Governance & compliance

ISO 27001 and SOC 2 readiness

The deal is blocked now and certification takes months, so they are two separate jobs.

Most security questionnaires are ISO 27001 or SOC 2 in disguise. We answer them from the evidence you already have, then separate the gaps that are blocking a deal today from the ones that belong in a certification programme.

Which one you need

ISO 27001, SOC 2 Type 1 and SOC 2 Type 2 are not alternatives to each other

ISO 27001

Certification

What it is

Certification of a management system, issued by an accredited body after an audit

Who asks for it

European customers, partners, tenders

How long

Stage 1 and Stage 2 audits at the end of a programme

SOC 2 Type 1

Attestation report

What it is

An attestation report describing your controls and confirming they are suitably designed, as at one date

Who asks for it

US customers who need something quickly

How long

The shortest route: the report covers a point in time

SOC 2 Type 2

Attestation report

What it is

The same report, confirming the controls operated over a period

Who asks for it

US customers, particularly enterprise procurement

How long

The observation period runs six to nine months and cannot be compressed

A question worth asking before you commit. If a US customer has asked for SOC 2, ask whether they would accept ISO 27001 instead. Often they will, and it costs less. Better to establish that on the first call than nine months in.

Neither is issued by us. ISO certification comes from an accredited certification body. A SOC 2 report is issued by a licensed CPA firm. We prepare you, run the programme, and coordinate with whoever audits you.

Situation

Four ways this usually starts

A questionnaire arrived and nobody can answer it.

A CAIQ or SIG landed from a customer's procurement team, and the contract does not move until it comes back.

Deals keep stalling at the security review.

Not one deal, a pattern. The same questions come up, and each time the answer is assembled from scratch.

A customer asked whether you are certified.

The answer was no, and now there is a date attached to changing that.

A US customer wants a SOC 2 report.

Type 1 or Type 2, and the difference between them matters more than anyone expects.

Book a consultation

Difference

Most of the work is making controls run and produce evidence, not writing policies

Compliance projects fail in a recognisable way. A set of policies is written, everyone signs them, and nothing changes in how the company actually operates. Then the auditor asks for evidence that a control ran, and there is none.

We split the gaps in two.

Deal-blocking now, and everything else. The first group gets answered or fixed at once, so the contract moves. The second becomes the certification programme, on its own timeline.

We answer from what exists first.

Most questionnaires can be answered from evidence you already have, once somebody has gone looking for it. That is cheaper than certification and faster than waiting for one.

We hand over the operating rhythm.

Surveillance audits come round every year, and you should pass them without us.

What you get

The documents, in the order they are needed

To unblock a deal

a questionnaire response an evidence pack a gap list split into blocking and later a recommendation on which certification, if any, you need

For an ISO 27001 programme

scope statement gap assessment risk register and treatment plan the ISMS document set Statement of Applicability internal audit records support through Stage 1 and Stage 2

For SOC 2

the criteria decision readiness assessment evidence collection, automated where you already run a compliance platform coordination with the CPA firm support through the observation period

If the deals are the problem rather than the certificate

lost-deal analysis a trust page a library of pre-answered questionnaires your sales team can use

Commitments

Which dates are ours to set, and which are not

In your proposal

Two dates are fixed before the work starts

When your questionnaire response comes back, counted from the point we have access to your evidence.
When you have the gap assessment and the scope, after which you know what stands between you and the certificate and what it costs.

Both are written into your proposal.

Set by the auditor

The rest of the calendar is not ours to promise

Stage 1 and Stage 2 dates are set with the certification body.
A SOC 2 Type 2 observation period runs six to nine months and cannot be shortened: not by us, not by the auditor, not by paying more.

Fit

This is not for everyone

Fits

A customer or partner is asking, with a date attached
Selling into Europe, the US, or both
No internal compliance resource, or an earlier attempt that stalled or lapsed

Does not

You want the certificate without the controls behind it
An auditor is already on site: that is too late for readiness work
Nothing has been asked of you yet and there is no date

Next step

Send us the questionnaire you cannot answer

One call about what has been asked of you, by whom, and by when. From there: a gap assessment, a scope, and a straight answer on whether you need a certificate now, or a set of answers now and a certificate later.

Book a consultation