ISO 27001 Implementation Case Study: UK Event Tech Platform Certified in 5 Months

An event tech platform holds a lot of attendee personal data and handles card payments, so it falls under several sets of rules at once. UK GDPR compliance covers how it collects and stores attendee data. PCI DSS compliance covers card payments. ISO 27001 and Cyber Essentials are what customers and partners ask for to prove the platform is secure. Running four frameworks in parallel is a full-time job, and the client's team needed to keep building the product.

Why this matters in event tech: corporations, associations and agencies check a platform's security before they sign. Their procurement teams send security questionnaires and often make ISO 27001, or SOC 2 for US buyers, a condition of the contract. The market leaders, including Cvent, Swapcard and Bizzabo, all hold ISO 27001. For UK public-sector events, Cyber Essentials is required for many government contracts. Without these certificates, a platform can lose a deal at the procurement stage, however good the product is. With them, the security review becomes a formality, and the platform can compete for the same enterprise contracts as the biggest players.

Solution

We worked as the client's managed compliance team, from scoping to certification. This is how our managed compliance services work: compliance as a service, so the client's own team did not have to run the program.

• Vanta implementation. We set up Vanta and connected it to the client's systems, so evidence for all four frameworks was collected in one place and kept up to date.

• Policies and documentation. We wrote the security and data protection policies and the records each framework requires.

• Access control and logging. We set up access controls, regular access reviews and audit logs, so the client can show who accessed what, and when.

• Penetration testing. Before moving to certification, we ran penetration testing on the platform to find vulnerabilities before an auditor, or an attacker, could. This step mattered for three reasons. PCI DSS requires penetration testing at least once a year and after significant changes (requirement 11.4), so a platform that takes card payments cannot skip it. ISO 27001 auditors expect evidence that technical vulnerabilities are found and fixed, and a pen test report is the clearest proof. And enterprise event organisers often ask for a recent pen test report in their security questionnaires. Testing before the audits meant the issues were fixed in advance, and the report became evidence instead of a surprise.

• Fixes in the code. When the gap analysis and the penetration tests found issues in the product, our engineers fixed them directly, so the client did not need a second vendor.

Frameworks

• ISO 27001

• Cyber Essentials

• UK GDPR

• PCI DSS

Result

The client achieved ISO 27001 and Cyber Essentials certification in five months, with UK GDPR and PCI DSS requirements covered. One set of controls and evidence in Vanta now supports all four frameworks, and the client's engineers stayed focused on the product.

Need help with compliance? Tell us which certificates your customers ask for, and we will tell you what it takes.