Custom software that we build from the first sprint according to the requirements arising from ISO 27001: security by design, threat modelling up front, secure coding, layered encryption, strong access control, demonstrable logging and tested incident response. This is about how we build software, not a GRC tool to keep your certification up to date.
ISO 27001 is the international standard for Information Security Management Systems (ISMS). The standard describes governance around information security, and Annex A lists 93 controls across four themes: organisational, people, physical and technological. Many of these controls apply directly to the software you commission, such as access control (A.5 and A.8), cryptography (A.8.24), secure development (A.8.25 to A.8.28), logging and monitoring (A.8.15 and A.8.16), supplier relationships (A.5.19 to A.5.22) and incident management (A.5.24 to A.5.30).
We're asked by organisations that are going through a certification process, or have already completed one, to build a new platform or business application that falls within the scope of their ISMS. The question is then not "put ISO 27001 in place for us", but "make sure the system you're building doesn't become a finding at the next audit". That's a different conversation, with different evidence requirements and different design choices.
We do not carry out the certification audit ourselves; that is reserved for accredited bodies such as TÜV, BSI, DEKRA, Lloyd's or Bureau Veritas. What we do is build the software and supply the evidence your auditor needs to tick off the relevant Annex A controls. This fits within wider projects around DORA compliance software, KYC and AML compliance software or a risk management software project, and is a logical building block if you are working towards a broader enterprise software project.
Two elements come up in almost every ISO 27001 project because an auditor will ask about them: controls in the development pipeline that demonstrably run, and an up-to-date inventory of your software components.
Most projects start in one of these three forms. In the first conversation, we advise which approach best suits your scope, your type of data, and how far your organisation has already progressed with the ISMS.
Your organisation is already certified or well advanced, and the ISMS is in place. You commission a new application that falls within scope: a client portal, an internal tool, a data platform or a processor application. We map the relevant Annex A controls in advance, select architecture and build choices that fit them, and deliver, with each release, the evidence your internal auditor or certification body expects.
You are working towards your first certification while the new application is being built in parallel. We liaise with the information security officer or CISO who is setting up the ISMS, translate the emerging policy into concrete architecture and coding standards, and ensure the software is not the bottleneck at Stage 1 and Stage 2. We often contribute to the Statement of Applicability for the controls that are implemented in software.
You fall under an additional regime: NEN 7510 for healthcare, BIO for government, or rigorous client due diligence from a large corporate customer that requires your SOC 2 or ISO 27001. The system must satisfy several frameworks at once. We build one coherent architecture that covers all these regimes simultaneously, with traceable mapping from features to the controls each framework requires, so you build once and certify many times.
A production-ready application plus the evidence your internal audit, external certification body or corporate client needs to sign off the relevant Annex A controls.
Here are four patterns we see among organisations that approach us for an ISO 27001 compliant development project. If one of them sounds familiar, we'd be glad to talk.
Your largest customer, whether a bank, insurer, retailer or public body, puts ISO 27001 into the contract and carries out its own due diligence. A SaaS product without demonstrable security by design drops out of the selection. The new application or integration you are building now needs to be explainable through that lens from the first release.
You're a healthcare provider under NEN 7510 (the Dutch extension of ISO 27001 for healthcare), a municipality or independent administrative body under BIO (the Dutch Baseline Information Security for Government), or an entity under Wft or DNB supervision. The standard isn't an optional badge but a legal or supervisory basis for how you run your business.
You are working towards initial certification and want to avoid unexpected non-conformities at Stage 2 caused by the new application. The ISMS is not fully in place yet, the policies are still being written, and the software is being developed in parallel. We work alongside your information security officer or CISO and build at that pace.
The application handles patient records, financial transactions, biometric data, children's records or confidential business information belonging to your customers. A data incident affects not only you but also your customers and their customers. A security-based architecture is therefore not a luxury but the starting assumption.
With OneDayBuild, we turn your idea into something tangible in one day for €1,150, so you can see whether further development is worth the investment. Decide to go ahead with the full build? Then we credit the full cost.
Explore OneDayBuild →A conversation in which we understand which application you want to build, which regime applies (standalone ISO 27001, NEN 7510, BIO, SOC 2 overlap, customer due diligence), what data will be processed and which core systems are involved. We also establish whether your organisation's ISMS is already in place or still needs setting up, and which information security officer or CISO we'll be working with.
A workshop with your CISO or security officer, plus the business owner of the system. We run a threat modelling session (STRIDE or PASTA), document the relevant Annex A controls that are in scope, such as A.5 access control, A.8.24 cryptography, A.8.25 to A.8.28 secure development, and A.8.15 and A.8.16 logging, and choose architectural patterns that address those controls. At the end, you have a controls mapping document, an initial architecture, and a sprint plan that puts security decisions first.
We work in two-weekly sprints, and every sprint passes through the same gates: four-eyes code review, SAST and SCA scanning, IaC policy checks, end-to-end testing and a security acceptance check. The threat model is updated whenever the architecture evolves. An independent penetration test is scheduled before go-live rather than after, so findings are still in scope. Dependency and container scanning runs continuously, so a new CVE is picked up within a manageable timeframe.
On handover, your CISO receives a complete evidence pack: the threat model, controls mapping, penetration test report, restore test, incident response runbook and the operational runbooks for management. During your audit, we support you with answers to questions that specifically concern the software. From go-live onwards, we provide monitoring, patch management, dependency updates, periodic retests and ongoing development, so the system remains in good shape for future audits too.
The questions CISOs, security officers and compliance officers most often ask us before a project begins.
A 30-minute introductory call, no strings attached. We listen to which application you want built, how far along your ISMS is, what data is processed and what your customers or regulators specifically ask for. You leave with direction you can act on straight away, even if we don't end up working together.
On applatenmaken.com, our platform focused on custom software development, you'll find more on ISO 27001 and your software supplier. For email authentication and DNSSEC as a standalone measure, see DMARC and DNSSEC monitoring.
Appfront uses cookies and similar technologies to keep the website working properly, for analytics and for marketing. You choose what you allow. Read more in our privacy policy.
