What ISO 27001 means for Transvault customers
Choosing a migration provider means trusting both the technology that moves your data and the organisation responsible for the work. Security, procurement and legal teams need more than an assurance that information will be handled carefully. They need to understand how risks are managed and what evidence supports the answers.
Transvault’s ISO 27001 certification gives customers an independently assessed reference point for that due diligence. It also reflects a commitment to managing information security as part of everyday operations.
Why Transvault pursued certification
Transvault had security practices in place before pursuing ISO 27001. For Darwin Lee, Chief Executive Officer, certification was a way to bring those practices into a recognised framework and subject them to independent assessment.
“Transvault has always been highly focused on security and had adopted many of the ISO 27001 principles long ago, so this felt like a logical step and a way of independently auditing that security for the benefit of ourselves and anyone who works with us.”
Darwin Lee, Chief Executive Officer
The aim was to make responsibilities, controls and reviews consistent across the business, rather than assembling evidence only when a customer questionnaire or audit arrived.
What changed inside Transvault
Chris Pritchard, Head of Customer Operations, Technical Account Management, led Transvault through the certification process. He describes its biggest effect as making information security a clearer responsibility across the organisation.
“The biggest change was that information security became a structured, company-wide responsibility rather than something primarily managed within IT. ISO 27001 made us more deliberate about identifying and assessing risks, documenting the controls we have in place, assigning ownership, and regularly reviewing whether those controls are still effective.”
Chris Pritchard, Head of Customer Operations, Technical Account Management
That structure extends to areas such as access management, suppliers, incident response, business continuity and employee awareness. It gives Transvault a consistent way to identify risks, decide how to address them and check whether its controls remain effective.
Building on an existing foundation
Transvault achieved certification on its first attempt. Chris attributes that result to security practices already in place, including access control, secure development, backups and incident management.
“We already had a strong security culture before certification. We were already taking the protection of customer and company information seriously, particularly around access control, secure development, backups, system security and protecting customer data. We also had processes for managing incidents, onboarding and offboarding users, and controlling access to systems. What ISO 27001 really added was structure and consistency around those practices: documenting them, assigning clear ownership, assessing the associated risks, and regularly reviewing whether the controls were effective.”
Chris Pritchard, Head of Customer Operations, Technical Account Management
Certification brought greater consistency to how those practices are documented, assigned and reviewed. For customers, it provides a clearer basis for examining the security arrangements behind a migration project.
Supporting customer due diligence
Security questions now arrive early in many migration discussions. James Moody, EMEA & APAC Channel Manager, sees the certification help Transvault respond to detailed customer and partner reviews.
“As the cyber threats and bad actors increase, the number of projects requiring very detailed due diligence from a security perspective has increased dramatically over the last few years. Each time we receive such a request to complete these security questionnaires, it is a time consuming process, much of which is repetitive in nature. However, the vast majority of the questions we are asked can be addressed as a result of our ISO 27001 certification. Subsequently, we are able to respond more efficiently and give our customers a greater confidence in our ability to execute projects in a way that meets their own security expectations and requirements.”
James Moody, EMEA & APAC Channel Manager
Customers will still carry out their own assessment. ISO 27001 gives their security, procurement and legal teams a recognised starting point for questions about risk management, ownership and review.
Assurance around the migration
Transvault Intelligent Migrator provides detailed auditability and Chain of Custody to help customers account for data as it moves from source to destination. ISO 27001 addresses a related question: how does the organisation developing and delivering the migration technology manage information security?
Deployment is part of that conversation too. As Darwin explains, many customers choose to run Transvault’s migration solutions within their own environment:
“We’ve always treated customer data with the greatest of care and respect. When others rushed to provide migration solutions in the Cloud, we preferred to remain inside the customer’s own security boundary to respect their investment in security and leave them fully in control of their data security as much as humanly possible. We can offer migration solutions in the Cloud, and migrate from and to Cloud solutions, but the majority of our customers prefer the internally hosted option for our migration solutions where this is possible.”
Darwin Lee, Chief Executive Officer
The appropriate approach depends on the customer’s environment and requirements. Certification gives them another way to assess Transvault alongside the proposed migration method.
A continuing commitment
ISO 27001 is an ongoing management system. As Transvault develops products, works with suppliers and responds to new risks, security responsibilities and controls must continue to be reviewed.
That is what makes certification useful beyond the initial audit. Customers can ask how risks are owned, how controls are checked and what evidence supports the answers.
Bring our ISO 27001 evidence into your due diligence