Most managed service providers (MSPs) come to ISO certification once they’re already established. By then, the habits have formed, the culture has set, and change is harder than it should be. techENVY didn’t wait.
When they launched techENVY in October 2021, co-founders Anthony Quaresima and Murat Sener decided to put the processes, governance and certification in place from day one.
No ticking legacy bombs
Quaresima and Sener built their Melbourne-based MSP from scratch. The two founders had worked together since 2011 and were keen to avoid the issues they’d experienced in previous roles.
“We didn’t want techENVY to be held back by inherited infrastructure and processes. We wanted to do everything 100% right from the start,” says Quaresima. “I’ve spent enough time in operations in larger organisations to know what happens when governance and process come after growth rather than before it. And it's very hard to change a business the bigger you get. People don't like change in general, and there's always resistance when you try.
“So we started with nothing but some great contacts and a determination to do everything the right way. Because we didn’t have any legacy bombs to work around or defuse, growing techENVY wasn’t nearly as stressful as it could have been.
“Because we did that work before we started to grow, there were no bad habits to pick up. Our employees started with us knowing we run a high-security environment, that we’re ISO certified, and that we have compliant policies and procedures already in place. And they knew what they needed to do to do their jobs well.”
– Anthony Quaresima, Co-founder, techENVY
The right call on where to spend the time
Quaresima also knew that managing the certification process internally wasn’t the answer. He'd watched what happens when businesses try to build ISO frameworks themselves.
“It can be a completely convoluted process, with documents that actually deteriorate your day-to-day work and add a lot of red tape. You might write a whole stack of framework documents, revise them, and they don't work; then you're rewriting again.
“But if you use someone with experience in ISO certification from day one, it's smooth sailing. Best practice is embedded in your company, and then you're on to the next thing.”
Saying ‘no’ to ISO DIY
Quaresima already knew ISO365 founder Jason Maricchiolo. So when techENVY launched, bringing in ISO365 was an easy call.
“We had a business to grow,” says Quaresima. “We didn't want to take our focus away from developing or supporting our managed services customers. Yes, we knew we could do it if we really wanted to, but we knew it would never be the best use of our time.
“Writing ISO-compliant policies and procedures and running meetings at regular intervals eventually becomes a full-time role. And we certainly didn't want to be one of those businesses that buy a cheap pack of ISO documents online and spend months rewriting them while also trying to run a business.
“If you use experts, you can get on to the next thing that’s important to you more quickly.”
Three certifications later
techENVY and ISO365 started with ISO 27001 for information security. ISO 9001 for quality management came next.
ISO 42001 for artificial intelligence management followed as soon as it became available. techENVY was among the first businesses in Australia to achieve it.
“AI governance is a big part of the future with AI. We wanted to have a framework in place so we could evolve along with it, not fall behind,” says Quaresima.
Easier than playing catch-up
Five years in, with 10 staff, Quaresima is matter-of-fact about their decision to gain ISO certification as quickly as possible.
“I think it's easier than playing catch-up all the time. When you do the bare minimum, you're just chasing your tail each time. MSPs are notoriously stressful and highly transactional. Anything you can do structurally to make things smooth is going to pay dividends for a long time.”
ISO365's approach suits the way techENVY operates.
“It was great to work with Jason and his team. It was get-to-know-your-business conversations, understanding what we had in place and what we didn't. Everything with ISO365 is very systematic. Everything's documented – even internally, how clients handle audits and how implementations are done. It's a consistent process,” says Quaresima.
From client to partner
The relationship with ISO365 extends beyond techENVY's own certifications. The two businesses work together on ISO projects, with techENVY referring its clients to ISO365 for certification work.
Quaresima has seen ISO365's Compliance-as-a-Service (CaaS) model from both sides: as a client and as a referring partner.
“They know how we work. We know how they work. They’re a true extension of our team. They become an internal compliance department – and having a product that you can go to market with to get clients certified is a lot better.”
– Anthony Quaresima, Co-founder, techENVY
“As ISO365 has grown and brought on team members, Jason’s strategically placed them in the correct spots. He's got a good model that will scale quite large, no problems at all.”
He's appreciative of ISO365’s work on shared client projects. “I have seen their process not just for myself, but for shared ventures together. It's been constant throughout.
“We like to focus on what we do well, and bring in others who are good at what they do,” says Quaresima. “And Jason and his team are very good.”