ISO 27001: How Datami Achieved Certification and Prepares Clients for It

If your company is in the running for ISO 27001 certification and you are wondering what to focus on, Datami can put some of that in perspective. We have been there ourselves: in a six-week period we made ready and were issued ISO/IEC 27001:2022 certificates for two of our legal entities. Here we put down our experience of the process and talk about the results and challenges of certification. We also draw on client projects as examples of how we go about getting other companies in order for an independent audit.

When commissioning a penetration test, a company puts its systems, applications, and infrastructure in the hands of outside specialists. The client should be concerned with more than the contractor’s ability to spot vulnerabilities; how the firm goes about safeguarding the data it is given is of equal importance.

We help businesses identify cyber risks and strengthen their security every day. We also prepare companies for independent information security audits. But in 2026, we found ourselves in our clients' position: we decided to confirm that our own information security management system complies with the international ISO 27001 standard.

On September 30, 2026, Datami LLC (Ukraine) and Datami OÜ (Estonia) obtained ISO/IEC 27001:2022 certificates. Behind this achievement were six weeks of teamwork, an independent penetration test of our platforms, and a review of how our internal security policies are followed in practice.

What Is ISO/IEC 27001:2022 and What Does Certification Confirm?

ISO/IEC 27001 is a globally recognized standard that specifies what an organization needs to implement an information security management system (ISMS).

An ISMS is more than a security program in its own right or some documents put together for the benefit of auditors. Rather, it is a system by means of which a company can spot information security risks and put in place the relevant policies, delegate the appropriate responsibilities, and see to it that there is compliance with those policies.

The ISO/IEC 27001:2022 edition updated the list of security controls in Annex A. These include specific controls addressing cloud service security, threat intelligence, and data leakage prevention.

In practice, compliance with the standard means that a company systematically manages risks, controls access to information, protects assets, works with suppliers, responds to incidents, and improves its security processes.

At the same time, ISO 27001 does not require all organizations to implement identical technical solutions. Specific controls are determined based on the risks, the company's activities, and the scope of certification.

An ISO 27001 certification is the confirmation from an independent body that an ISMS has been evaluated and found to be in line with the standard’s requirements for a given scope. While it cannot vouch for a lack of vulnerabilities or cyber incidents, it does attest to the existence of a systematic method for managing information security. 

The independent certifier will have verified compliance and put out a certificate to that effect, detailing the party certified and the extent of the coverage.

Here are the key details of Datami's certificates:

Both certificates we obtained cover the provision of cybersecurity services, including penetration testing:

Datami LLC (Ukraine) – ISO/IEC 27001:2022, № UA-ISMS-300926-1.

Datami OÜ (Estonia) – ISO/IEC 27001:2022, № EE-ISMS-300926-2.

Why Datami Decided to Pursue ISO 27001 Certification

For a company providing cybersecurity services, protecting client information is part of everyday work. Yet large international clients often need more than a supplier's assurances about the reliability of its internal processes.

Banks, fintech companies, and corporate clients assess contractors' information security before starting a partnership. For them, this is not only a matter of trust but also of supplier risk management. In particular, European regulatory requirements such as DORA and NIS2 are increasing the focus on the security of ICT contractors and supply chains.

We regularly encounter ISO 27001 requirements in banking tenders and during negotiations with large international companies. Some prospective clients will only work with companies that hold the relevant certification. Without it, even an experienced contractor with a strong portfolio may fail to pass the selection process.

Therefore, this certification became a way for us to independently confirm that Datami's ISMS complies with the international standard and gain access to new opportunities for cooperation.

One ISMS for Two Legal Entities

The distinctive feature of our project was that two related companies underwent certification: the Ukrainian Datami LLC and the Estonian Datami OÜ.

They operate under a shared ISMS, so we organized a single certification process for both legal entities.

