ISO/IEC 27001 Certified: Building Trust in Game QA

A framework for managing information security.

ISO/IEC 27001 sets requirements for an information security management system, often shortened to ISMS. It brings risk assessment, responsibilities and ongoing improvement into a structured approach to managing information. Its focus extends beyond IT equipment to people and working practices.

Certification concerns the management system within its defined scope. It is not a certification of every game we test or a promise that no incident can ever happen. ISO develops the standard; independent certification bodies perform certification. Read ISO’s introduction to ISO/IEC 27001 and its explanation of certification.

The build is only part of the picture.

In game QA, sensitive information can appear in ordinary work. A screenshot attached to a defect may reveal an unannounced character. A crash log may include an internal path or account identifier. A test plan may disclose an upcoming feature, while a release calendar can reveal a partner’s commercial plans.

That makes information security relevant to the whole workflow, from the initial brief to the final handover. The following examples show why the conversation needs to be specific to the project.

These are examples of planning considerations, not a claim that every engagement uses the same technical setup. A focused compatibility test and an embedded development QA team can have very different access needs.

Building the system behind the work.

Our certification journey brought together an assessment of our practices, implementation of the ISMS, staff awareness and audit preparation. It covered areas such as asset management, access control, information classification, risk treatment and business continuity procedures.

Start with an honest assessment.

We began by examining our existing practices and identifying gaps against the standard’s requirements. That assessment helped turn a broad goal into a programme of work, with areas to address and a clearer understanding of the risks involved.

Make responsibilities part of daily work.

Policies need people who understand them. Staff training and awareness formed part of the journey, alongside the development of the management system. The aim was to connect security responsibilities with the way colleagues handle information during their working day.

Review, audit and improve.

Internal audits helped us assess the system and identify issues before the external certification assessment. Achieving certification marked an important milestone in that work. Maintaining the discipline behind it remains an ongoing responsibility.

The care we bring to a game should extend to the information entrusted to us.

What this means for studios and publishers.

A certificate helps start a supplier review, but productive collaboration still depends on understanding the engagement. Before work begins, it is useful to translate security expectations into clear project decisions.

For procurement and security teams, the certificate’s scope, validity and applicability to the proposed work should form part of the discussion. Project-specific contractual requirements remain important alongside certification.

For production teams, the benefit is a more structured conversation about working together. Good QA needs timely access and useful evidence; good information handling helps define how both can be achieved responsibly.

New tools. The same need for care.

Game production keeps changing. More hardware, distributed teams and new analysis tools introduce new decisions about where information goes and who can use it. AI-assisted workflows deserve particular attention when they involve unreleased content or project documentation.

Before introducing a tool into a confidential workflow, useful questions include whether it receives project data, how that data is retained, who can access it and whether the proposed use fits the partner’s requirements. These questions belong in the planning process, alongside the tool’s potential benefits.

At Pixel Bowl, our next steps build on the commitment behind certification: keep reviewing our practices, learn from experience and make information security part of the conversation as our work develops.