Telviva has successfully obtained certification according to the ISO/IEC 27001:2022 standard, which is a significant step in its commitment to ensuring a high level of information security. The company's journey to achieving this certification began five years ago following a client request that required a thorough security audit.
As more organizations seek business partners with ISO or equivalent certifications, Telviva undertook a multi-year effort to obtain this confirmation. The certification demonstrates that corporate and client data remains protected, available, and fully secured. The goal of this process was to strengthen trust among clients and commercial partners by demonstrating a proven ability to properly manage and store information.
The ISO/IEC 27001:2022 standard is recognized globally as an Information Security Management System (ISMS) standard. It primarily concerns operational consistency, meaning 'documenting what you do and executing what you have documented.' This extensive standard requires the enterprise to develop clear policies and processes covering access management, asset management, business continuity, disaster recovery, human resources management, and risk assessment.
Furthermore, the standard mandates formalized change management, IT operation guidelines, which include incident management, mobile device policies, remote work rules, information classification and handling protocols, and secure coding policies for internally developed software. Preparing for the certification required significant financial and labor investment across the entire organization.
Key Elements for Obtaining ISO Certification
The updated ISO/IEC 27001:2022 standard includes 93 controls distributed across four thematic categories:
- Organizational elements: These relate to general policies, identity management, asset classification, and asset disposal.
- Personnel elements: These include remote work rules, employee vetting, and confidentiality agreements.
- Physical elements: These focus on security perimeters, physical facility monitoring, equipment protection, and secure asset disposal.
- Technological elements: These concentrate on access control, cryptography, endpoint protection, and cloud security.
Practical Changes Implemented at Telviva
To ensure a smooth transition, Telviva implemented the necessary operational changes in phases over three years. Key improvements include the formalization of change management procedures and the implementation of a mobile device management system to track authorized devices accessing the network.
To protect against cyber threats, the company began conducting daily vulnerability scans in collaboration with a security provider, and it regularly performs penetration testing to detect and address issues early. These technical measures were reinforced by employee security training, updates to remote work rules, and stricter device security practices, making Telviva a significantly more secure environment.
Obtaining the ISO/IEC 27001:2022 certification brings substantial benefits to both Telviva and its clients. Although the certification does not eliminate questions about supplier security during Requests for Proposals (RFPs), it provides a structured foundation that serves as a simpler and more reliable starting point. Existing and potential clients immediately understand that Telviva supports and strictly adheres to proven information security management policies.
For customers, knowing that their data is stored in a systematically protected environment provides peace of mind and guarantees the safety of their valuable assets. Primarily, opening up operations to rigorous external assessment continuously strengthens client trust.
Continuous Improvement
The ISO/IEC 27001:2022 certification is valid for three years and is maintained through annual surveillance audits. An organization cannot simply receive a certificate and become complacent, as a central principle of ISO standards is continuous improvement. Telviva promotes ongoing progress by holding quarterly ISO meetings with senior management to review metrics and operational reports, as well as to identify and implement improvements.
During each annual surveillance audit, external auditors verify these documented improvements, delving into the process throughout the entire three-year cycle. This culture of constant evaluation ensures that Telviva consistently applies what it documents, maintaining a strong security posture and preserving long-term client trust.