Queensland MSP ADITS supports more than 15,000 users and has its sights set on doubling that number by 2030. Strong governance is central to that ambition. Through its partnership with ISO365, ADITS has achieved four ISO certifications, improved everyday business processes and strengthened accountability across its team, with a fifth certification now underway.
Celebrating its 20th anniversary this year, ADITS was founded in 2006 as a technology provider in Bowen, North Queensland. Over the years, the managed IT services provider (MSP) has grown into a major force in the Australian IT industry.
With a team of 60+ professionals, ADITS supports more than 15,000 users across Queensland, delivering services to sectors including medical, not-for-profit, education, defence, and professional services.
As an MSP operating across these sectors, the ability to demonstrate independently verified governance standards isn’t a nice-to-have. It’s a commercial imperative.
Today, ADITS holds four ISO certifications (ISO 27001, ISO 9001, ISO 14001, and ISO 42001) and is currently working towards ISO 27701.
Inherited certifications, unfamiliar territory
ADITS didn’t come to ISO365 without some compliance history. In 2020, the business acquired a company with several ISO certifications and decided to adopt them and integrate them across the wider business.
However, says Chris Grasso, General Manager at ADITS, the process quickly became far more complex than anticipated.
“When we started looking at the audit material, it was apparent there were a lot of gaps between what the other business had been doing and where we'd need to get ADITS to become certified,” says Grasso.
“We honestly didn’t have anyone internally with the exposure, experience, or available time to bridge the gaps. We’re not a large business either, so employing a dedicated compliance resource didn’t make commercial sense. We needed a different approach – and ISO365 offered us just that.”
– Chris Grasso, General Manager, ADITS
The ISO Guy
Grasso first met ISO365 founder Jason Maricchiolo (aka The ISO Guy) in 2023 through the MSP community at a ConnectWise Evolve peer group, and ADITS became one of ISO365’s earliest clients.
“The referral to Jason came at exactly the right time,” says Grasso. “The undertaking to become certified was far more than we’d anticipated – so his services were very appealing to us.”
“What made the engagement work for us wasn’t just their ISO experience. Jason’s background in the MSP sector meant that ISO365 could integrate the work into the software platforms we already used. We didn’t need to go out and purchase or learn a new solution or tools.”
– Chris Grasso, General Manager, ADITS
ADITS and ISO365 started with ISO 27001 certification. They soon followed with ISO 14001 and ISO 9001. They completed ISO 42001 for artificial intelligence management a couple of years later, and ISO 27701 for privacy is currently in progress.
That’s five certifications. Three and a half years. And one partner.
A team that earned the trust
Grasso came in with two specific reservations.
"In the early days, I was unsure how an external party could get to understand our business in the depth needed. But they did. ISO365 proved me wrong very quickly.”
Grasso’s second concern grew as ISO365 scaled.
"As Jason added on more clients and employees, I was worried that they might struggle to maintain their level of service and consistency. But I needn’t have. Despite the challenge of finding staff who had the very specific skill sets he and his clients needed, he did it. ISO365 has ended up with a strong team; they all seem to be singing from the same song sheet. It’s great to see them work so well alongside our people.”
Beyond the paper trail
Certification produced more than documents for ADITS. It changed how they operate.
One of the clearest changes was in how ADITS manages its vendors, says Grasso. “We’ve been making sure we ask the right questions and ensure they comply with the standards we hold at ADITS. Having a full register and assessing a new vendor before bringing them on board is something we didn’t do before we were ISO certified. We wrote the policies and procedures, but we weren’t necessarily practising them. Now, we’re held to account.”
Physical access control was another. Before certification, says Grasso, ADITS had door locks but no formal way to track staff comings and goings. "Everyone now has swipe and ID cards. Looking at it through an ISO lens, you see the real benefit behind it.”
ADITS also formalised its offboarding processes. “All of those processes are now very well documented and run through almost an automation, where tasks are assigned, and things get actioned quickly,” says Grasso. Tasks include access deactivation through to the return of physical assets like phones and laptops.
ISO365 also helped ADITS work out who inside the business was best placed to own each certification. “ISO365 helped us identify the people already within our business with the necessary skill sets. Luckily, we have a lot of very process-driven, analytical people on our team, so that made it easier. We were able to divvy up the different certification responsibilities and assign them with confidence.”