From customer requirements to the ISO 27001 security standard

This customer success story shows how the digital agency Sprintwerk navigated the path to ISO 27001 certification with heyData, turning a client requirement into a core part of their own workflow. Learn how Sprintwerk worked with heyData to tailor an international security framework to a young, agile team without disrupting their day-to-day business.

Sprintwerk: digital solutions for companies with complex requirements

Sprintwerk develops custom digital solutions for companies that have outgrown standard software - from internal tools and bespoke applications to entire platforms. The team works fully remotely and supports clients in healthcare, the public sector, and the mid-market, as well as smaller start-ups.

Through previous projects in the healthcare sectors, the team was aware early on of the importance of information security in regulated industries.

A corporate standard for a small, remote team

Sprintwerk had two main reasons for pursuing ISO 27001 certification. The first was very practical: clients in regulated industries like medicine, as well as several mid-sized companies, made certification a prerequisite for collaboration - including one major potential client that requires it from all its service providers.

The second reason went deeper: Sprintwerk didn't want to use information security as a mere marketing promise, but as something truly embedded in the company. Since clients entrust the agency with their software and data, they wanted to replace empty promises with solid, verifiable proof.

The real difficulty lay in the translation: ISO 27001 was originally designed for large, traditionally structured organizations with dedicated IT security departments - whereas Sprintwerk is a small, agile team without those structures. Added to this was the challenge of managing the process alongside daily operations without having dedicated compliance staff.

Solution: heyData as a partner on equal footing

It was clear to Sprintwerk from the start that the certification could not be implemented without external support and that outside expertise was the right way to go.

“We knew we wouldn't be doing the ISO certification entirely on our own. After doing some research, we found heyData. And that was an absolute stroke of luck for us.”
- Julia Streichan, co-founder of Sprintwerk GmbH

The key was not just providing templates, but adapting them together to fit Sprintwerk’s actual way of working. Instead of rigid patterns, the goal was to work with heyData experts to identify what was truly relevant for a small, remote team.

Three aspects of the collaboration were particularly valuable for Sprintwerk:

• A central platform for the entire process. Templates, tasks, and evidence were all consolidated in one place, allowing the team to focus on the actual content rather than wasting time organizing the process itself.
• A dedicated contact person. For the Sprintwerk team, it was clear that having one fixed contact person who could bring in additional specialists as needed was more efficient than dealing with a rotating team - this keeps the flow of information clear and traceable. 
• Focus on what really matters. Since Sprintwerk works fully remotely, many physical requirements from the classic ISO process could be ruled out from the start. Through close, interactive exchange with heyData, it quickly became clear where they needed to dive deeper.

“ISO 27001 was clearly designed for large corporations. That means multiple departments and likely a dedicated IT security team. We had to figure out how to adapt that to our needs. In that regard, both the ISO experts at heyData and the platform itself were incredibly helpful to us.”
- Julia Streichan, Co-Founder of Sprintwerk GmbH

Along the way, the entire team completed compliance training via the heyData platform. For a team without a dedicated compliance department, this was an essential step in maintaining the certification long-term rather than just achieving it once.

How ISO certification has changed things at Sprintwerk

Sprintwerk is now ISO 27001 certified. Just as important as the certificate itself is the fact that the process gave the team a structured view of their own way of working. Many workflows that were previously handled intuitively are now clearly documented, repeatable, and assigned to specific responsibilities. 

"We were already living by the principles of ISO 27001, but much of what we did was based on gut feeling. Now, however, those exact processes are repeatable and clearly assigned. We know exactly who is responsible for what. It's not a matter of "asking someone" anymore - it's one person, one process, one interval."
- Julia Streichan, Co-Founder of Sprintwerk GmbH

This solid framework provides Sprintwerk with security without restricting the flexibility typical of a digital agency: there is still plenty of room for creative and agile working methods within these clear guardrails.

After certification is before certification

For Sprintwerk, the journey doesn't end with ISO 27001 certification. On the contrary, it is the starting point for a more comprehensive compliance foundation. As a next step, the team plans to achieve ISO 9001 certification later this year to sharpen their quality management and make the agency's values visible to the outside world. Re-certification for ISO 27001 is already scheduled for next year.

Sprintwerk feels much better prepared for this next chapter: the team now understands the audit process, knows which policies apply, has a trusted partner in heyData, and is approaching future certification processes with greater confidence.

Conclusion: Why ISO 27001 is worth it for small teams, too

The success story of Sprintwerk shows that ISO 27001 is not a standard reserved exclusively for large, traditionally structured organizations. For young, agile companies without rigid processes, the standard is often easier to integrate than it would be later on, when team size, tools, and internal structures become more complex.

From Sprintwerk's perspective, the key is having a partner who flexibly adapts to your way of working, especially when remote-first operations and a lack of dedicated IT security structures don't fit the standard mold. With heyData as a central platform and a dedicated contact person, Sprintwerk was able to focus on their own documentation and security instead of wasting time organizing the process itself. The result: a certification achieved alongside day-to-day business, and a partnership that continues to grow.

‍