Omnicom agencies
Client
Sector
Advertising
ISO 27001, TISAX and DPO
Framework
Engagement
2018-2026
THE CHALLENGE
Advertising and media agencies regularly handle sensitive information belonging to some of the world's largest brands.
Client data, campaign information, unreleased products, creative assets and commercially sensitive material can all form part of everyday operations.
For agencies working with automotive clients, these requirements can become even more demanding, with TISAX introducing specific expectations around areas such as information security, prototype protection and data protection.
The challenge across the Omnicom businesses wasn't simply achieving certification or passing an assessment.
With multiple agencies operating across different countries, the management systems needed to remain practical for individual businesses while still providing a consistent and structured approach to information security.
And once certification or TISAX labels had been achieved, the work didn't stop. Risks, systems, suppliers, employees and client requirements continued to change, meaning the management systems needed to change with them.
OUR APPROACH
We worked directly with the teams responsible for information security within each organisation.
Rather than trying to force every Omnicom business into exactly the same model, we looked at how each organisation actually operated and built the management system around that.
For new implementations, this meant understanding the existing environment, identifying gaps against ISO 27001 or TISAX requirements and working through the changes needed to get the organisation ready.
We supported teams with risk assessments, policies, procedures, security controls, supplier management, employee awareness, internal audits, management reviews and the evidence required for external assessments.
Once the initial implementation was complete, our focus moved towards maintaining and improving the management systems.
Because the relationship lasted from 2018 to 2025, we were also able to build a much deeper understanding of the businesses we supported. Instead of starting again every year, we already understood the organisation, its risks and its previous audit history, allowing us to focus on what had actually changed and where improvements were needed.
Supporting information security across international operations
OUR DELIVERY
ISO 27001 and TISAX consultancy across multiple agencies
ISMS implementation
Supported the development and implementation of information security management systems aligned with ISO 27001 and applicable TISAX requirements.
Risk Management
Assisted agencies with information security risk assessments, policies, governance arrangements and the implementation of relevant security controls.
Audit Preparation
Supported agencies in preparing for ISO 27001 certification and TISAX assessments, including documentation reviews, evidence preparation and remediation activities.
Annual Internal Audits
Provided continuing consultancy and guidance to help agencies maintain their management systems and respond to changing security requirements.
INTERNATIONAL ENGAGEMENTS
Supporting Omnicom agencies worldwide
Europe
DDB UK - DDB Germany - EG+ Poland - TBWA Sweden - TBWA Finland - OMG Norway - OMG Finland - OMG Sweden - OMG Denmark
Asia
TBWA China
Americas
ALMAP BBDO Brazil - DDB Colombia - Interbrand USA - BeGrizzlee USA
1
2
Prepare for certification
Support certification readiness through documentation reviews, implementation guidance and the identification of outstanding requirements.
3
Annual Internal Audits
Independently assess the ISMS against ISO 27001 requirements and report findings to support ongoing compliance.
Continual Improvement
4
Identify opportunities to strengthen the ISMS and address changes in business operations, security risks and applicable requirements.
OUR ENGAGEMENT
Supporting ISO 27001 compliance since 2020
Establish the ISMS
Develop and implement the management system, including policies, risk management processes and information security controls.
1
OMNICOM
A seven year relationship
What made this project particularly rewarding was the relationships we built along the way.
Between 2018 and 2025, we worked with people across Omnicom businesses in different countries, cultures and time zones. Over those seven years, that meant getting to know a lot of different teams – from senior management and information security teams to IT, HR, Legal, Finance, Facilities and people working directly with clients.
Every business was slightly different, and so were the people we worked with. Some teams already had a strong understanding of information security, while for others ISO 27001 or TISAX was completely new. A big part of our job was being able to work with all of them, explain what was needed in a straightforward way and find solutions that worked for their particular business.
As the relationship grew, we became familiar faces rather than consultants who appeared once a year before an audit. People knew who to contact when they had a question, a new client requirement, a security concern or simply weren't sure how something should be handled.
We also saw people move into new roles, teams change and new colleagues join the businesses. Being involved for so long meant we could provide continuity through those changes and share the knowledge and experience we had built up across the different Omnicom companies.
For us, that long-term relationship was one of the most valuable parts of the engagement. We weren't just working with organisations or helping them pass audits – we were working with people, building trust and becoming a reliable part of the teams we supported across Omnicom.
LETS TALK
Start a conversation.
Complete the form and one of our consultants will contact you to discuss your requirements and next steps.