How We Achieved ISO/IEC 27001 Certification at LANARS

Information security has always been at the core of how we work at LANARS. As our projects grew in scale and sensitivity, it became increasingly clear that we needed a more formalized and systematic approach to protecting data — both our own and that of our clients. The journey toward ISO/IEC 27001 certification was not easy, nor was it quick. But it was absolutely worth it. Here's how we got there.

 

Why We Decided to Pursue ISO/IEC 27001

As a company that delivers both software and hardware development — often for complex, high-stakes environments — we understood that the cost of a security lapse could be catastrophic. Not just financially, but in terms of trust. Over the years, our client base has grown to include institutional partners such as UNICEF and the Ministry of Social Policy of Ukraine. These organizations demand the highest level of information security.

 

We realized that, although we already had many best practices and procedures in place, they weren’t fully documented, standardized, or formalized. In other words, the knowledge lived in people — not in an information security management system (ISMS). That had to change.

 

Choosing ISO/IEC 27001 — the world’s leading standard for information security — felt like a natural next step. Our goal was not just to check a compliance box, but to build a sustainable system that reinforces trust, reduces risk, and matures with our company.

 

It Was Harder Than I Thought

I’ll be honest: I underestimated the process. Initially, I thought it would be more bureaucratic than practical — something we could complete within a month, collect the certificate, and move on. I imagined a well-documented checklist and a few meetings.

 

Reality was very different.

 

Getting certified was a deeply involved process that took four months of focused effort, coordination, and hundreds of working hours from multiple team members. It challenged us to rethink how we manage risk, structure processes, assign responsibilities, and track performance. It also demanded full commitment from top management down to operational teams.

 

Building Our ISMS

One of the most important early decisions we made was to bring in external expertise. We hired a professional consulting firm to guide us through the process. That was crucial. Their input helped us interpret the ISO requirements and tailor them to the realities of our company, culture, and clients.

 

Internally, we formed a working group that became the ISMS committee. I was part of it myself, along with our CTO, Chief of Delivery, Head of Project Management, Head of DevOps, and Head of HR. Together, this team represented a cross-section of LANARS and ensured that every key department was involved.

 

Our ISMS work included:

 

• Mapping existing security procedures and identifying gaps.

 

• Defining the scope and context of our ISMS.

 

• Conducting a thorough risk assessment.

 

• Documenting policies, controls, and operational procedures.

 

• Building out incident response and business continuity processes.

 

• Setting up continuous monitoring and regular audits.

 

We didn’t reinvent everything from scratch. In many cases, we adapted and formalized what was already happening. But we also had to add new layers of discipline, accountability, and documentation — especially around access control, employee onboarding/offboarding, risk evaluation, and vendor management.

 

The Human Factor

One of the key lessons from this process was just how human-centered information security really is. While the standard talks about controls and frameworks, at the end of the day, it's about people. How they act. How they make decisions. How aware they are of the risks in their daily work.

 

That’s why we emphasized internal awareness and training as part of our ISMS. It wasn’t just about writing policies — it was about changing habits, introducing a security mindset, and helping our team understand why these measures matter.

 

We also had to manage a delicate balance: improving security without slowing down development or innovation. That required collaboration, flexibility, and compromise — especially between tech teams and compliance teams.

 

The Certification Audit

After completing the implementation phase, we invited an external auditor to perform the certification audit. This was a rigorous, multi-day process that evaluated our documentation, reviewed our procedures, and tested our readiness in different real-world scenarios.

 

It was intense, but also validating. The auditor highlighted several areas where we had gone above and beyond the minimum requirements. At the same time, they gave us constructive feedback for further improvement, which we welcomed.

 

Receiving the final certification was a proud moment for all of us. It wasn’t just a piece of paper — it was a milestone that reflected months of hard work, alignment, and evolution.

 

The Outcome — and What’s Next

Today, we are proud to be an ISO/IEC 27001-certified company, and even more proud of the culture shift that this journey sparked. We now have:

 

• A structured and documented ISMS that aligns with international best practices.

 

• A deeper understanding of our risks — and how to mitigate them.

 

• Stronger internal alignment around security responsibilities.

 

• Increased trust from enterprise and public-sector clients.

 

• A solid foundation for future audits, compliance initiatives, and scale.

 

But this isn’t the end of the story — it’s just the beginning.

 

Security is not a one-time achievement. It’s a continuous process of monitoring, improving, and adapting. As threats evolve and our business grows, we’ll keep revisiting our ISMS, expanding its scope, and refining how we work.

 

Final Thoughts

To other companies considering ISO 27001: don’t underestimate the effort, but don’t hesitate either. This process will challenge you — but in the best possible way. It forces you to grow up, get organized, and treat security as a company-wide responsibility.

 

To the team at LANARS: thank you. Without your dedication, openness, and attention to detail, this would not have been possible. Special thanks to the members of our ISMS committee and everyone who contributed their time and expertise — even while juggling daily work and project deadlines.

 

This certification is a win for all of us — and for every client who trusts us with their data.