The system covers cybersecurity service delivery processes, as well as employees, contractors, and partners who have access to corporate services. At the same time, the organizational conditions differ:

• Datami LLC (Ukraine) – a team based in Ukraine, an office, local IT assets, and operational processes.
• Datami OÜ (Estonia) – a remote team, European contractors, and cloud infrastructure.

We needed to ensure consistent information security management across both companies while taking into account the specifics of their operations.

How We Prepared for Certification in Six Weeks

We began preparations in August 2026. Datami already had internal security policies in place, and our team had experience preparing other companies for ISO 27001. Therefore, the task was not to build all processes from scratch, but to systematize them, address gaps, and prepare evidence for independent auditors.

The project involved the CISO, Blue Team Lead, Compliance Officer, and Chief Growth and Revenue Officer. Other employees were brought in as needed.

We organized the work into four main areas.

1. Defined the Scope of the ISMS and Assigned Responsibilities

First, we documented which services, information assets, processes, and resources were covered by the shared ISMS of the two legal entities.

Next, we assigned people responsible for each area of preparation: documentation, risk management, technical security controls, and internal reviews.

This allowed us to distribute the work among specialists and coordinate the teams' activities within a single certification process.

2. Systematized Policies and Documentation

Datami already had internal instructions and security policies in place, but some of the documentation was scattered across different locations.

We reviewed, organized, and refined it, and assigned responsibility for individual processes. In particular, we updated device security policies, password management and authentication policies, and documented incident response procedures.

After that, we checked whether the documented rules reflected the company's actual operations. A written policy alone won't satisfy certification requirements. The company needs to demonstrate that its procedures are followed in everyday operations.

3. Strengthened Technical Security

We paid particular attention to the security of corporate communications, including email and work chats.

We also reviewed and improved the protection of our cloud infrastructure and data storage processes.

In addition, we organized an independent penetration test of our own platforms. We engaged external specialists for this purpose, as having the same team assess its own systems would not have provided the necessary independence of the evaluation.

4. Assessed Team and ISMS Readiness

We conducted training in each department using previously prepared internal materials.

We then arranged an internal ISMS audit, followed by a management review of the findings.

This helped us verify whether all processes were properly documented, whether responsible individuals had been assigned, and whether evidence of compliance with established procedures was available.

Internal ISMS audits and management reviews also became established procedures within the company.

How Datami's Independent ISMS Audit Was Conducted

BALTUM BÜROO OÜ of Estonia was our selection for independent certification. 

While we gave some thought to other bodies, the experience and reliability of BALTUM, along with the know-how of its specialists and ease of communication, made it the better option. 

The audit covered both Datami LLC and Datami OÜ in a joint process. The audit took up to two weeks, including the initial review, time for necessary improvements, and the final audit.

Stage 1: Documentation and Readiness Review

The auditors of BALTUM BÜROO OÜ began with a review of the ISMS documentation and the certification scope as defined, in addition to gauging the company’s preparedness for the principal assessment. 

They examined the policies, procedures, allocation of responsibilities, and evidence that the ISMS had been implemented.

Stage 2: Review of Actual Processes

The attention then turned to the practical application of the rules on record. In their review, the auditors did not confine themselves to the documents; they also ascertained if the employees in charge had a grasp of the set procedures and could put forward proof that they were being put into effect. 

We were required to supply registration papers and contracts along with evidence of internal processes at work, verification that document storage and handling were secure, and some photographs of the physical security in place at the office and its environs.

What Proved Most Challenging

Documentation required the most time and attention: every document had to accurately reflect the company's operations, and its provisions had to be reviewed and approved by management. This required the involvement of key specialists who were simultaneously continuing their work on client projects.

Support from other employees helped: they took on individual tasks and partially reduced the workload of colleagues involved in compliance matters.

We aimed to achieve certification on the first attempt, so we paid particular attention to details to ensure nothing was overlooked.

What Recommendations Did We Receive?

