ISO 27001 Stage 1 and Stage 2: ServiceRocket Case Study

At a glance

ServiceRocket, a technology services company, completed its first ISO/IEC 27001 certification process with Insight Assurance across three phases: a Gap Assessment, a Stage 1 audit and a Stage 2 audit. After each audit day, the audit team debriefed on topics covered, findings and follow-up items. ServiceRocket remediated all nonconformities without major issues.

Client: ServiceRocket Inc., a technology services company that helps teams adopt, use and manage software
Framework: ISO/IEC 27001 (first certification)
What they needed: A clear, structured certification process and an audit team that could work across several time zones
What Insight Assurance did: Ran the Gap Assessment against ISO/IEC 27001 requirements and the Stage 1 and Stage 2 certification audits; certificate issued through IA Certifications
Result: ISO/IEC 27001 certification completed; ServiceRocket remediated all nonconformities without major issues
Next step: Two surveillance audits planned in the certification cycle

ServiceRocket supports organizations with technology services designed to improve how teams adopt, use, and manage software. As part of its commitment to security and operational trust, ServiceRocket pursued ISO/IEC 27001 certification. It was critical for the company to validate its information security management system (ISMS) through an independent certification process.

ServiceRocket engaged Insight Assurance for its first ISO/IEC 27001 certification process, covering a Gap Assessment, a Stage 1 audit, and a Stage 2 audit. The certificate is issued through IA Certifications, an independently accredited certification body.

ISO/IEC 27001 certification can feel overwhelming the first time an organization pursues it. ServiceRocket needed to understand what each phase required, how to prepare documentation and evidence, and how to address audit findings without losing momentum.

The company also needed an audit team that could coordinate across several time zones and give clear answers to process questions. Effective communication was paramount, so every stakeholder could understand the requirements in a way they could act on.

Insight Assurance ran the engagement as a structured certification process covering the Gap Assessment against ISO/IEC 27001 requirements, the Stage 1 audit, and the Stage 2 audit. (For a phase-by-phase overview, see the ISO 27001 certification process, step by step.) After each audit day, the Insight Assurance team provided timely debriefs, with summaries of the topics covered, all relevant findings, and follow-up items.

What did ServiceRocket’s ISO 27001 certification process include?

A Gap Assessment, a Stage 1 audit and a Stage 2 audit, followed by planning for two surveillance audits in the certification cycle.

ServiceRocket also highlighted Insight Assurance’s responsiveness when questions came up, including clarification of the ISO 27001 internal audit requirements for acceptable internal auditor qualifications and of the evidence expected for controls.

“The ISO 27001 certification process, encompassing the Gap Assessment, Stage 1 Audit, and Stage 2 Audit, was executed with clear structure and guidance,” said Catherine Matterson of ServiceRocket Inc.

The audit team’s professionalism and responsiveness also stood out. ServiceRocket noted that its main auditor was selected with time zone accessibility in mind, which made follow-up communication easier for a team spread across several time zones.

ServiceRocket completed its ISO/IEC 27001 certification process with Insight Assurance and remediated all nonconformities without major issues. The team now has clearer visibility into certification expectations, audit evidence, and control documentation.

A transparent engagement structure also let ServiceRocket plan for the full certification cycle: initial certification and two surveillance audits.

“We are first timers for the ISO-27001 certification,” Matterson shared. “Insight Assurance was chosen after careful review, and we could not have been happier with the outcome.”

If you are pursuing ISO/IEC 27001 certification for the first time, ServiceRocket’s experience shows the value of a structured audit process, clear communication, and a certification team that keeps expectations understandable from start to finish. Read more case studies.