Manufacturer heading for ISO 27001 learns its controls exist but almost none can be proven
A large automotive and industrial components manufacturer. Outcome verified
The problem
A large automotive and industrial components manufacturer decided to pursue ISO 27001 certification to give customers a verifiable security baseline, but had never measured itself against the standard across headquarters and its plants. Security practices existed, yet most lived in people's heads or in tools nobody had validated in years, and plant staff were double-booked.
Why it mattered
Certification is on the path to keeping and winning customer business. Entering a certification audit blind risks a failed Stage 2 and wasted spend.
What we did
Vizius fielded a small senior team: a technically strong lead assessor plus a compliance engineer who handled evidence so interviews stayed focused. Every requirement was scored under both a strict certification lens and a lenient one, to separate controls that are absent from controls that merely lack formal proof.
What changed
Preliminary findings across 127 requirements showed only one fully satisfied under the strict lens, with 42 major nonconformities concentrated in three root causes: documentation currency, monitoring and supplier security. That gave leadership a clear remediation order; the final report was in review in September 2026.
- Manufacturing
- Large company
- ISO 27001