ISO 27001 and SOC 2 Readiness

ISO/IEC 27001 is an international standard for an information security management system, the rules and routines a business uses to protect its information. An accredited certification body audits the business and issues a certificate if it passes.

SOC 2 is a report. An independent audit firm examines how a service company's controls meet criteria for security and related areas, and writes up the result.

The two overlap heavily: access control, risk management, change control, logging, incident response and vendor management. Work done for one usually helps the other.

• Software and service companies that keep receiving long security questionnaires.
• Startups heading into fundraising, larger sales or due diligence. See also technical due diligence.
• Companies bidding for tenders that require ISO 27001.
• Teams whose security lives in people's heads and who want it written down and tested.

We implement. That means the gap assessment, the risk register, policies that match how you work, and the technical controls themselves: two-step sign-in, single sign-on, access reviews, activity logs, backups and safe storage of passwords and keys. We set up evidence collection so proof builds up as you work.

Accredited partners do the parts that must be independent. A certification body or audit firm performs the formal audit. Where an attested penetration test is required, an accredited testing partner provides it. Where a point needs legal interpretation, partner counsel advises. We coordinate all of them and sit alongside you in the audit.

We learn how you work, what information you hold and which systems matter, and run a gap assessment against the standard. Then we agree the scope, rank the gaps and write the plan, including whether to pursue ISO 27001, SOC 2 or both.

We write the policies, put the controls in place and set up evidence collection. An internal audit and then a mock audit come next, so the real one holds no surprises. During the audit itself, Stage 1 and Stage 2 for ISO or the auditor's fieldwork for SOC 2, we answer questions and supply evidence with you.

• Secure by default: the controls go into your everyday tools, so they protect you every day, not only on audit day.
• Built to scale: policies and evidence collection are set up so new staff, new systems and new customers fit in without a fresh scramble.
• Tested before it ships: the internal audit and the mock audit test every control before an auditor does.
• Looked after after launch: certificates need upkeep, with surveillance audits, reviews and risk register updates, and a managed service can carry it.
• Small changes handled, not invoiced: answering a customer's security questionnaire from evidence you already have gets done, not quoted.
• Honest advice: if you are not ready for the audit date, we say so and move the date, rather than let you fail it.

Certification sits on top of everything else you run. Security hardening, two-step sign-in and single sign-on are part of the same Trust, Security & Compliance work. Data protection duties under India's law are covered in DPDP Act compliance. Cloud setups often need tidying before an audit, under Digital Infrastructure, and products sold to larger customers come from SaaS development. One team builds the systems and the evidence that proves they are secure.

If you want a certificate without changing how you work, we are not the right team, and an auditor would find the gap anyway. If no customer or tender needs either standard yet, a smaller step such as security hardening may serve you better for now. Not sure which route fits? Tell us who is asking for proof.