Back to case studies 
Software / SaaS · SaaS provider of an ITSM solution
ISO 27001 assessment and hardening of a software vendor's SaaS infrastructure
- Duration
- 1 month
- Framework
- ISO 27001
- Role
- ISO 27001 consulting and hardening
- Contract
- Data processing under Art. 28 GDPR
Situation
A software vendor also offers its IT service management (ITSM) solution as a SaaS service that it operates itself. The infrastructure behind it was to meet the requirements of ISO 27001. Some measures were still missing, above all in monitoring and in access by external service providers.
Approach
In May 2026, WCS assessed and improved the infrastructure within one month:
- Assessment of the infrastructure in use against the requirements of ISO 27001.
- Reconfiguration and extension of the infrastructure to implement the requirements that were still missing.
- Extension of the monitoring of the SaaS infrastructure.
- Securing access by external service providers.
- Processing of personal data such as log data only on the vendor’s documented instructions: WCS acted as a processor under Art. 28 of the Datenschutz-Grundverordnung (GDPR), with technical and organisational measures under Art. 32 GDPR.
Result
The ISO 27001 requirements for monitoring and external service provider access that were missing before are now implemented in the infrastructure. The engagement is complete.
More case studies
Public sector
Access governance, passwordless sign-in and BSI-aligned hardening for 40,000 users in one operating model
- Users
- 40,000
- Devices in Intune
- 1,500
Wholesale
Group-wide Azure security baseline, central CSPM and just-in-time admin rights for 30,000 users
- Users
- 30,000
- Duration
- since December 2025
Energy / critical infrastructure
Security principles, access controls and integration patterns built into the platform architecture
- Duration
- 4 months
- Role
- Security and platform architecture