The independent audit identified no critical nonconformities. At the same time, the auditors provided several recommendations on what could be further improved in our ISMS, including:

• Separating the Statement of Applicability for each legal entity.
• Expanding the information asset register and organizational structure.
• Formalizing evidence of regular access rights reviews.

We implemented all the auditors' recommendations.

What Changed at Datami After ISO 27001 Certification

For us, what matters is not only the two certificates we obtained but also the practical results of the preparation process and independent audit.

The last result is particularly valuable to us.

Previously, our compliance specialists had practical experience undergoing such audits. Now, all key participants in the preparation process have gained this experience. They have a better understanding of what questions arise during certification, which processes require the most attention, and what challenges clients may face.

Oleksii Lavrenchuk, Chief Growth Officer (CGO) at Datami, comments:

"Obtaining ISO 27001 certification confirms that we operate according to the same standards that are required of our clients. Regulated banks and fintech companies are required to assess their contractors, so it is important for Datami to meet actual market requirements. Our experience helped us complete this process on the first attempt. We will continue to use this experience to help our clients prepare effectively for independent audits."

Certification does not mean that the work on information security is complete. An ISMS requires regular risk reviews, process monitoring, and continuous improvement.

For us, this project was an opportunity to see ISO 27001 preparation from a different perspective.

Our work with clients in getting them ready for independent audits has given us considerable experience. We have put our own certification process to use as a way of building on that, having been through it from the inside out, be it in the organization of our internal affairs or in dealing with auditors.

How Datami Helps Companies Prepare for ISO 27001 Certification

We would do well to make the division of roles clear at the start. Our part is to have companies ready for certification, yet we are not in the business of issuing ISO 27001 certificates. That is left to an independent body which will carry out the audit and determine if the ISMS is up to standard.

A company may have modern security tools in place but lack properly organized documentation. Or the opposite may be true: policies have been written and responsible individuals assigned, but no one has assessed how effectively the established security controls work.

The extent of ISO 27001 preparation is a function of the ISMS as it stands. In some cases, an organization will have to put in place new documentation, put processes into effect, or shore up technical security; for others, it is sufficient to close certain gaps. 

Datami can be of help at various points along the way, whether for a readiness assessment or in making ready for an external certification audit.

1. Assess Readiness and Identify Gaps

We begin preparation not by writing new policies, but by reviewing what is already in place.

We analyze internal documentation, risk management, access control, incident response, and other information security processes. We compare the company's current approach with ISO 27001 requirements and highlight anything that needs to be addressed.

For example, during a security policy audit for a fintech company, our team reviewed seven policies. The work included assessing documentation against information security requirements, including ISO 27001, and identifying areas for improvement.

An audit of this kind is useful in resolving the practical matter of which rules are in effect, what is not there, and what changes should be put in place first. 

The company is then left with a sound basis on which to plan its preparation as opposed to a mere inventory of documents to be produced.

2. Develop Policies and Help Implement an ISMS

Datami helps companies develop information security policies and implement an ISMS in accordance with ISO 27001 requirements. This work may include assigning responsibilities, establishing processes for risk management, access control, incident response, and preparing the necessary documentation.

The scope of work depends on the initial state of the ISMS: one organization may need to develop policies and implement processes from scratch, while another may need to update documentation, align existing practices with the standard's requirements, and prepare evidence of compliance.

3. Implement Technical Security Controls

Depending on the organization's risks and needs, Datami helps configure access controls, security event monitoring, and improve incident response.

For example, during the SOC implementation for an IT company, our team configured centralized security event monitoring and incident response processes. As part of the project, we implemented 47 threat detection scenarios and 25 response scenarios. According to the assessment conducted within the project, compliance with ISO 27001 requirements increased from 32% to 94%.

During the implementation of Cloudflare Zero Trust and Wazuh SIEM for a SaaS company, we helped organize secure access to resources and centralized monitoring. We set up 55 SIEM scenarios for the purpose of flagging any suspicious activity.

