As tech scaleups grow, so do expectations: more clients, more funding, more scrutiny.

At this stage, security often starts to show up as a bottleneck. That is when many turn to ISO 27001. But it rarely plays out as the checkbox exercise they expect.

At LeftBrain, we help fast-moving teams implement ISO in a way that supports growth, not slows it down. In this conversation, our GRC Lead Lucas Jansen shares how ISO helps reduce risk, remove guesswork, and build the systems needed to scale securely.

Can you introduce yourself and your role at LeftBrain?

I’m Lucas Jansen, the GRC Lead at LeftBrain. That stands for governance, risk, and compliance. I look after our internal ISO 27001 compliance and also support our clients through their own certifications. Right now, my focus is on helping scaleups under pressure move their security posture into a stronger and more comprehensive place.

Do companies often think ISO 27001 is just a tick box exercise?

Definitely. A lot of clients come in thinking it’s something they can get through quickly. They see it as a step they need to take so they can work with bigger partners or meet procurement requirements.

But ISO 27001 requires real ownership. It touches how your business actually runs. It involves leadership buy-in, managing risk, controlling access, documenting processes, and understanding how you store and handle data. Teams are often surprised by the level of detail at first, but they quickly see the value once they get started.

What makes ISO 27001 a growth strategy rather than just a compliance task?

ISO brings structure to fast growth. It helps teams get clarity on things they may not have thought about yet. You are given a set of requirements, but how you meet them is up to you. That flexibility makes it scalable and achievable.

Once implemented, ISO helps reduce complexity. You know who has access to what, where your data lives, and what systems are in use. That makes onboarding smoother, enables client access faster, and makes growth more consistent and sustainable. It also gives you clear evidence of your maturity as a business, not just to auditors but to investors and partners too.

Can you give an example of a policy that has had real business impact?

One of my favourite examples is an access control policy. It outlines how employees are expected to access business resources. That might sound simple, but it makes a big difference. Even something like saying, “do not go looking for data you are not meant to access” can help people understand their responsibilities.

This kind of policy is not just about control. It is about trust, clarity, and helping teams know how to handle sensitive information properly. It is also a safeguard. A clear policy helps reduce security risk and gives you a foundation to build on with additional controls. It is not just for audits — it is the first step in your own risk management approach.

How does LeftBrain support clients through ISO 27001?

What I love most about how we work is that clients get access to our whole team’s expertise. You might only speak to one consultant, but behind the scenes we are all involved. We have people with different strengths — from technical engineering support for identity and access, to policy specialists who understand different risk areas.

That collective experience means clients are not stuck figuring it out alone. They do not need to hire a full-time person to manage ISO or exhaust their internal team. We bring the structure, keep momentum going, and help implement everything without draining resources.

What problems does LeftBrain help solve with ISO support?

We solve time, clarity, and confidence. ISO can feel overwhelming when you first start. But once you go through it with us, you gain a clear understanding of what is in place, where the gaps are, and how to respond when questions come from investors, partners, or clients.

You are no longer scrambling to answer a security questionnaire. Instead of saying, “we are working on it,” you can say, “we have an access control policy and enforce it with technical controls.” That builds trust quickly.

It also gives peace of mind. You know the answers to the important questions, and you are not guessing anymore.

Any final thoughts for scaleups considering ISO 27001?

ISO is one of the most valuable things a growing business can do. It helps you address tricky questions early and set a foundation you can build on.

But it only works if you treat it as a business framework, not a checkbox. The companies that try to do the bare minimum really struggle to maintain it — especially when the next audit comes around. With the right structure and support, ISO becomes something that helps you grow with clarity and confidence.