Turning a certificate into an actual security program
Ownership of Lightmatter's ISO 27001:2013 → 2022 transition and full-scope re-certification, the build-out of the policy library and risk framework beneath it, and the governance restructuring that put security in front of the executive team.
A certificate on the wall, and very little behind it.
Lightmatter is building the photonic interconnect for the next era of AI compute — the kind of company whose customers and investors ask hard security questions early.
On paper the company was ISO 27001:2013 certified. In practice the steering committee's own assessment was blunt: minimal formal controls, with no dedicated security staff or leadership, minimal tooling, and checkbox-only compliance. Meanwhile the 2022 revision of the standard was coming, bringing eleven new controls with it. The task was not to renew a certificate — it was to build the program the certificate was supposed to represent.
What the work actually was.
ISO 27001:2013 → 2022 transition
Owned the transition end to end — gap assessment, risk-to-control mapping, policy development, internal audit, and external audit — including all eleven controls new to the 2022 revision. All 65 risks mapped to controls.
Full-scope re-certification, clean
Delivered full-scope re-certification with A-LIGN, certified 8 September 2025 with zero non-conformities: 93 Annex A controls plus management clauses tested across 20 in-scope systems, backed by 300+ evidence artifacts from five business functions. Secured a three-year certification runway.
A policy library from a standing start
Directed creation of the information security policy library — 15 policies developed and published across 2025, covering the full set of ISO 27001 Annex A policy requirements.
Governance put in front of the executives
Restructured the ISMS Steering Committee to add C-level and VP membership — CFO, General Counsel, SVP Operations, and VPs of Software, Product, People, and Photonics — and moved cadence from twice yearly to quarterly. Now chairs the combined IT & Security Steering Committee with formal decisions recorded each quarter.
Continuous controls monitoring
Deployed a continuous controls-monitoring platform, integrated across 13 systems, replacing manual evidence collection with automated control-to-evidence mapping.
Third-party risk, automated end to end
Rebuilt vendor risk from spreadsheet coordination into an automated workflow — procurement intake now triggers an automated risk assessment in the controls-monitoring platform, so security review happens before vendor approval rather than after. Live 31 March 2026.
What it delivered.
“The company was already certified. What it didn't have was a security program. Passing a full-scope 2022 audit with zero non-conformities was the proof that we'd built one.”
Four ways it mattered.
Turned checkbox compliance into controls that hold up under a full-scope audit.
Zero non-conformities across 93 controls and 300+ pieces of evidence.
Security moved from an IT topic to a quarterly executive decision forum.
Evidence and vendor risk automated, so the program scales without headcount.
