A group of three affiliated companies in the investment and property services sector pursued ISO 27001 certification group-wide, partnering with Reflective IT to strengthen their security posture and build lasting stakeholder trust.
Background
The Situation
The Challenge
A group of three affiliated companies in the investment and property services sector set out to strengthen their information security. Each company had its own business model, customer base and regulatory obligations, but shared a common goal: to protect customer data and demonstrate commitment to best practice.
The Approach
With a strong internal culture of governance already in place, the group partnered with Reflective IT to launch a group-wide project aligning their information security policies and processes. Despite differences between the businesses, a unified framework was created allowing flexibility where needed. Each company was certified individually to reflect its unique risk profile.
"I wanted us to be forward thinking in getting this initiative into the business, where many other similar businesses of our size aren't thinking about this type of accreditation. It is a way for us to differentiate ourselves and evidence we do what we promise."
Group Director of Technology & DataChallenges
Key Focus Areas
Multi-Company Coordination
Each company had a different focus — institutional funds, freehold services and aspirational living. Different teams, cultures and regulatory pressures meant a group-wide framework required careful coordination and strong leadership.
Supplier Risk Management
One of the biggest areas of focus was supplier risk. The group reviewed vendor selection, expected standards and contractual protections. The entire supplier lifecycle — from onboarding to offboarding — was reviewed to embed security at every stage.
Secure Software Development
The group already built some of its own tools, but the ISO process encouraged them to formalise their approach. Structured testing was introduced at every stage of development to ensure software was secure and reliable before deployment.
Results
Business Outcomes
First-Attempt Audit Success
All three companies passed their ISO 27001 audits on the first attempt, providing a solid foundation for continuous improvement and reducing risk across the group.
Stronger Controls Across the Board
Supplier contracts became more robust, software development more secure, and internal teams more confident. The ISO logo now appears in communications as a visible mark of quality.
Investor & Customer Confidence
The project improved security posture and built trust with investors, customers and staff — demonstrating the group's commitment to doing things right.
"Looking back at the last year since we originally achieved ISO 27001 certification for all three businesses, it has been a contributing factor to building confidence with new investors and existing customers."
Group Director of Technology & Data
Get Certified
Ready to pursue ISO 27001?
Reflective IT has been helping businesses achieve certification since 2003. Let's talk about what the process looks like for your organisation.
Get in Touch
