On the road to ISO 27001, and the app that holds the office door

We are getting ready for our ISO 27001 certification. For a company our size, that means taking every habit we have relied on informally and turning it into something written down, owned by someone, and provable to an auditor.

It is a lot of work. It is also the kind of work that makes a company better, and we are enjoying more of it than we expected.

What the preparation actually looks like

ISO 27001 is less about having perfect security and more about showing that you know your risks and manage them on purpose. In practice, our list this autumn looks like this:

• A risk assessment that covers what we build, what we store and who could get at it, with an owner and a decision for each risk.

• Policies we actually follow: information security, access control, acceptable use, incident response, supplier management. Short and specific, not copied from a template nobody reads.

• An asset inventory, so every laptop, phone, cloud account and repository is known, encrypted and assigned.

• Access reviews across our tools, plus offboarding that removes access the same day, every time.

• Security awareness training for everyone, renewed every year.

• Supplier reviews for the services that hold our data or our customers' data.

• Internal audit and management review, so we check ourselves before the auditor does.

We are not doing it alone

Two partners make this far more manageable than it would otherwise be.

Vanta is our compliance platform. It connects to our cloud, code and identity tools, checks the controls continuously and tells us what is drifting before it becomes a finding. Instead of collecting screenshots into a folder the week before the audit, the evidence builds up while we work.

Workstreet is guiding us through the standard itself: what an auditor will look for, what good looks like for a company of our size, and where we can keep things simple without cutting corners. Having people who have done this many times before, and who answer quickly, has been worth a lot.

Thank you both. The support has been excellent.

The penetration test went really well

We have just finished a penetration test of our prioritised products, and the result was great. The testers spent real effort trying to break in, and what came back confirmed that the way we build holds up under pressure. The few observations we got are already being handled as part of our normal work.

For a small team, that result means a lot. Security is something we design in from the first commit, not something we add before a launch, and it is good to have that confirmed by people whose job is to prove us wrong.

The requirement we did not see coming: the office door

The item that surprised us most had nothing to do with code.

ISO 27001 asks you to control and record physical access to your premises: who was in the office, when, and which visitors came by, who they were with, and when they left. A larger company already has reception, badge readers and a visitor book. We had a door, a key and a good memory.

Being a small company, we had never needed any of it. There was no process and no tool. We could have started an Excel sheet and a "please remember to sign in" note by the door. Everybody knows how that goes: it works for a week.

It is worth being clear about who this applies to. Most of our team does not need it at all. Iris, Bob, Reala, Otto, Maeve and Argus live in Slack and have never once walked through the office door. Argus keeps working the night shift at 03:17, and there is no record anywhere of him passing reception. This requirement is only for those of us who are still physical: the ones who need coffee, take up chairs and sometimes forget their keys.

So we built an app instead

With the help of AI, we built our own office registry in an afternoon. We use it every day now.

The iPhone app in the iOS simulator, with demo data.

On the iPhone, the app knows where the office is. When you arrive, you are checked in automatically, and when you leave, you are checked out a few minutes later. The short grace period means a trip to the coffee shop across the street does not count as going home. If you prefer to check in yourself, there are widgets for the Home Screen and Lock Screen, a Control Center toggle and a Siri shortcut, so it is one tap or one sentence.

On the Mac, a small menu bar app checks you in as soon as your work computer joins the office Wi-Fi. You open the laptop and that is it.

Guests are registered in a few seconds: name, company, who they are visiting, badge number, and confirmation that they have seen our visitor and privacy notice. Any colleague can check a guest out, and the app records who did it.

Behind the scenes it does what an auditor wants to see. The log cannot be edited after the fact. Corrections are possible, but each needs a reason, and both the original entry and the correction are kept. Records are deleted automatically after twelve months. Data stays in the EU. Automatic check-in is opt-in, and only colleagues can see who is in. As a bonus, the "who's in the office now" list prints out as a fire roll call.

Faster to build an app than an Excel sheet

This is the part we keep thinking about. Two years ago, nobody would have built a native iPhone app, widgets and a Mac app for a visitor log at a company this size. The sensible answer would have been the spreadsheet, a routine, and a reminder in the Monday meeting.

Today the honest comparison looks different. Agreeing a manual process, writing it down, teaching it and then policing it takes longer than building something that makes the right behaviour the default, and building it took us less time than all of that. Our whole system, from the first commit to the Mac app, was built in one afternoon. We are genuinely grateful for how fast software can be built now, and we still review it and test it like anything else we ship.

Could your company use one of these?

This is what we do for our customers as well. Luminbrane designs and builds web and app products, from internal tools that fix a real problem in an afternoon to customer-facing platforms that have to be fast, secure and certifiable. We bring the product thinking, the UX and the engineering, and we work the way this post describes: quickly, with AI where it helps and people where it matters.

If you have a process stuck in a spreadsheet, or an app idea that has been on the "someday" list for too long, get in touch. We would love to help you build it.