security measures). Combining these two areas of expertise within the same auditors is rare in the industry; many certification bodies are strong in one area and lighter in the other. This enabled us to benefit from a demanding audit that genuinely reflected our level of maturity, both in substance and in form.
What does this certification mean for what comes next?
This certification is not an end goal, but a milestone. It commits us to continuing to implement only high-quality elements that are consistent with our values and our corporate identity, and to continuously evolving our own security governance, in line with what we recommend to our clients.
Would you like to learn more about our ISO 27001 approach or receive support with your own certification project? Please feel free to contact us: our team will be happy to discuss your specific context and challenges with you.
Sources
- Swiss Accreditation Service (SAS) / SECO — seco.admin.ch
- ISO/IEC 42001:2023 — International Organization for Standardization
