When a private equity sponsor bought a data and analytics business out of a large public company, the business inherited the parent's obligations without the parent's security organization. For the first time it owned its own security posture, with enterprise customers to answer to and standing privacy commitments to keep. It needed a security program of its own and its first ISO 27001 certification. Partway through that work, the company acquired another firm that ran its own information security management system (ISMS), with its own policies, tooling, and ways of working. Running two programs side by side would have doubled the cost and confused every audit that followed.
We built one ISMS for the combined company. The scope covered both organizations from the start. We mapped the acquired company's controls against the target control set, and wherever the two programs overlapped, the stronger control won. Policies were consolidated rather than duplicated, the two risk registers became one, and Vanta became the single compliance platform, so evidence from both sides of the acquisition landed in one place.
The integration ran alongside certification preparation rather than after it. That sequencing meant the Stage 1 and Stage 2 audits examined the company as it operated after the acquisition, not the company as it looked before the deal. Certification came from an accredited certification body. BD Emerson implements ISO 27001 and prepares companies for the audit; it does not issue certificates.
The company earned its first ISO 27001 certification with the acquired company inside the scope. It runs one management system where there could have been two, and one compliance platform that the whole organization shares. The acquisition shows up in the org chart and nowhere in the control environment.
Client details in this case study are generalized, and in places combined across engagements, to protect confidentiality. The work combined our carve-out advisory and ISO 27001 consulting practices, and our guide to private equity carve-outs covers what a sponsor takes on when it buys a business out of a parent. We are glad to walk through comparable work under NDA.
