BSI Case Study Worldpay

Information resilience

How payment processing specialist Worldpay is using
certification to key standards to improve information
resilience and boost competitive advantage“In the global payments market,
security and reliability are
absolutely non-negotiable. Our
customers must have complete
confidence in all the solutions weprovide, at all times. Our proveninformation resilience gives themthat.”
Ian Crossley,
Head of Business Continuity & Corporate
Security, Worldpay

Customer benefits

At a glance• Minimized impact of businessdisruption

Worldpay, is a global leader inpayment processing solutions,focussing on data security, security
in data management, incident
management and disaster recovery.
The company holds BSI certification
for ISO 22301 business continuity,
ISO/IEC 27001 information security.
and achieved auditor verificationfrom BSI aligned to ISO 27031, aninternational standard for IT security
techniques.

• Proven protection of sensitive data
• Enhanced information security
management• Increased business resilience• Customer reassurance• Competitive advantage

The company consistently needs toachieve and demonstrate the highest
standards of security and reliability
in its technology and processes. It isdetermined to remain ‘best in class’in terms of information resilience,
supporting its business growth.

Customer background
Worldpay is a global leader in payment
processing. It provides an extensive rangeof technology-led payment products andservices to over 400,000 customers; it helps
businesses of all sizes to grow and prosper
by enabling them to accept the widest rangeof payment types around the world.

issues such as disaster recovery plans, asset
management, incident management andhow you communicate during an incident,
among other key subjects for us”.

He continues, “Externally, they bring vitalreassurance to customers. They certainly
help us win business because customers cansee we’re resilient.”

Crossley says that, with data protection
a growing concern for all businesses,
certification to ISO/IEC 27001 “was justa natural progression for a technology
organization that holds and maintains data”.

While ISO/IEC 27001 has gradually become“a given in our business”, Crossley sayscustomers are now increasingly asking for
ISO 22301 too. But Worldpay can go evenfurther. “If a customer comes in and says,‘Great, you’ve got ISO 22301’, we can also
show them we are aligned to ISO 27031. We
can explain what it covers, and that we havebeen externally audited to it by BSI. And that
we’re the only company in Europe to havethis independent verification.”

Using its secure and reliable technology
and network, Worldpay is able to process
payments from geographies covering 99%
of global GDP, across 146 countries and
126 currencies, offering over 300 payment
methods. On a typical day, Worldpay
processes 31 million mobile, online and instore transactions.
In 2015, Worldpay listed its shares for
trading on the main market of the London
Stock Exchange, and in December 2015 it
became a member of the FTSE 100 largest
UK companies. It now has over 5,000
employees, with its headquarters in London,and 25 offices in 13 countries around theworld.
Why certification?
Worldpay’s standards journey began
when it realized the advantages that key
certifications offer, specifically in challenging
itself to improve its already high standardsof security and reliability, and in meeting
the increasing expectations of businesscustomers in its large, rapidly expanding
marketplace.
As Ian Crossley, Head of BusinessContinuity & Corporate Security, explains,the company’s initial focus was on ISO22301. “Originally, we were following theFinancial Services Authority’s guidance on
best practice in business continuity, but I
wanted to benchmark ourselves against a
recognized standard that would prove that
we were best in class,” says Crossley.
Through ISO 22301, its first BSI certification,
Worldpay demonstrates to both internaland external parties that it has a robust
management system in place to cope witha business disruption. But Crossley wassoon keen to go further in implementinga standard that was more closely tailoredto the company’s specialist in the field ofpayment processing.
He continues, “BSI talked to us about ourneeds and the ISO 27031 standard seemed
to fit what we were looking for. It speaks toThis standard fitted seamlessly withthe company’s ethos of continuous
improvement within its wider information
resilience strategy, as well as with increasing
customer expectations of information
security-minded practices.
Implementation
Worldpay has rolled out its certifications
gradually, with its technology hubs being
made a priority. For example, ISO 22301 wasinitially achieved by four offices, then later afurther five with the ultimate aim to have allits global locations covered by the standard,
and a similar pattern is being adopted for
ISO/IEC 27001 and ISO 27031.
Crossley has found that implementing
the various standards “has never been aproblem” because Worldpay has always
had a clear business vision and committed
leadership who “walked the talk”, harnessing
the support of management and staff.
This has enabled decisive action. For
example, the company was able to achievecertification to ISO/IEC 27001 very quickly.
“We decided to go for certification in May
2015 and we achieved it in December, so it
was quite an aggressive timescale,” he says.
One of the major information risks in
any organization comes from the people
within any process. Some threats could
arise from poor practice, or simple humanerror or inaction. Worldpay’s rigorous
implementation of its standards ensures that
staff are well trained to avoid such instances.
Benefits“We had robust information security andbusiness continuity processes in place
already, but the standards ensure that
we follow them and enhance them,” says
Crossley. “They have given us a structure toidentify risks to our business and manage
these. They prove that we are doing
everything we can.”+44 345 080 9000
certification.sales@bsigroup.com
bsigroup.com

Worldpay has consistently harmonized
its standards with its broader businessresilience strategy. We were alreadydetermined to maintain our security andreliability as ‘best in class’, but by focusing
on standards in specific areas the process
has become more thorough, systematic andeasier to maintain.”
BSI’s role
BSI has played a key role in supporting
Worldpay’s success. For example, BSI carriedout Gap analyses and pre-audit inspections“to make sure we were on the right lines,”
says Crossley. “They’ve always been readyand willing to provide guidance whenever
we’ve needed it.”
BSI was particularly helpful when it cameto implementing ISO 27031. This standard
posed a challenge in terms of certification,
but BSI came up with a solution by
establishing a bespoke audit approachto verify Worldpay’s compliance with its
requirements.
Crossley concludes, “As a leader in the global
payments market, security and reliability
are absolutely non-negotiable for us. Ourcustomers must have complete confidence
in all the solutions we provide, at all times.
Our proven information resilience gives
them that.”Call +44 (0)345 080 9000

to find out how BSI canhelp your business makeexcellence a habit.

ISO
22301

ISO/IEC
27001

ISO27031

Business Continuity
Management

Information Security
Management

Information
Technology Security
Techniques

BSI/UK/917/SC/0916/BLD

Information Resilience© BSI Group

BSI Case Study Worldpay