We certified ISO 27001 in record time!

As part of our continuous improvement plan, just a few months ago at Pomelo, we set out to certify ISO 27001, a regulation that defines world-class status in Information Security. And we achieved it in less than four months! A true record for the industry, where it usually takes between 6 and 24 months. But not only that: we also managed to certify without findings, meaning we did not receive any observations during the process.

ISO 27001 is an international standard that protects the confidentiality, integrity, and availability of information, providing confidence in proper risk management. Certifying it demonstrates companies' commitment to preserving their customers' data privacy, as well as efficiently safeguarding their internal processes.

At Pomelo, we were one of the first companies in Latam to have certification in the PCI-DSS level 1 version 4.0 standard, which regulates and defines the requirements to operate with payment methods. And now, with the ISO 27001 regulation, we cover another front, the management aspects, as it seeks to form what is called an Information Security Management System, also known as ISMS.

How did we certify the ISO 27001 regulation?

The first version of the ISO 27001 regulation was launched in 2005, and since then it has been updated several times. The latest version dates from 2022, which defines 4 general areas of interest, which in turn define 93 specific control points.

At Pomelo, we achieved certification through a thorough analysis to evaluate the best strategy on how to approach the project. The path to deploying the ISMS required the collective effort of multiple areas, which had to work together to meet the objectives of this regulatory framework.

The challenges of certification: lessons learned

As with any initial deployment, we had to overcome demanding challenges, but at the same time, we learned some lessons that we share below:

• Define precise scope: just like with PCI-DSS 4.0, the initial objective of the certification includes identifying the “critical path” of all services and systems to be reviewed, in order to adjust and reinforce controls where they are truly necessary. To do this, the team worked on planning the main issues associated with Information Security management. From there, priorities and a schedule of tasks were established, which, together with other sources of information, such as budgets, requirement prioritization, future projects, etc., define the Annual Plan that sets the course and horizon of the ISMS.
• Consolidate documentation: like any system dedicated to management, the ISO 27001 regulation requires special attention to the documentation of all processes, systems, and services within its scope. To meet this objective, it was necessary to reformulate, update, or generate much of the regulatory framework associated with the ISMS scope. This was done to cover each of the aspects required by the standard, as well as to consolidate all documentation in a new internal portal, explicitly dedicated to its dissemination and availability.
• Strengthening Risk Management: the certification journey included the consolidation of a dedicated Information Security committee, which addresses and defines all risks arising from the ISMS. This new entity comprehensively governs Technological Risk Management, whether by evaluating the impact of potential new threats, defining their treatment, or informing management about the results of these analyses.
• Govern Change Control: a fundamental part of the ISMS involves demonstrating sufficient traceability of every change made to the services within scope. Access Security and Platform teams worked to achieve a refined Access Control and Change Control circuit respectively, integrated into Pomelo's core systems, generating the necessary evidence to meet the objective.
• Classify ALL information: the information classification criteria initially defined for the PCI-DSS scheme were adjusted and optimized, extending the scope comprehensively. This covers the entire flowchart where data traffics, resides, and is stored as affected by the processes. Additionally, commercial contracts, documentation associated with third parties, and all internal messaging circuits were incorporated.
• Demonstrate how we maintain Business Continuity: unlike PCI-DSS, ISO 27001 sets controls related to the recovery of services in the event of incidents that threaten their normal operation. To meet these requirements, Pomelo utilizes the resilience capabilities of the cloud, both at a multi-region and multi-zone level, which allows for agile response times, supported and demonstrated through precise use tests, duly documented and scheduled.
• Document the relationship with suppliers: to achieve Pomelo's current business operations, service agreements had to be made with multiple suppliers, each specializing in a specific field. ISO 27001 requires explicit and orderly detailing of the security controls implemented by these suppliers, to demonstrate they meet the same security requirements as Pomelo and to detect any possible deviation or irregular situation.
• Master the Threat Map: like any management system, the nature of our ISMS aims to maintain it as a "living" system, which is continuously fed and adjusted to new risks and threats.

To achieve this dynamic, we integrate into various interest groups specializing in different topics of Information Security and Cybersecurity, both locally, regionally, and globally, which continuously report all types of relevant events. In the specific task of Threat Intelligence, these reports are classified, identified, and documented, and then reported to the internal teams that need to take action on them.

• Strengthening Incident Monitoring: one of Pomelo's strengths lies in its ability to generate alerts and take immediate action against events that threaten the normal functioning of services. This is demonstrated by the dashboard published at https://status.pomelo.la

These tasks and their operations were documented as part of the Incident Response circuit required by ISO 27001, far exceeding what is expected in this regard.

• Conduct comprehensive Cyber-Awareness: lastly, it is worth mentioning the arduous internal task carried out to disseminate the objectives of ISMS. Throughout the entire certification process, all employees were informed, integrated, and made aware of the implications of its implementation, the controls involving them, and the adjustments expected from each of them. Their constant collaboration was crucial to achieving the system's effectiveness, a fact verified in various tests and specific samples conducted by external audit teams.

What are the next steps?

Achieving certification is just the starting point; the ISMS requires constant attention, which naturally leads to a continuous improvement plan, continually optimizing the process to achieve the expected results.

Along the way, we coined a new phrase that sums up the spirit of what this certification represents for us and will accompany us from now on: One Pomelo, One Security!