ACME, the company this series follows
ACME is the small, made-up company that this series uses as its example. It starts in 2019 as a webshop for smart plugs, sells software to businesses from 2020, puts a gateway into buildings from 2022 and sells to the public sector from 2024. This chapter describes how it grows and how its risks change along the way. It also covers which rules reach it and how much room each one leaves, and who inside and outside the company cares about security at each stage.
- Leading security at two startups in a row, both acquired about two years after I joined
- ACME, the company this series follows (you are here)
- One set of security records for customers, auditors and regulators
- Proactive, application and detective security in a growing company
A small example
Security advice is hard to apply without a company behind it, because the right amount of work depends on the company's size, its customers and what it sells. ACME gives every chapter a concrete situation, with enough detail for the people who care about security at that stage. Its situations come from real companies I have worked with, with the details changed so that none of them can be recognised.
ACME is an EU company that hosts its systems in the EU and sells across the EU, mostly to customers in the Nordics, Central Europe and Romania. Michael, the commercial founder, is the CEO, and Andrew, the technical founder, is the CTO. The story runs from 2019 to 2026 in real years, so the incidents and the laws it meets are the real ones of those years.
ACME from 2019 to 2026
In 2019 ACME is three people selling smart plugs and electricity meters, made by other companies, to households through a WordPress webshop. Its data is the customers' names, addresses and orders, and card payments happen on the payment provider's page. The risk is small, and most of it sits in the webshop's plugins and the administrator accounts.
From 2020 ACME sells a web dashboard that shows shops and offices how much electricity each site uses. Now other businesses trust ACME with their data, and the first large customer, a retail chain, sends a security questionnaire before it signs. The main new risk is one customer seeing another customer's data, and the first requests for ISO 27001 and SOC 2 arrive.
From 2022 ACME ships a gateway that reads the meters already installed in a building and sends the readings to the dashboard. ACME's code now runs inside other companies' networks, often next to meters that have no authentication at all. Industrial customers ask how they can verify the software they install, and the Cyber Resilience Act makes ACME a manufacturer with duties for this product.
From 2024 municipalities and public hospitals buy the dashboard and gateways for their buildings, through public tenders. Some of these customers are covered by NIS2, and they pass its requirements on to ACME through contracts. In 2026 a larger building-automation company acquires ACME, and its due diligence reads the records ACME has kept since 2020.
The people who care at each level
| Level | What they care about | An example from ACME |
|---|---|---|
| Leadership | Deals, cost, the company's reputation and its value at a sale | Michael decides whether to promise a retail chain an ISO 27001 certificate within a year |
| Sales and customer-facing staff | Questionnaires, what may be promised, deadlines | A salesperson answers the retail chain's questionnaire from the answer library and promises nothing without a date and an owner |
| Engineering | The code, the pipeline and the controls built into the product | Andrew's team adds a check that every request reads only the customer's own sites |
| Operations | Keeping systems running, access, backups and incidents | The platform engineer runs a restore test every quarter and records how long it took |
| Customers and regulators | Their own duties, and proof that ACME meets its share | A hospital asks for incident notice within 24 hours because NIS2 gives it the same deadline |
Rules and how much room they leave
Some requirements come from the law and leave little room. Others come from customers and can be negotiated, as long as the company keeps what it promises.
| Rule or request | Reaches ACME | Room to move |
|---|---|---|
| GDPR | From the first day | Little on the basics: records of processing, privacy notices, breach notice within 72 hours. The measures are proportionate to the risk |
| The payment provider's card security self-assessment | Stage 1 | A hosted payment page keeps it to the shortest form |
| Security questionnaires, ISO 27001, SOC 2 | Stage 2 | Negotiable. A dated, written commitment can close a deal before a control exists |
| NIS2 requirements from customers | Stages 3 and 4 | The contract clauses are negotiable, but the customer cannot waive its own legal duties |
| Cyber Resilience Act, for the gateway | Reporting from 11 September 2026, all requirements from 11 December 2027 | None on the deadlines |
| Public tenders | Stage 4 | None at tender time, because qualification criteria are pass or fail, so the company plans a year ahead |
Ways of working
ACME's engineers work in short iterations, in the extreme programming tradition: small changes, a review on every pull request, continuous integration and several deployments a day. Planning happens on Monday and review on Friday. Security work follows the same rhythm. The threat model is updated when the week's tasks go out and checked when they close, so no separate security process runs beside development and slows it down.
Incidents along the way
ACME also meets real incidents. Each one is told in the chapter where it fits, from the side of every level that cares: what customers and outsiders saw, what leadership decided, what operations did and what engineering changed.
| When | Incident | Chapter |
|---|---|---|
| 2020, stage 1 | A WordPress plugin on the webshop is exploited | 2.1 |
| December 2021, stage 2 | Log4Shell. ACME runs no Java of its own and still has to answer every customer within days | 2.5 |
| 2024, stage 3 | Browsers stop trusting the certificate authority behind ACME's certificates, including the ones on deployed gateways | 2.8 |
| 2025, stage 4 | Ransomware at a hospital customer, which asks whether the gateway was the way in | 5.3 |
Every one of these leaves records behind, and chapter 1.3 shows who reads them. Chapter 1.4 draws ACME's data flow, which every later chapter uses to place its work.