ISO 27001 certification with zero findings: How m2hycon built a scalable ISMS with DataGuard

Achieve ISO 27001 certification quickly and reliably

At m2hycon, customer data is at the core of every project. That’s why information security isn’t just a nice-to-have, it’s essential. As Senior Data Science Solution Designer Natalia Grinberg puts it: “If we can’t handle data properly, we simply won’t get hired.”

A strong commitment to data protection and compliance has always been part of m2hycon’s DNA, but growing business demands meant it was time to formalize that into a certified ISMS.

The goal: achieve ISO 27001 certification quickly and reliably. With DataGuard, they reached that milestone in under a year— with zero audit findings.

Challenge

Working with sensitive data means trust is everything. m2hycon knew early on that on top of internal best practices, they needed proof, making ISO 27001 certification a strategic must-have.

A major customer made certification a requirement. Tenders increasingly excluded vendors without ISO 27001. Internally, it was clear that certified suppliers had an edge with smoother processes, fewer hurdles, and higher trust. That’s exactly the standard m2hycon wanted to set.

They needed a solution that provided structure without adding unnecessary complexity — one that could be adapted to their business and help them stay on track alongside daily operations.

Their key challenges: 

1. External pressure: Customers made ISO a requirement.
2. Tender exclusion: More and more tenders required ISO 27001 as a baseline.
3. No ISMS in place: Roles, documentation, and processes had to be built from scratch.
4. Limited capacity: A small IT consultancy couldn’t spare full-time InfoSec resources.
5. High demands in AI projects: Without proven security, AI solutions risk being seen as black boxes— a no-go for many clients.
   

Solution

m2hycon chose DataGuard for its powerful combination of platform and expert support. What stood out most was a structured, step-by-step approach that was flexible enough to fit their team size and needs. It gave them all the tools to build a lean, audit-ready ISMS without being overwhelmed.

What made the difference:

• User-friendly Risk App: Helped categorize and track risks clearly, which according to Natalia was ”a real benefit in the audit.”
• Pre-built documentation: Provided structure without being rigid—content could be customized and aligned with the team quickly.
• Flexible templates: When standard formats didn’t fit, DataGuard helped adapt them, keeping things lean yet audit-proof.
• Built-in Academy: Covered 80% of their training needs out of the box, with tracking and proof of completion.
• Expert-led collaboration: The dedicated DataGuard consultant worked closely with m2hycon to build a realistic ISMS that fit their business.
• Time savings: Everything was integrated into the daily workflow — no extra headcount needed.
  

Results 

m2hycon successfully built a complete, audit-ready ISMS: structured, scalable, and fully aligned with their day-to-day operations. Just nine months after starting, they passed their ISO 27001 audit on the first try, with no findings, all while using only 20–25% of the team members’ time.

Key achievements: 

• Certified in 9 months: No findings, no delays
• Lean implementation: Built the ISMS using just 20–25% of two FTEs' time
• Business impact: Gained access to new tenders and clients who prioritize security
• Efficient operations: Fewer questions, clear documentation, smoother project delivery
• Audit-ready structure: Risks, controls, and responsibilities are now fully traceable
• Tailored, scalable system: Templates adapted to reality, not the other way around
• Long-term value: A foundation that grows with the company and evolving regulations