Auditors rarely leave empty handed. There is usually something on their list: a procedure that needs updating, a missing document, an access right that should have been revoked months ago. At ACA Group, that list stayed empty this year.
In 2026, BSI Group, an internationally recognised certification body, carried out our first annual surveillance audit since we became ISO 27001 certified. The report lists zero nonconformities, major or minor.
The audit at a glance
Who
BSI Group, an internationally recognised certification body
What
Our entire Information Security Management System (ISMS)
When
2026, the first annual audit since certification
Result
0 nonconformities
ISO 27001 is the international standard for information security. So an audit goes far beyond firewalls and passwords. The auditor examines the whole system we use to protect information. Who gets access to which data, and who decides? How do we assess risks, and what do we do about them? What happens when something does go wrong?
And above all: do our people actually work the way the procedures say they do? That is often the hardest part. Anyone can write a good procedure. Making sure every colleague follows it on a busy Tuesday afternoon is another story.
An ISO 27001 certificate is not something you frame, hang on the wall and forget about. Every year an auditor comes back to check that you still do what you promised. That keeps you sharp.
The first year after certification is also a real test. Before the initial audit, everyone is on their toes. A year later, you find out whether the system keeps running once that pressure is gone. For us, it clearly does.
Curious how we earned the certificate in the first place? Simon Vercruysse explains it in his blog about our certification.
For our clients, this is more than a nice report. It has a few very practical consequences.
Fewer questionnaires. When you choose an IT partner, you need to check how they handle information security. That usually means long questionnaires, extra documents and yet another meeting with your security officer. A valid certificate, freshly confirmed by an independent auditor, answers many of those questions in one go. Want to see for yourself how we handle security and compliance? Take a look at our Trust Center.
Support for your own obligations. Regulations such as NIS2 require more and more organisations to keep an eye on the security of their suppliers. If you work in finance, healthcare or government, you need to be able to show that your partners can be trusted. This report is solid evidence for that.
Your data in safe hands. Access to your applications and data is strictly controlled. Only people who need it for their work get access, and that is reviewed regularly.
A plan for when things go wrong. No system is invulnerable. If an incident does happen, we follow a fixed approach that has been tested and externally reviewed. So you know in advance what to expect from us.
That applies to everything we do for you, including the custom software we build. Security is part of it from day one, not something added at the end.
Resting on our laurels is not an option. Threats evolve, technology does too, and what is enough today may fall short next year. That is why we keep improving our system.
In a year's time, the auditor will be back at our door. Our goal is simple: send them home with an empty list once again.
Questions about the security of your project?
We are happy to explain how we protect your applications and data.
What our ISO 27001 certification means for secure software
How to use machine learning without worrying about privacy
All posts on security and privacy