PromoVeritas: Moving from an In-House Compliance Officer to an Outsourced vCISO
How an outsourced, part-time security leader (a vCISO) gave PromoVeritas continuous security leadership through a period of change, reviewed the security risks posed by every supplier in its network, and helped the business meet every requirement across two ISO 27001 audits.
Client overview
PromoVeritas (PV) is an international marketing compliance and prize promotion verification specialist with more than 20 years’ experience, helping brands and agencies run compliant campaigns across the UK and internationally. As a trusted compliance partner to high-profile clients, PV holds its own information security to the same standard it verifies in others.
The challenge
When PV’s Information Security Manager left the business, PV needed someone to take over responsibility for its information security processes and documentation (known as its ISMS) without any gaps, ahead of its next certification audit.
- Someone needed to take over responsibility for the company’s security processes at short notice, ahead of a scheduled audit.
- The latest version of ISO 27001 meant the company’s control documentation and risk treatment plan needed refreshing and strengthening ahead of the external audit.
- PV also wanted to check the security risks posed by its growing number of suppliers, as required under the ISO 27001 standard.
Our approach: an outsourced security leader (vCISO engagement)
We stepped into the security leadership role on a flexible, embedded basis, structured in two phases.
Stabilise and certify
- Took over day-to-day responsibility for PV’s information security system — including its risk log, set of policies and supporting evidence — so there was no gap in security leadership from day one.
- Improved the company’s documentation and supporting evidence and reviewed the security risks posed by every supplier PV works with.
- Prepared staff and leadership through training, reviewed the evidence, and ran through what to expect on the day, helping PV achieve ISO 27001 certification.
Sustain and advance
- Continued as PV’s outsourced security leader, providing ongoing, year-on-year oversight of the company’s security leadership and processes.
- Led the move from the 2013 version of the ISO 27001 standard to the updated 2022 version. This included reviewing what needed to change, and updating the company’s security controls, risk treatment plan and Statement of Applicability (the document that lists which security controls apply to the business).
- Ran internal check-ins and practice audits to make sure PV was ready, then supported the business through the official audit — meeting every requirement, with no gaps found.
Gemma CuttingManaging Director, PromoVeritasCorrect Group has been instrumental in supporting PromoVeritas through both the maintenance of our ISO 27001 certification and our transition to the ISO 27001:2022 standard. The team’s technical expertise is exceptionally strong, combining a deep understanding of information security principles, risk management, governance and compliance with the practical ability to translate complex requirements into workable business processes. Correct Group has helped us strengthen our ISMS, enhance our security controls and ensure our policies, procedures and documentation remain audit-ready and aligned to best practice.
The results
PV kept experienced, senior-level security leadership in place throughout a period of internal change — without the cost, delay or risk of hiring someone permanently. Its high-profile clients continued to receive ongoing assurance about PV’s own approach to security, reinforcing PV’s reputation as a trusted compliance and verification specialist.
Gemma CuttingManaging Director, PromoVeritasBeyond the technical delivery, Correct Group has become a trusted adviser to us on all matters of InfoSec. The team takes the time to understand our business, provides pragmatic and commercially focused guidance, and is always responsive, approachable and professional. Rather than simply interpreting the standard, Correct Group works collaboratively with us to embed information security into the way we operate. Their support has given us confidence that our security and compliance programme is not only meeting certification requirements but genuinely adding value to the business.