A large client asks for your SOC 2 report, or a contract requires ISO 27001. For a small company with no compliance team, a first audit can feel overwhelming. It's manageable with a clear plan.
SOC 2 or ISO 27001?
SOC 2 is an attestation report from an independent CPA firm, common with North American clients and SaaS companies. A Type I report checks your controls at a point in time; a Type II report checks that they worked over a period, usually several months.
ISO 27001 is an international certification of your information security management system, often requested by European and enterprise clients.
The path we follow
- Scope. Decide which systems, teams and services the audit covers. A tight scope saves time and money.
- Gap assessment. Compare what you do today with what the framework requires.
- Fix the gaps. Usually multi-factor authentication, access reviews, logging, backups, vendor reviews and onboarding and offboarding steps.
- Write the policies. Short, accurate policies that match how you actually work.
- Collect evidence. Screenshots, logs and records, organized the way the auditor expects.
- Readiness check, then the audit. A dry run catches surprises before the auditor does.
How long it takes
For a prepared small company, a SOC 2 Type I or ISO 27001 readiness project commonly takes a few months. A SOC 2 Type II then adds an observation period of three months or more.
We guide companies through their first audit and keep them compliant after. See our compliance service or book a consultation.