These are technical controls that go some way to harden the defences of information systems. For ISO 27001 compliance, however, they need to be part of a broader mix of risk management, policies, and other information security procedures.

4. Assess the Effectiveness of Technical Security

Implemented security measures need to be tested in practice. To do this, we conduct cybersecurity audits and penetration testing. These assessments help identify vulnerabilities, configuration issues, and weaknesses in security controls that need to be addressed. The organization's risks, infrastructure characteristics, and requirements determine the need for and scope of these assessments.

For example, during an Azure security audit for a government platform, our team reviewed cloud infrastructure configurations. We identified 12 vulnerabilities, and addressing them helped ensure compliance with the requirements.

Technical assessments are also useful when a company has already implemented the necessary security measures and wants an independent evaluation of their effectiveness. Penetration testing helps assess systems' resilience against real-world attacks and provides test results for preparation for a certification audit.

For example, as part of a blockchain company's preparation for ISO 27001 certification, the Datami team conducted grey-box penetration tests of the website and API. The assessments found no critical or high-severity vulnerabilities. After retesting, Datami confirmed that all other identified findings had been remediated. These assessments formed part of the company's comprehensive preparation for certification, which it successfully completed, obtaining ISO/IEC 27001 certification.

5. Support the Internal ISMS Audit

Once the documentation is prepared and the necessary processes are implemented, the remaining task is to verify whether the company is ready to demonstrate them to independent auditors.

A key and mandatory stage of preparation is the internal ISMS audit. It allows the company to assess the system's compliance with the standard's requirements, identify issues that need to be addressed before the external audit, and determine the necessary corrective actions.

The Datami team provides informational and organizational support during such an audit.

4 Tips for Companies Seeking Compliance Certification

Based on the lessons learned from our client projects and our own certification experience, we would like to share a few practical recommendations for those planning to undergo an independent audit:

1. Start With a Gap Analysis, Not Policy Writing

Don't rush to create new documents or implement security tools. First, understand what is already working in your company and what is missing to comply with ISO 27001. Review existing policies, processes, and security controls, and assess risks. This will help you set priorities, avoid spending resources on unnecessary work, and focus on changes that truly matter.

2. Make Sure Your ISMS Works Beyond Paper

Even perfectly written policies won't help you achieve certification if employees don't follow them. Therefore, make sure to assign responsible individuals, establish access, risk, and incident management processes, and train your team to follow the established rules. These processes need time to become operational, and the company needs time to collect evidence that they are being followed.

3. Don't Leave Readiness Assessments Until the Last Minute

One should not have to wait for the certification audit to find out where the problems lie. Put in place an internal ISMS audit and a management review beforehand and deal with any nonconformities that turn up. It is not enough to put documents in front of the auditors; you must be able to show them how your security controls are put to work as well.

4. Don't Rely Solely on Your Own Security Assessment

A system’s weaknesses can be missed by an internal team, no matter how seasoned they are in their daily work with it. For this reason, there is value in the input of external specialists. 

With an outside view, one can make a more objective appraisal of security and go about reviewing technical controls, policies, and processes to spot any deficiencies and what should be put right. While this is not a substitute for the required internal ISMS audit, it serves to put additional risks on the table ahead of time.

Our Own ISO 27001 Certification Experience Benefits Our Clients

Preparation is not just about developing policies and passing an audit. It is important to build an information security management system that works every day, helps manage risks, and protects the business.

Datami knows this process from both sides, as we have undergone independent certification ourselves and help clients prepare for it. Our team understands how important it is to consider the specifics of each company, including its risks, processes, and initial level of readiness. That is why we begin compliance audit preparation projects by assessing the client's current information security posture, identifying gaps, and helping plan the next steps.

For those with plans to get ISO 27001 certified and who would like to gauge their company’s readiness, we are on hand to talk through your requirements and put you in a position to be audited by an independent party.