Certification-ready security for a global manufacturer.
Confidential global manufacturer
3 Min
The case study in 30 seconds
Sensitive customers, factory sites worldwide and a certification to earn.
A manufacturer with factory sites around the world and security-sensitive customers needed to prepare for cybersecurity compliance and certification. The objective was to build an information security management system (ISMS): the policies, controls and processes a company uses to manage security risk and prove it does.
In three months, Arenema developed 85 new policies, standards and templates, ran a complete cybersecurity audit of the R&D department, built the roadmap to certification and linked the documentation to the company’s risk management tool.
The company now has a documented framework, a prioritised plan for its R&D risks and a clear route to certification.
The challenge
Eight standards. One framework.
Expectations came from several directions: information security, cloud services, personal data, EU regulation, US defence requirements and industrial control systems. The framework had to cover:
- 01ISO/IEC 27001, 27017 and 27018, for information security management, cloud security controls and personal data in the cloud
- 02The EU NIS2 Directive and the EU Cyber Resilience Act
- 03The CIS Critical Security Controls
- 04CMMC Level 1, the US Department of Defense’s foundational cybersecurity maturity level
- 05IEC 62443, for industrial and operational technology security
The aim was one framework that answers to every standard, rather than a separate effort for each.
Our approach
Write it, test it, plan it, embed it.
Arenema treated the ISMS as one body of work rather than eight compliance projects: documentation for the whole framework, an audit of the R&D department, a roadmap to certification, and training so the framework would be used, not just filed.
01. Policies
85 policies, standards and templates in three months
The documents an ISMS rests on, covering the standards the company needed to meet.
02. Audit
A complete cybersecurity audit of R&D
Every finding came with a severity rating and a place on an action roadmap, so the most serious gaps can be tackled first.
03. Certification
A roadmap to certification
A complete certification roadmap, including the plan for internal audit.
04. Risk management
Linked to OneTrust
Documentation was linked with OneTrust, the company’s risk management tool, so policies and risks sit in the same system.
05. Training
Training and awareness
Arenema worked with teams on training and awareness content, including new training material.
What three months delivered.
A complete documentation set, mapped to every standard in scope.
85
policies, standards and templates
3months
to deliver them
8
standards and frameworks covered
The outcome
A framework the company can certify against.
The manufacturer now has an ISMS mapped to the standards its customers and regulators care about, an audited view of its R&D risks with clear priorities, and a roadmap that takes it through internal audit to certification.
Because the documentation is linked to its risk management tool and supported by training, the framework can be kept up to date as the business and the regulations change.
Next projects
Featured stories
Every organisation faces different technology challenges. Let’s explore how we can help you move forward.