From separate documents to a shared way of working
VORM wanted to demonstrate effective information security management, partly because clients were asking about it in tenders. Documents and processes already existed, but according to ICT Coordinator Richard van Breugel, they lacked coherence and alignment with ISO 27001. VORM chose IT as the starting point for its project with De Compliance Afdeling.
In this customer story, Richard and DCA's Maarten van Veen describe the collaboration: working through risks and responsibilities together, recording information centrally and maintaining the approach.
Why ISO 27001 matters so much for property developers
VORM is a major property developer, with just over seventy operating companies and projects worth hundreds of millions of euros. In that context, information security is essential to organising projects professionally. “Municipalities and other clients increasingly ask how you handle data,” says Richard van Breugel, ICT Coordinator at VORM. “ISO 27001 had been mentioned a few years earlier as something we would need for tenders. But knowing you have to do something is very different from organising it properly.”
ISO 27001 is an internationally recognised framework for managing information security systematically. It enables organisations to manage risks, responsibilities, policies and checks within one coherent system.
“To be honest,” Richard laughs, “certification felt like another obligation to us too. You have to fit it in alongside everything else, and understanding it all is quite a task.” Maarten van Veen of De Compliance Afdeling recognises that experience in many organisations. “ISO 27001 is often seen as an extra obligation, whereas in practice it is a strategic foundation. You set out how you manage risks, who is responsible for what and how you demonstrate it.” VORM shares that view. “We deliberately started with IT,” Richard says. “It is a manageable starting point, and it also shows the rest of the organisation that we are taking this seriously.”
Scope and responsibilities in the project described
The starting point: the IT department, existing ways of working and the requirements VORM wanted to address. The interview describes joint sessions, documentation, risk assessments and recording responsibilities. It does not set out a full contractual scope or formal certification scope for all operating companies.
VORM: contributed its practical experience and existing documents, with various IT roles helping develop the approach. Richard describes how the team learned where information is held and who is responsible for what.
DCA: guided the sessions, explained the standard and worked with VORM on documents, risk assessments and the division of work. The Compliance Tool became the central place for policies, risks, controls, tasks and documents.
After the project: the interview describes DCA's continued involvement in keeping information up to date. Software and guidance support that approach; VORM remains the organisation putting the agreements into practice in its daily work.
VORM and De Compliance Afdeling: putting ISO 27001 into practice
Early in the project, it became clear that few arrangements were fully established. “Of course, we had documents and processes, but they were mostly separate,” Richard explains. “There was no uniform structure behind them, and they were not yet aligned with the standard.” De Compliance Afdeling therefore began primarily by listening. Maarten: “We always start with the organisation itself: what are its objectives, how does it work now, and what do its clients and supply-chain partners require? If things are not yet organised, it is almost never for lack of good intentions. The main questions are: what information do we have, what is still missing, and how do we bring it together?”
Together with VORM, they then prepared documents, carried out risk assessments and recorded responsibilities. Through several sessions and coordination across different IT roles, both companies worked towards certification. “We could not have done it without them,” says Richard. “Especially when you are unfamiliar with it, you want to get everything exactly right: research more, understand why something is being asked or what it means. Maarten not only guided and explained the process; his role also gives him a clear understanding of when something meets the requirements.” Then, with a grin: “That matters a lot to us, because we want everything to be perfect.”
VORM uses De Compliance Afdeling's Tool for this. “It is the central place where everything comes together,” says Maarten. “Policies, risks, controls, tasks and documents. It prevents information from becoming fragmented and makes evidence easier for everyone. New information can also be managed in one place.” Like Richard, Maarten is pragmatic. “Compliance is not about collecting as many standards as possible. It is about establishing your approach. That approach needs to fit your organisation and, above all, help you demonstrate that you work professionally.”
What does ISO 27001 deliver for VORM in practice?
For VORM, ISO 27001's main impact is how information security is now embedded. “Of course, it is good to have the certificate and be able to say you meet the standard,” says Richard. “But more importantly, we can now always show: this is how we have organised it, and this is how we work.” Processes, responsibilities and documentation are recorded, so information security no longer depends on particular individuals' knowledge. This is especially noticeable during audits. “An audit is still nerve-racking, of course,” Richard admits. “But we approach it with much greater confidence now, because we know where everything is and who is responsible for what. It also makes a huge difference to preparation.”
At the time of the interview, ISO 27001 was embedded within VORM, and another audit was planned. “It is a continuous cycle,” Richard explains. “Having policies also means continuing to refine them.” Maarten sees this as the essence of compliance: “Organisations change, people move on and systems expand,” he explains. “That is precisely where many organisations can benefit, whether with ISO 27001 or another certification. Control comes from being able to adapt easily.”
In the interview, Richard and Maarten also describe DCA's involvement after the project towards certification. Alongside the Tool, the collaboration included help with keeping information current. They described people working each week to update information. “It is not as though compliance has suddenly become very simple for us,” Richard concludes, “but it is now properly organised.”
What are the results based on?
The results on this page are experiences from DCA's existing published interview with Richard van Breugel of VORM and Maarten van Veen of DCA. Richard describes greater clarity, clearer responsibilities and more confidence in audit preparation. Centralised documentation and joint risk assessments are the changes to working practices described.
Richard mentions an achieved certificate in the interview. This customer story does not include a certificate, audit report or independent measurement establishing current validity, formal scope, time savings or the effect on security incidents. No percentage, timeframe or guarantee is therefore attached to it. These experiences relate to the project described.
Want to know which steps would suit you? Read our guide to ISO 27001, the certification step-by-step plan or explore our implementation support.