What started as a business requirement became a shared commitment to information security. Here’s how the certification project brought our team together and helped make security part of everyday life at Trigrr.
When we first started working towards ISO 27001 certification, we knew it would be a significant project for Trigrr. There were processes to review, policies to formalise and plenty of work ahead of us. What we hadn’t anticipated was how much of the team it would involve, and how quickly security would turn up in everyday conversations.
The initial motivation was quite straightforward. As Trigrr grew internationally, more customers, prospects and partners in our ecosystem were looking for tangible evidence of our commitment to information security. And for good reason: our technology operates at the heart of buildings, connecting systems such as access control, HVAC and other building technologies. It’s our responsibility to protect the systems and information entrusted to us.
Internally, though, the project quickly took on a second purpose. Preparing for certification gave us the opportunity to take a closer look at how we worked, strengthen existing practices and build a more consistent approach to information security across the company.
Looking back, what we value most is the way the whole team contributed to the ISO/IEC 27001:2022 certificate, and what we’ve built together along the way.
Building an ISMS that fits a growing tech company
One of the first challenges was bringing more structure to practices that were already in place. We weren’t starting from scratch. Our teams already had technical safeguards and established ways of working, but not everything was formally documented or consistently managed within an Information Security Management System (ISMS).
The challenge was finding the right balance between structure and agility. We needed policies and processes that met the requirements of ISO 27001, but that also made sense for a growing technology company like ours.
Rather than simply adopting generic templates, we reviewed existing practices, adapted policies to our operational reality and built our own tools to manage security activities, such as in-house risk and event registers, a KPI framework and dashboard, and project tools to maintain the ISMS.
It took quite a bit of back-and-forth. Access management, for example, raised a simple but important question: how do we make sure people only have access to what they need, without making their work unnecessarily complicated? Our first approach was to list every tool and its review schedule directly in the policy. It looked thorough on paper, but we quickly realised it would be difficult to maintain. So we opted for a more practical, risk-based approach: the more critical the system, the more frequently we review who has access. It’s a small example, but it reflects what we were trying to achieve throughout the project: security practices that are both rigorous and realistic.
Security awareness: when security becomes everyone’s business
New policies and procedures rarely get people excited, and we expected to send a few reminders. Instead, colleagues took the training seriously and started flagging potential issues on their own. Our internal security awareness assessment reflected that commitment:
100%
participation across the team
18.1/20
average score
> 75%
scored by every participant
Some signs were harder to measure.
Within a few months, “That’s very ISO!” and “That’s not very ISO...” had become part of our office vocabulary.
🥐 Leave your laptop unlocked when stepping away from your desk, and you might find yourself “croissanté”, our very Belgian way of saying you owe the team croissants (or cookies) the next morning. It’s a running joke, but also a friendly reminder that information security is everyone’s responsibility.
Why cybersecurity matters for connected building systems
One of our favourite examples is our monthly security awareness newsletter.
We follow a structured awareness plan, but we also make room for recent events, emerging threats and topics that resonate with our activities. And the content doesn’t always come from our ISMS Manager. Colleagues suggest topics, contribute ideas or even take the lead in writing an entire edition.
In October, our newsletter featured a rather unexpected story: hacked supermarket refrigerators. A cyberattack had disrupted refrigeration systems across hundreds of French supermarkets, causing significant food losses. In early November, the same method hit supermarkets in Belgium. (source)
For most people, a hacked fridge might sound like a strange cybersecurity story. For a team working with connected building systems, it hits surprisingly close to home. Once physical systems are connected, a digital vulnerability can have physical consequences: in this case, empty freezers and spoiled stock.
That’s why we value these newsletters: they give colleagues a way to link security news to our own work and share what they’ve learned.
Onboarding new colleagues into a security culture
New colleagues are a good test of whether a security culture holds. Before joining Trigrr, new team members receive key information security policies to review and formally acknowledge.
During onboarding, we revisit the essentials together, focusing on why they matter. We explain the systems we work with, the responsibilities that come with our technology and the trust our customers and partners place in us.
What’s particularly rewarding is seeing that these expectations make sense even to colleagues who weren’t part of the certification journey. They understand the reasoning, ask questions and take the subject seriously from their first days, a sign that our security culture doesn’t depend on having lived through the ISO project.
Preparing for the ISO 27001 audit as a team
Our CTO and development team contributed their technical expertise, our CEO supported the initiative and helped maintain momentum, and colleagues across the company made time for reviews and training.
The final weeks before the audit were intense. We were gathering evidence and answering last-minute questions on top of our everyday work, and whenever help was needed, someone stepped up, sometimes with croissants, no penalty required.
" What makes me proud isn’t just passing the audit. It’s seeing how security has become part of the way we work, across every team. The certification makes that commitment visible, but the real achievement is what happens every day. "
What comes after ISO 27001 certification
ISO 27001 certification gave us external recognition and a stronger foundation for managing information security. But maintaining that commitment is an ongoing effort. Risks evolve, technologies change and there’s always something to improve.
What helps is that the framework no longer rests on one person. Colleagues contribute to security awareness, and new team members understand why it matters from day one.
Certification isn’t a finish line, and the work doesn’t pause until the next audit. It goes on every day: new risks are assessed and recorded as they emerge, our KPIs show us where to improve, and the monthly newsletter keeps the whole team up to date on emerging threats. We’re also strengthening how we address information security with the partners involved in our projects, making expectations and responsibilities clearer wherever our platform is deployed.
Our first surveillance audit in September 2027 will be a checkpoint along the way, not a deadline: an independent confirmation that our practices keep improving.
So far, the habits are holding, and so is the croissant supply.
Read also
Trigrr is ISO 27001 certified. Trust is built, not claimed. →
What our ISO 27001 certification means for customers and partners.
