Feasibly brought an engineering mindset to ISO 27001, building an ISMS designed to remain useful beyond the audit.
Feasibly builds AI agents for renewable energy developers. The team knew ISO 27001 was something it would need to pursue and decided to act early, making future conversations easier for prospective and existing customers.
Building an ISMS that fits the team
Feasibly chose Probo, an open-source compliance platform, as the place to build and manage its ISMS. Its AI-first approach suited the team, while its open-source structure gave them the flexibility to adapt it to the way they worked. Policies, responsibilities and evidence could all be organised there from the start.
They treated the preparation like another product build. The work became tickets in Linear, grouped into sprints and tracked alongside everything else the team was building.
Feasibly’s approach to ISMS
“I think we approached it like it was a technical build. So we developed tickets, spec docs. Sprints and just did it.”
Feasibly already had practical security measures in place across its product development, infrastructure and day-to-day operations. ISO 27001 was new to the team, but much of the underlying work had already been done. The main lift was documenting that work in Probo and turning founder and early-employee knowledge into a shared reference point. This meant mapping decisions against the standard, assigning clear ownership and gathering evidence to show how the controls worked in practice.
Together, this gave Feasibly a company brain for security, with one place to find and maintain the knowledge behind its day-to-day work.
Working through the audit
Once Feasibly was audit-ready, it completed Stage 1 and Stage 2 and received certification within around two weeks.
During that time, Calibre reviewed how Feasibly’s controls operated in practice, from access management and cloud security to secure software development and incident response. It also considered how the different parts of its ISMS worked together across the business.
The audit gave Feasibly an independent review of the ISMS it had built, while creating space to work through its implementation with an auditor who understood the realities of a startup. In the follow-up conversation, the team described the audit experience as “fantastic”.
What the team takes forward
Feasibly now has a clear starting point for bringing new colleagues into its security practices. With its policies, processes and responsibilities formalised in Probo, the same structure can support onboarding as the company grows.
“In the long run as a business, the experience of being able to talk through things with you concretely will be super helpful.”
The preparation has already proved useful beyond ISO 27001. In the same week, Feasibly drew on the work for its Cyber Essentials submission, applying the same foundation across another assurance framework.
The team sees it as a useful way to give security and procurement teams more confidence in how the business manages information security.
