For James Leavesley, CEO of Cultiv8tiv, information security needed to be built in early.
Cultiv8tiv is an AI-powered culture platform that helps organisations understand their workplace culture using anonymous employee assessments and AI analysis. That means handling sensitive information, from employee details to confidential responses.
For James, ISO 27001 certification was a practical way to show clients that trust, security and data protection were being taken seriously.
“We are dealing with an organisation’s employees,” James explained. “All of that data needs to be protected, and our clients should know that we care about their data and have gone to the lengths of becoming certified to prove that.”
That’s what brought James to ISO 27001, and to Citation ISO Certification.
The challenge
James wasn’t new to ISO 27001. He’d taken a previous tech business through the same certification process and knew how demanding it could be without the right support.
“That process took us a year. A consultant helped us get prepared, but they didn’t get us through the certification itself — we still had to do a lot of the legwork, and then find another provider to get us over the line. It was disjointed, and more expensive to get to that initial certification.”
This time, with Cultiv8tiv still a small business, James wanted to avoid repeating that experience — and to get certified early enough for the business to grow with it.
“I chose to get certified early in our journey because it meant we could build on a strong foundation.”
The solution
One of the biggest differences was the support.
Working with Citation ISO, James felt guided through the process, rather than being left to work everything out alone. He described it as needing a “navigator” — someone to help pull out the right information, structure it properly, and keep things moving.
“A lot of the hard stuff we did together,” he said. “A lot of the easier stuff I was able to then do by myself.”
That made a real difference for a busy CEO managing ISO 27001 alongside the day job.
“It wasn’t overwhelming,” James said. “It’s not effortless, but actually it was manageable.”
The commercial model made a difference too. For an early-stage business, avoiding a large upfront cost made it easier to start sooner.
“Your cost model was the most attractive thing. When you’re an early-stage business looking at ten grand as a one-off plus fees, you’re really weighing up when to do this. A single monthly fee, from one provider who supports you through the assessment as well.”
The impact
The difference was clear. Cultiv8tiv completed the process in around three months, compared with around a year the first time James went through ISO 27001.
“I think this process took us maybe three months, from start to finish, where the last one took a year. Things were provided in a much more structured way.”
The audit experience was smoother too. James’s previous audit took around three days. With Citation ISO Certification, it took one.
“Because you’d already helped build the system, you already had access to the information, so a lot of the questions could already be answered. It went from three days to one day.”
Beyond the certification itself, James sees ISO 27001 as an ongoing commercial advantage. It helps Cultiv8tiv give clients confidence, respond to tenders more easily, and reduce the time spent answering repeated security questions.
“If you’ve got to go through a client’s data security and information security questionnaires, it’s a 20-hour exercise if you want to do it properly. ISO saves you all of that. It just makes things easier for tenders and conversations, especially if you’re dealing with IT people.”
Would he recommend it?
For James, the biggest lesson is simple: don’t wait until your business is bigger to get started.
“I chose to get the certification early in our journey because then it meant we could build on a strong foundation. It will pay for itself the earlier that you get it, and you can get it earlier with Citation ISO.”
James Leavesley
CEO, Cultiv8tiv
Ready to make ISO 27001 more manageable?
Speak to our team about certification support.
Login 
