We're ISO 27001 Certified. Here's What It Means for Your Project.

Why we did it

Notum is now certified under ISO/IEC 27001:2022, the international standard for information security management. TDS Brno, an accredited certification body, issued the certificate after an independent external audit. You can verify it in the IAF CertSearch global database.

Most of our clients are enterprise teams, and for them security is part of choosing a vendor. Before a project starts, their security teams send detailed questionnaires, ask for policies, and review how we handle code and data. Until now, we answered those questions one by one.

ISO 27001 gives them an answer they already recognize, checked by an independent auditor.

What the certificate covers

ISO 27001 certifies how a company manages security. We identify risks, decide how to handle each one, set rules, train people, and check regularly that the rules work in practice. The auditor reviewed all of it, and follow-up audits keep checking.

Our certificate covers the whole company. That means every team, every process, all employees and external contractors, and our Brno office. It applies to how we design, build, test, deploy, and support web applications, from the first workshop to long-term maintenance.

What it means for you

• Faster vendor approval. Your procurement and security teams already know ISO 27001, so vendor risk assessments get shorter and more predictable. It also helps if you need to show NIS2 compliance across your supply chain.
• Secure code from day one. Security requirements are part of every project from the start. Passwords and keys never go into source code, and we fix critical and high-risk vulnerabilities before release.
• Your data stays yours. We keep each client's data separate, and only people who need it for the job get access.
• A plan for when things go wrong. A business continuity plan and regularly tested backups keep delivery going when something breaks.
• Fewer human mistakes. Regular security training, least-privilege access, and multi-factor authentication (MFA) cut the most common causes of incidents.

What changed inside Notum

The biggest risk with ISO 27001 is ending up with a shelf of documents nobody reads. We set one rule early: no paperwork for paperwork's sake. Security is part of everyone's daily work, and everyone at Notum owns a piece of it.

So we kept the documentation lean and wrote the rules the way developers talk. A few examples of what that looks like day to day:

• Security starts at kickoff. We define security requirements alongside the functional ones, before anyone writes code.
• No shortcuts to production. Developers get time-limited, approved access to production, and we log every session. Changes go through the agreed process, with a controlled emergency procedure for real emergencies.
• Clear rules for AI tools. We use only approved AI tools, keep confidential and client data out of them unless someone authorizes it, and have a person check every output before it goes anywhere.
• Report first, fix second. Anyone who spots a problem, from a phishing email to a lost phone, reports it right away.

The training wasn't a one-off either. Everyone went through it, and it repeats regularly, because the threats keep changing.

How we did it

Getting ready took about six months. I led the project on our side as Notum's Personnel Security Manager and Deputy Information Security Manager. We worked with BeSecured, a Czech information security consultancy, and Anna Kuleshova helped us build the system and prepare for the audit. She still supports us as our information security manager.

The rest of the core team:

• Martin Čapek wrote the technical directives, set up identity and device management, and configured the IT side.
• Tomáš Jakúbek built backups for systems that seemed impossible to back up and supported the IT work.
• Klára Stehlíková covered physical security, directives, signatures, and security objectives.
• Michelle Jantulíková introduced the system to the team and set up the project management.
• Ondřej Janošík, our CEO, gave the project the time and budget it needed.

Everyone else at Notum installed the tools, went through the training, and read the rules. Because the groundwork was solid, the certification audit itself went quickly.

What's next

Keeping the certificate takes ongoing work: regular internal audits, a yearly management review, and follow-up audits by the certification body. We keep improving the system as Notum grows and as new tools and threats show up.

If your security team has a vendor questionnaire waiting, send it our way. And if you're planning a Strapi or Payload project and security is on your checklist, let's talk.