| High Tech

Implementation of the highest cyber security standards (ISO 27001)

Introduction

In an era of increasing data protection requirements, obtaining information security certification is one of the key steps for companies that want to build customer trust and demonstrate compliance with global standards. ISO/IEC 27001:2022 is a universal international standard that specifies requirements for an information security management system.

Successfully passing an audit and gaining certification not only confirms high standards of information protection, but also helps minimize and manage risks while meeting the expectations of large, corporate clients. In this case study, we describe how Toggl, a Software-as-a-Service application provider, carried out a successful implementation and achieved certification through cooperation with dotlaw.

“Thanks to Dotlaw, we were able to not only successfully pass the audit, but more importantly, approach it with the confidence that every detail was taken care of during the implementation.”

Alari Aho CEO, Toggl OÜ

Key results

Full compliance with ISO/IEC 27001:2022 and a solid foundation for the next certification – the SOC 2 Type 2 report.
Optimize the work of SecOps and Legal & Compliance teams, leading to more efficient security management and a reduction in manual activities.
Reduce operational risks associated with information security management.
Increased customer confidence, translating into higher retention, more contracts closed and faster negotiations.
Significant increase in information security awareness within the team.

Customer Profile

Toggl is an Estonian company offering tools in a SaaS model, the best known of which is Toggl Track, a popular time tracking application. Toggl’s team operates 100% remotely, is spread across different countries, and serves thousands of customers worldwide.

In the SaaS industry, where data security and compliance with global regulations are of paramount importance, achieving ISO 27001 certification was a strategic step to enable further growth and win customers in the enterprise sector, regulated industries and companies with exacting standards for vendor verification of information security and data protection.

Challenges

Prior to the implementation , Toggl faced several key challenges:

Lack of sufficiently formalized risk and vendor management processes, which hindered effective control over data security.
The lack of physical IT infrastructure and the dispersion of the team around the world, requiring the adaptation of security strategies to the specifics of an organization working fully remotely.
Growing demands from corporate customers expecting auditable proof of compliance with global security standards.
Cultivating a culture of security and data protection in an international team required intensive training and simple, unambiguous procedures.
Team fears of excessive bureaucracy – ISO 27001 is associated with extensive documentation that could disrupt operational flexibility.

Solution

Thanks to the cooperation of dotlaw, it has succeeded:

Conduct a preliminary audit, identifying key gaps and areas for improvement.
Create an information security policy and accompanying documents, and implement them based on existing information-sharing tools (such as Notion), so that all materials are easily accessible to both auditors and the teams that use them on a daily basis.
Gain greater clarity on security policies so that employees thoroughly understand their responsibilities, and train teams on their roles, which has translated into increased awareness.
Create a centralized supplier management system for faster and more efficient verification of business partners.
Adapt security processes to a 100% remote organization model, which allowed for effective information security management without the additional cost of physical infrastructure.

Implementation process

Stage 1

Preliminary audit, product analysis and gap identification.

Stage 2

Identify and assess risks, define context, identify assets and assess vulnerabilities.

Stage 3

Develop and implement ISO 27001 compliant policies and procedures in collaboration with client teams.

Stage 4

Training and system testing.

Stage 5

Audit support and obtaining certification.

Added value

New sales opportunities – dotlaw has opened the door for Toggl to work with larger corporate clients, and the certification obtained has clearly accelerated the processes of negotiation, acquisition and verification of Toggl as a reliable supplier.
Integration of ISO 27001 – with existing processes, which has helped eliminate redundant procedures and optimize operations.
Raise awareness of information security – resulting in not just dry procedures, but actual involvement of all staff.
Opening up the possibility of getting more certifications – such as SOC 2 Type 2 or ISO 27701 – faster , thanks to a solid foundation.

Customer recommendation

“The experts at dotlaw helped us not only to achieve ISO 27001 certification, but more importantly to go through the entire process in a structured manner tailored to our company. From the first internal audit, to the implementation planning and analysis of our processes, to the training and certification audit, they were with us every step of the way, answering our questions and helping us solve the challenges that arose. It was with their support that we were able to integrate ISO 27001 into our existing processes and successfully prepare for certification. Their commitment, knowledge and professionalism made us feel confident throughout the process.”

Alari Aho CEO, Toggl OÜ

About dotlaw

Dotlaw’s team of experts are experienced lawyers specializing in data protection, compliance and information security management. We have extensive knowledge in ISO 27001, ISO 22301, ISO 42001, SOC 2 and similar regulatory audits for technology companies. With our international experience, we effectively support both dynamic startups and large organizations, helping them build solid foundations and counteract legal and regulatory debt.