Three standards under one system, for a team of five

The problem

A broker of end-of-life IT assets sells trust: enterprise customers hand over data-bearing equipment and expect it to be handled responsibly all the way downstream. Those customers were asking for three different proofs at once, R2v3 for responsible recycling, ISO 27001 for information security, and ISO 9001 for process control, and building three separate systems would have tripled the documentation and audit load on a team that could be counted on one hand.

What we did

• Designed a single integrated Quality and Information Security management system (QIS MS) satisfying R2v3 Core, ISO 9001, and ISO 27001 with one manual, one set of objectives, one internal audit, and one management review
• Built the broker-specific R2v3 controls: downstream vendor qualification, broker transaction sheets tying every sales order to verified vendor certificates, and a focus-materials management plan
• Developed the ISO 27001 information security risk assessment and Statement of Applicability, refined through four revisions as controls matured
• Delivered R2 focus-materials and ISO 9001 awareness training to the whole team, and coordinated SERI licensing and certification-body registration for all three standards
• Conducted the integrated internal audit and led Stage 1 preparation in fall 2025; supported corrective actions arising from downstream vendor reviews

Services: R2v3 Core and Appendix A · ISO 27001 ISMS · ISO 9001 QMS · Integrated internal audit · Registrar coordination · Team training