About Lean Tree
- What it is: an employee-owned digital transformation consultancy, founded in 2020 and headquartered in London, with people working across the UK and Europe.
- Scale: around 50 consultants and specialists (LinkedIn company data, November 2026), organised in five practices: Advisory, Delivery, Growth, Engineering and AI.
- Clients: organisations in financial services, energy, technology, media and telecoms, retail, healthcare, industrial sectors and the public sector: typically larger organisations running complex change.
- Listing: not listed. Lean Tree is employee-owned, which shaped this engagement more than any other single fact: the people being asked to run the system are its owners.
Company facts from leantree.co.uk and Lean Tree’s LinkedIn company page, checked November 2026.
Where did Lean Tree start?
A consultancy holds very little sensitive information of its own, and a great deal of everybody else’s.
Its consultants sit inside client programmes, log into client systems, and carry client documents on their laptops between client sites, home offices and everywhere in between. As Lean Tree grew, its clients (larger, often regulated organisations) asked the entirely reasonable question of how that information was being looked after, in longer and more detailed questionnaires.
My starting point is to remove any mystique about what the standard requires, and to be honest about scope. For a consultancy, the honest scope is the delivery of its services and the client information that flows through them, covering the places consultants actually work.
What did I do at Lean Tree?
In brief, I led the implementation of the management system:
- Scoped the ISMS by service line, covering all client information received or created across the firm’s consultants and company-managed devices, wherever they were working.
- Built the risk assessment around how consultancies actually lose information: a laptop, a leaver whose client access was never revoked, an associate onboarded in a hurry. The register described those real routes.
- Dealt properly with associates and subcontractors (screening, confidentiality terms and access that starts and ends with the engagement), because auditors test exactly that, and pick the person who left.
- Kept the policy set slim enough for consultants to follow on client sites, and evidenced it from the systems the firm already used.
- Ran the internal audit and management review, and prepared the firm for independent assessment through to certification.
What was the difficult part?
Consultants are professionally sceptical people who spend their lives improving other organisations, so asking them to follow a process in their own is a particular kind of conversation.
The difficult part was making the system feel like it belonged to a delivery firm: short, sensible, and visibly connected to winning and keeping client work.
Employee ownership helped more than any document did, and once the partners could see the certificate answering client diligence once instead of forty times, the argument was largely over.
What was the outcome at Lean Tree?
Lean Tree achieved independent ISO 27001 certification for the agreed scope. Certification was the decision of the independent certification body, as it always is; my role was to make sure the firm met that assessment prepared, with a system its own people could run after I stepped back.
I have built my business on mutual trust and understanding, and a consultancy sells the same thing: the certificate simply lets a client verify it before the first engagement.
Is your situation similar?
If your firm advises clients while holding their information, I have set out the approach on my consultancies and professional services page. I am always happy to answer questions, so feel free to drop me an email, anytime.