Passing ISO 27001 on technical controls

The starting point

The company was making technology decisions without a technical voice in the room. It needed ISO 27001 but had nothing structured to certify. There was no central identity provider, no device management, no endpoint protection and no documented access control. Each tool had been adopted ad hoc as the company grew.

The risk

Auditors do not accept policies on paper when nothing technical enforces them. Every month without controls made the estate that would need retrofitting larger.

What we built

We designed the control set and built the tooling end to end. Identity runs through Okta with lifecycle automation. Devices are enrolled in Intune with compliance policies enforced at login. SentinelOne runs on every endpoint. DNS filtering meets the web access control requirements, and access reviews run on a schedule instead of as a one-off exercise.

Everything was built as infrastructure and handed over as code repositories, with documentation that maps each control to its ISO 27001 Annex A requirement.

The result

When the auditor arrived, they walked through live controls instead of a policy binder. Enrolment records, endpoint compliance data, access review logs and DNS filtering settings were all available, because they are how the estate is run.

The nine months were set by the client's work on HR policies and documents. The technical controls passed on what was enforced and evidenced.