ISO 27001 case study: a BPO provider protecting client code, data and its own intellectual property

The organisation and what it needed

The organisation in this ISO 27001 case study is a BPO provider whose clients hand over more than routine work. They entrust it with their source code and their data, which means a single lapse could expose material that belongs to someone else.

The provider faced two obligations at once. It had to safeguard the intellectual property of every client whose code and records passed through its hands, and it had to protect its own intellectual property as well.

The organisation is not named here, and this account keeps to what its case record states.

What was implemented

The provider put in place controls based on ISO/IEC 27001, the international standard for an information security management system. The case record describes the work at that level: an ISMS whose controls were aimed squarely at the three risks the business cared about most, namely breaches, unauthorised access to systems and information, and the theft of intellectual property, whether the client's or its own.

With the controls in place, the provider went on to certification. Under ISO/IEC 27001, that decision is taken by an independent certification body after its own two-stage assessment, not by the organisation or its consultant.

What changed

The first change was in exposure. The ISO/IEC 27001 controls sharply cut the risk of breaches, unauthorised access and intellectual property theft, the very threats that had made the project necessary.

The second change was in how clients saw the business. Certification demonstrated a firm commitment to information security, and that commitment attracted security-conscious clients. In turn, the certificate supported the company's growth.

The third change was cultural. Its chief technology officer said the certificate showed clients that their code and data were in careful hands, and that security has now become part of the company's software DNA.

About ISO/IEC 27001

ISO/IEC 27001 sets out how an organisation governs the confidentiality, integrity and availability of the information it holds. The current edition is ISO/IEC 27001:2022, read together with Amendment 1:2024, which asks organisations to consider whether climate change is a relevant issue. Certificates issued against the 2013 edition lapsed on 31 October 2025, so a valid accredited certificate today names the 2022 edition.

The standard does not hand every organisation the same fixed checklist. It requires a risk assessment against criteria the organisation defines, a decision on how each risk will be treated, and a comparison of the chosen controls with Annex A, whose 93 controls fall into organisational, people, physical and technological themes. The result is recorded in a Statement of Applicability.

Certification is the job of an independent body accredited to ISO/IEC 17021-1 and ISO/IEC 27006-1. It carries out a Stage 1 readiness review and a Stage 2 audit, then returns for surveillance audits in the following years.

How Sterling runs a programme like this

The description below is how Sterling approaches ISO/IEC 27001 programmes in general; it is not an account of this particular client's engagement. Every programme starts with a gap analysis that compares existing policies, controls and records with the standard, keeps what already works and sets an action plan with owners and dates.

Design™ and Drive™ are alternatives: an organisation chooses the one that fits its capacity rather than moving from one to the other. Either way, the engagement includes Effivity, the ISMS software used in 50+ countries, at no additional cost, together with a vulnerability assessment and internal auditor training for your audit team, as applicable to your standard.

ISO/IEC 27001 for BPO providers: questions buyers ask