ISO 27001 from scratch at a manufacturing company

The company manufactured components for an enterprise customer that had tightened its supply-chain requirements: ISO 27001 certification within twelve months, or a gradual loss of orders. Until then, security had been the diffuse responsibility of a three-person IT team. There was no reliable asset inventory, backups were never tested, and the office and plant networks shared a single segment.

The board had a legitimate concern: that the project would become a graveyard of policies with no real effect. Our condition was the opposite — every control implemented had to leave operational evidence that someone could show an auditor without preparing anything the week before.

We worked in five phases, each with deliverables closed before opening the next:

1. Gap analysis against ISO/IEC 27001:2022 — all 93 Annex A controls assessed on site, not by questionnaire. Result: 68% of applicable controls had no recognisable implementation.
2. Inventory and risk assessment — an asset inventory built from scratch (servers, endpoints, production lines with embedded IT, unmanaged SaaS) and a risk methodology approved by the board, with explicit acceptance thresholds.
3. ISMS design and Statement of Applicability — policies and procedures written in the company's own language, with named owners per control. The production-line electronics were excluded from scope with a documented rationale; the plant IT perimeter was included.
4. Phased implementation — first whatever reduced real risk (office/plant segmentation, MFA, backup management with restore tests, access and leaver management), then the documentation layer. Role-based training rather than generic awareness.
5. Internal audit and certification support — a full internal audit six weeks before the certification visit, with fifteen deviations found and closed before the certification body arrived.

Beyond the certificate: the plant network is now segmented from the office network, backups are restore-tested monthly with records kept, and the security committee meets quarterly around a dashboard the board actually understands. The enterprise customer kept its orders, and the company now uses the certificate as a commercial argument with new clients.