The certification work began with a current-state assessment, reviewing how existing practices, processes, and documentation align with the requirements of ISO/IEC 27001. As the work progressed, it became clear that the largest effort related to documentation. Over the years, a substantial amount of information security–related material had accumulated, and reviewing, structuring, and aligning it with the certification requirements required significant and careful work.
During the process, the Information Security Management System (ISMS) documentation was further developed, and refinements were made to processes, working practices, and policies. The work also led to valuable insights into how information security should be managed as a coherent whole. In particular, practices related to data collection, processing, and monitoring emerged as key areas of focus.
With ISO/IEC 27001 certification, Ambientia’s information security management is now even more consistent and systematic. For example, responding to customer information security requirements has become clearer and more straightforward, and the overall approach is more transparent to external stakeholders as well.
Certification is not an end point, but a solid foundation for continuous development. Information security is a living discipline that will continue to be developed and maintained as an integral part of Ambientia’s ongoing operations.
The certification work was led in particular by Veikko Skurnik and Petri Leppänen, with contributions from several experts across the organization.
