Organisation
Founded by aviation psychologists, CAP provides specialist clinical support, training, and consultancy services to pilots, airlines, and aviation regulators. The organisation has been instrumental in promoting mental health awareness within the aviation industry, particularly following the global focus on pilot well-being in recent years.
- CAP co-founded the Peer Support Programme (PSP) model now adopted by several international airlines to help pilots access confidential mental health support.
- Their CAP Peer Portal provides a secure online environment that connects aviation professionals with trained peer supporters and mental health experts — an innovative platform that bridges clinical expertise with technology.
Background
CAP faced growing pressure from major clients to demonstrate compliance with rigorous IT and cyber security standards. Following an external audit, several opportunities for improvement were identified in CAP’s IT governance and cyber security framework.
As a small organisation without a dedicated IT department, CAP’s leadership team recognised that maintaining compliance with processes aligned to ISO 27001 and ISO 9001, while continuing to deliver services to their clients, would require external expertise. CAP turned to Blueloop to deliver hosting, consultancy, and ongoing IT management support.
The Challenge
Small and medium-sized businesses (SMBs) often underestimate the importance of board-level responsibility for cyber security. CAP’s directors understood that cyber resilience was not just an IT issue but a governance and reputational one. However, without in-house expertise, they lacked:
- A structured Information Security Management System (ISMS)
- Clear oversight of IT risks, incidents, and change management
- The ability to provide evidence of compliance to external partners and auditors
- Resources to ensure continual improvement and monitoring of IT systems
The challenge was to embed formal IT governance and cyber security management into CAP’s business processes, without overburdening their limited internal capacity.
Outsourced ISMS Solution
Blueloop proposed an outsourced ISMS model, combining strategic oversight with hands-on technical delivery. This involved the creation of a formal ISMS Board, including representatives from CAP, Blueloop, and CAP’s software development partner. The Board meets bi-monthly to review system changes, incidents, risks, and performance metrics, providing CAP’s leadership with structured governance and assurance.
Blueloop designed and implemented a comprehensive ISMS based on ISO 27001 principles. The system included:
- A dedicated ISMS Wiki to store system procedures and records, for transparency and collaboration
- Regular audits, vulnerability assessments, and performance reporting
- Defined incident response and change management procedures
- Risk and opportunity registers aligned with business objectives
- Additionally, Blueloop migrated CAP’s Peer Portal software to a secure, dedicated environment within their own data centre. This ensures that the ISMS controls are fully integrated with hosting and operational management.
- Business Enablement and Continuity
By outsourcing IT governance, CAP is able to maintain focus on its core operations while Blueloop ensures IT stability, compliance, and resilience. The partnership enabled CAP to:
- Satisfy external audit requirements from major clients
- Strengthen business credibility, positioning CAP as a secure and trusted partner
- Access professional IT governance without the cost of a full-time IT person
Blueloop’s proactive vulnerability assessments, performance monitoring, and structured ISMS reviews provide CAP’s leadership with confidence that IT risks are being managed effectively. The outsourced ISMS model translated complex cyber security requirements into actionable governance processes accessible to non-technical board members.
Outcomes and Advantages
The collaboration between CAP and Blueloop demonstrates the tangible benefits of integrating IT governance at the board level, even for smaller organisations:
- Improved compliance and audit readiness through structured ISMS processes
- Clear accountability for cyber risk at board level via the ISMS Board structure
- Enhanced resilience and uptime, supporting CAP’s service commitments
- Scalable IT management, allowing CAP to grow without needing in-house IT staff
The Blueloop team led by Robin Barker were the epitome of professionalism and responsiveness to our requirements and timescales. They were able to provide an excellent, outsourced service and consultancy that would have been impossible and uneconomic for us to replicate in-house.
– Aedrian Bekker, Director: Enterprise Solutions and Business Development
Conclusion
For smaller businesses like CAP, outsourcing IT governance delivers the strategic oversight, governance, and technical assurance required to protect client data and maintain business continuity.