How do you tackle a standard written mainly with large organisations in mind when your team is just a handful of people? And how do you keep everything properly documented without the paperwork taking over your day-to-day work? Novellas Healthcare made a deliberate choice for an information security management system (or ISMS) that fits its own way of working. Cingulum guided the team from the very first documents all the way to ISO 27001 certification. Read how they did it.
Software for healthcare, with high expectations
The SaaS platform brings together care providers, doctors and pharmaceutical companies. Nurses use it to share reports of their patient visits with the doctor straight away. Pharmaceutical companies can use it to offer new medication to patients for whom no alternative exists yet. For market access, the platform also gathers real-world data on how a treatment works in practice, for example for reimbursement files. Because every pharmaceutical client has its own needs, the platform can be fully tailored.
Behind the platform is a compact team, with each member bringing their own background. Inge Wyns started at Novellas as a nurse and grew into the role of quality manager, with experience in ISO 9001. Bjorn Vereecken built up his own software company, whose SaaS solution Novellas acquired last year. Today he is its digital solutions architect. Together, Inge and Bjorn took on the ISO 27001 project.
When launching a new patient programme, Novellas Healthcare often receives extensive due diligence questionnaires, and ISO 27001 almost always comes up. More and more contracts also ask for the certificate. Novellas Healthcare wanted to be able to give a clear and well-founded answer.
The challenge: a big standard for a small team
The project demanded time and commitment, which is never a given in a small team. Everyone juggles several responsibilities while the daily work carries on. So Inge and Bjorn deliberately made room for it. They made it a priority and set aside fixed slots in their calendars to keep track of progress.
The deeper they got into the standard, the clearer it became that an ISMS (Information Security Management System) looks beyond your own product. It covers the entire organisation and the way the team works every day.
That broader perspective called for a critical look at their own operations. Some measures were already in place and only needed refining or better documentation. Other ways of working needed adjusting. That made the project more intensive, and at the same time more meaningful.
Our approach
To keep that intensive project manageable, Cingulum chose a pragmatic approach tailored to Novellas. The team wasn’t starting entirely from scratch either. Inge already had experience with ISO 9001, so she knew how a management system is put together. That experience made the way of working feel familiar from the outset.
The project soon found its rhythm. Every week, Novellas worked on a number of tasks itself, while the Cingulum consultant delivered new documentation or procedures. For policies and procedures, we provided our own templates, based on our experience with similar projects. This gave the team a concrete starting point and showed them right away what such a document looks like in practice. Inge and Bjorn then adapted them to their own way of working. That steady cadence kept the project moving, even in busier weeks.
After a kick-off meeting, the collaboration took place fully remotely, and it ran smoothly. Whenever Inge and Bjorn got stuck, they bundled their questions in an email. More complex questions were discussed briefly over the phone. That way, Novellas always had an extra pair of eyes to check things. Even when another consultant took over in the final phase, there was still a single point of contact and the project simply carried on.
The result? More than a certificate
Around eight months in, and after a successful internal audit, Novellas Healthcare obtained its ISO 27001 certificate.
What changed in day-to-day operations is at least as valuable. Today, the team is quicker to link a new situation to a possible risk. What could go wrong, and what do we do about it? That question now comes up naturally. Things that used to be put off because other work seemed more urgent now have a fixed place. And when something changes at a supplier, or doesn’t go quite as agreed, it gets noticed sooner. For Inge and Bjorn, that is proof the system really works.
Finally, a few tips from Inge and Bjorn
For other small organisations, Bjorn stresses the importance of an ISMS that matches the way you work. Decide what is achievable for your team and set your objectives accordingly. In a future project, Inge would put the risk assessment at the centre from the very start. It gives you a solid foundation to build on and reduces the need for adjustments later. Their joint advice is to free up enough time, because this kind of project calls for focused attention and sustained effort.
Next steps
Now that the certificate is in place, the focus is on keeping the ISMS alive. The risk assessment and regular follow-up make sure information security stays embedded in the way Digital Solutions works.
Want to know what ISO 27001 means for your organisation? Get in touch with Cingulum for a no-obligation conversation. www.cingulum.eu
