The Virtual IT Department (VITD) has provided IT services to Australian organisations since 2001. The business started in founder John Cromie's lounge and grew around supporting the disability and aged care sectors. Today, John’s daughter, Anna Furlong, and her husband, Liam Furlong, run the business, with Liam serving as Director of Product. Twenty-five years on, VITD has a 50-strong team and customers Australia-wide.
Concentrating on compliance
When the Furlongs took over VITD, the company’s compliance infrastructure needed attention. With a successful track record of leading ISO 27001:2013 accreditations at software companies, Liam took ownership of the certification process and subsequent upgrade to the ISO 27001:2022 framework.
To support their compliance efforts, VITD adopted ISMS.online, a cloud-based compliance platform that supports various ISO compliance frameworks.
Furlong envisaged the ISO certification as a collaborative effort, engaging VITD's whole team in the process. Six weeks in, he realised they weren't making progress. “It was great, but we weren’t being realistic. It was a kumbaya moment when we decided that getting ISO certified is an autocratic experience, not a democratic one.”
Furlong took a month out of the office to get the company’s policies and controls in order. “We agreed that once I’d done that, we’d hand it back to the team and talk about iterative improvement. But trying to take everyone on the journey in the first instance was just silly – a bad idea. In retrospect, I can say that because I’d been through the ISO process several times, I probably had an overly enhanced view of my capability rather than a realistic one.”
After three months of hard work, the auditors were satisfied, and the certification came through. But despite this, Furlong says they weren’t happy with the outcome. “The platform didn’t allow us to evolve the way we did business. It brought us up to a particular point, but it wasn't going anywhere from there.”
One of the main issues was where the compliance lived. "While we’d become more and more confident and comfortable with our set of standards and knew what we were doing, we found the process frustratingly disconnected. An extra tool sat between us and our documents. If we wanted to review anything, we basically had to go to their library instead of pulling it from our own bookshelf. It was infuriating. We wanted easy access to our documentation, so we could constantly refer to and refresh it.
“While VITD had a certified management system, we didn’t have compliance embedded in how our people actually worked. So, we started looking at what we could do to bring it all across ourselves into tools that we were already using.”
– Liam Furlong, Director of Product, The Virtual IT Department (VITD)
More than a platform
Through the auditors VITD used, Furlong met ISO365 founder Jason Maricchiolo.
“Jason was upfront, saying that they could make a big difference for VITD, and that what we envisaged as a way forward was exactly what they'd want for us too,” says Furlong.
“The main appeal of ISO365 wasn't just a better platform. It was something no platform could deliver on its own. We wanted the challenge of improvement, a great experience, and deeper integrations. We wanted accountability and support. And those were all things that Jason and his team could deliver."
Getting the data across
Moving from ISMS.online to ISO365’s SharePoint platform required Jason’s team to consolidate 97 control lines (each with its own document) into 40 policies.
Every policy started with the intent, then the detail, then an "as measured by" section: specific, tangible things that VITD employees could look at in their own workspace to understand what the policy actually meant in practice.
"Moving required us to put in the effort and own the outcome,” says Furlong. “But I don't think that's a bad thing. However, if we’d started with ISO365’s platform, it would have been much easier. Their templates are better.
“The outcome is a simpler structure that’s made it easier for our teams to read everything rather than being overwhelmed by the wall of policies that they faced every time they logged into the other platform.”
The value of extra expertise
While VITD knows ISO 27001 well, Furlong is the first to say that can work against them.
"We still look to ISO365 for ISO guidance around 27001. When we go off the deep end and get carried away with technical things that drift away from the heart of the intent, they challenge us. They do a great job of bringing us back."
That willingness to be challenged opened new ground. After a year or so, ISO365 helped VITD achieve ISO 9001 for quality management, a standard completely outside their existing expertise.
ISO365 really shines, says Furlong, when it comes to maintaining certification. “To get your certificate, you need to prove intent to improve, but ongoing audits require you to provide evidence. That’s much harder.”
“It's the ongoing support, the monthly meetings, the reviews, and everything that goes towards staying on track where they absolutely prove their value. When I'm having a busy month, I can still be confident that things won't slip and fall off. That's what excited me most when we engaged ISO365 as our virtual compliance team.
“I knew that if I had competing priorities, it wouldn’t impact our ISO compliance, no matter how busy things get. They hold us accountable and challenge us to do better.”
– Liam Furlong, Director of Product, The Virtual IT Department (VITD)
Adding value with ISO365
VITD has no hesitation in referring its own clients to ISO365.
"Most of our clients don't know what they're doing in the compliance space. But they do know what they don’t want. And that’s 40 manuals on a shelf that they have to read to every new person, and which they know no one's following. They don't want to put their heads in the sand. They want to run a good business. Most organisations need someone passionate and available. And that’s why we introduce them to ISO365."
Inside VITD, the question of cost never comes up, says Furlong. "We don't debate the cost internally. It's a no-brainer for us. We have a wonderful relationship with ISO365, and we know the value of improving how we do business.