The two, side by side
| SOC 2 | ISO 27001 | |
|---|---|---|
| What it is | An auditor's report on your controls | A certification of your security management system |
| Who asks for it | Often US business customers | Often international and enterprise customers |
| Scope | Controls for the criteria you choose, such as security and availability | A management system covering policies, risk and controls |
| Issued by | An independent auditor | An independent certification body |
What preparation involves
- A security review of your cloud accounts, access rules and code
- Written policies: access, change management, incident response, backups
- Single sign-on and two-factor login, with least-privilege access
- Logging and monitoring, so you can show what happened and when
- Security checks in your delivery pipeline
- Evidence: records that the controls were really in place over time
A sensible order of work
- Start with a review, and fix the cheap, high-impact gaps first
- Write only the policies you will follow
- Switch on logging and evidence collection early, because auditors want a track record
- Run a penetration test, if the scope or your customers ask for one
- Then book the audit
We prepare you and support you through the audit. We do not issue the report or certificate; an independent auditor does.
Frequently asked questions
Which should we get first?
Whichever your customers ask for. US customers often ask for SOC 2; international and enterprise customers often ask for ISO 27001.
How long does it take?
It depends on how far you are today. A review gives you a realistic plan before you commit.
Do we need a penetration test?
Often it is expected, or asked for by customers. We offer VAPT testing.
Can you issue the certificate?
No. An independent auditor or certification body does. We prepare you for it.