As our team works toward ISO 27001:2022 certification, we’re using the Cynomi platform at every stage of the process.
I sat down with Dror Hevlin, our CISO, to talk about how we’re applying our own platform to achieve ISO readiness, and why we believe this approach represents the future of security and compliance, especially for service providers supporting their own clients on similar journeys.
1. Dror, let’s start with the big picture. I know it was important for you to get Cynomi ISO 27001 certification?
Dror: ISO 27001 is a globally recognized standard, and we want to show our commitment to high levels of security, not just in principle, but in practice. It’s not just about passing an audit; it’s about aligning our internal processes with best practices and being able to prove it. As a security-first company, it’s essential we hold ourselves to the same standards we help our partners meet.
2. How did you use the Cynomi platform to manage the process of getting ISO 27001 certification?
Dror: We use our own technology just how we recommend service providers use it with their clients. We started by onboarding our environment into Cynomi. The platform guided us through an interactive onboarding process – leveraging questionnaires, policy evaluations, and scans to quickly build a complete picture of our security posture and compliance status.
From there, Cynomi automatically generated a pre-populated risk register, a prioritized remediation plan, and a list of actionable tasks – all directly mapped to ISO 27001:2022 controls, including the new Annex A control categories.
Tasks are dual-purpose – they improve our real-world security posture and simultaneously drive us toward ISO compliance. That’s one of the platform’s biggest strengths, security and compliance are integrated, not siloed. So we’re not duplicating work, and we’re not juggling disconnected systems.
As we complete each task, whether it’s implementing a policy, mitigating a vulnerability, or assigning ownership, Cynomi instantly updates our compliance dashboard and security posture to reflect that progress. That kind of visibility is incredibly valuable. It means we can run ISO alignment not as a one-off project, but as an ongoing, continuous process, all within our own platform.
And because Cynomi is already tracking our security and compliance activity, it serves as built-in documentation. When it comes time to prove compliance, the platform itself is our system of record. It eliminates guesswork and makes audit prep nearly effortless.
3. What are the biggest benefits of using Cynomi for ISO certification?
Dror: Four things stand out:
- Speed and simplicity. The platform reduced our discovery time and setup by more than half. It’s fast and guided. From assessments to pre-populated risk registers, auto-generated remediation plans and custom reporting, the platform makes the process seamless and saves our team time at every step.
- Continuous compliance tracking. Every task we complete, security policy, mitigation, control, is mapped directly to ISO. We always know exactly where we stand.
- Audit readiness. All our documentation, task ownership, and status updates are logged and exportable. No scrambling at the last minute.
- Security – first. Every task improves real security and maps to ISO controls, so compliance happens automatically as we strengthen our posture.That way we’re secure, not just compliant. It’s a major difference. Compliance is the outcome, but security is the driver.
4. How does the platform handle framework changes—like the 2022 update to ISO 27001?
Dror: That’s one of the biggest advantages. When ISO updates their framework, we don’t have to start from scratch. Cynomi automatically updates the backend mappings. The tasks we already have in place are re-scored or remapped to the new controls, and we instantly see any new gaps that need addressing.
It saves hours of work and ensures we’re always aligned, even if the standard evolves.
5. What would the ISO process look like without Cynomi?
Dror: It would be messy and lengthy. You’d need to download the ISO checklist, manually create tasks, assign them in a ticketing system, track progress in spreadsheets, and collect evidence in scattered folders. Then repeat all that every year, or worse, discover at audit time that something was missed.
We’ve done it that way in past companies. It’s time-consuming and stressful.
6. What would you say to a service provider wondering if it’s worth offering ISO services to their clients?
Dror: ISO 27001 is in high demand. Clients are under pressure to prove they’re secure, and they need partners who can help them do it efficiently. Cynomi turns ISO services into something repeatable and scalable. You can onboard clients faster, reduce delivery time, and generate a new revenue stream while helping them truly improve their security posture.
Using Cynomi to manage the ISO certification process isn’t just easier, it’s smarter. It’s a way to build trust, grow your business, and deliver more value with fewer resources.
7. Final thoughts, how has this process changed the way you think about compliance?
Dror: Compliance used to feel like a chore. Now, it’s seamlessly embedded into our daily operations. Cynomi made ISO something we manage continuously, not something we rush through once a year. That shift, from reactive to proactive, is the real transformation.
And the best part? We didn’t have to build custom tools or hire extra people. We used the same platform we offer to our partners. It’s been a powerful validation of what we’re building, and why it matters.
Conclusion
By using our own platform to pursue ISO 27001:2022, we’ve seen firsthand how automation, alignment, and real-time visibility turn a complex, manual process into something smooth, scalable, and strategic.
Whether you’re managing internal compliance or helping clients pursue certification, Cynomi gives you the tools to do it faster, better, and without the overhead.
Ready to simplify ISO 27001 for your clients, and scale your security business? Book a demo with Cynomi today.