Telviva has achieved ISO/IEC 27001:2022 certification, marking a significant milestone in its commitment to information security. The company’s path toward certification began five years ago, initially sparked by a client who required a rigorous security audit.
As an increasing number of organisations seek business partners who are ISO-certified or aligned, Telviva undertook this extensive multi-year effort to secure the certification, which demonstrates that corporate and customer data remains secure, accessible, and fully protected. Ultimately, this achievement serves a vital purpose: building trust with customers and commercial partners by demonstrating a verified ability to manage and store their information properly.
ISO/IEC 27001:2022 is the premier, globally recognised standard for Information Security Management Systems (ISMS), and is fundamentally about operational consistency: “writing down what you do and doing what you write down”.
The wide-reaching standard mandates that an enterprise establish clear policies and processes spanning access control, asset management, business continuity, disaster recovery, human resources, and risk assessment. Additionally, it requires formal change management, IT operations guidelines covering incident management, mobile device policies, remote working guidelines, information classification and handling protocols, and secure coding policies for internally developed software. Preparing for certification required significant effort and financial investment across the entire organisation.
Key Controls for ISO Certification
The updated ISO/IEC 27001:2022 standard incorporates 93 controls organised into four simplified thematic categories:
- Organisational Controls: Cover overall policies, identity management, asset classification, and the return of assets.
- People Controls: Encompass remote working guidelines, thorough employment screening, and confidentiality agreements.
- Physical Controls: Focus on security perimeters, physical facilities monitoring, equipment protection, and eco-disposal of assets.
- Technological Controls: Focus on access control, cryptography, endpoint protection, and cloud security.
Practical changes implemented at Telviva
To ensure a smooth and seamless transition, Telviva implemented its operational changes incrementally over a three-year period. Among the primary improvements was the formalisation of change management procedures and the deployment of mobile device management to track authorised devices accessing the network.
To guard against cyber threats, the company introduced daily vulnerability scanning in partnership with a security vendor alongside regular penetration testing to proactively identify and address issues. These technical measures were strengthened through employee security awareness training, updated remote working guidelines, and stricter device security practices, transforming Telviva into a far more secure environment.
Securing ISO/IEC 27001:2022 certification yields substantial advantages for both Telviva and its clientele. While certification does not eliminate vendor security questions during RFP processes, it provides a structured framework that serves as an easier, trusted starting point. Existing and prospective clients immediately know that Telviva maintains – and rigorously enforces – verified policies regarding information security management.
For customers, knowing that their data is stored within a systematically protected environment provides peace of mind and reassures them that their valuable assets are safeguarded. Above all, opening up operations to rigorous external evaluation continually reinforces the foundation of customer trust.
Continuous Improvement
The ISO/IEC 27001:2022 certification is valid for three years and is supported by annual surveillance audits. An organisation cannot simply achieve certification and rest on its laurels, as a central pillar of ISO standards is continuous improvement.
Telviva drives ongoing progress by holding quarterly ISO meetings among senior leaders in the company to evaluate gathered metrics and operational reports and identify and implement improvements. During each annual surveillance audit, external auditors assess these documented enhancements, probing progressively deeper over the three-year cycle.
This culture of continuous evaluation ensures that Telviva consistently practices what it documents, maintaining a robust security posture and preserving long-term customer trust.
By Antony Russell, CTO at Telviva