ISO 27001 & SOC 2 Certification
From first gap to certificate, without the guesswork.
Getting ISO 27001 certified or a SOC 2 report is a project, not a document template. We guide you through the whole process — scoping, implementing controls, preparing evidence, choosing and applying to an auditor, and standing next to you during the audit itself.
What we cover
Every engagement is scoped to your environment — these are the areas we typically work across.
Scoping & gap assessment
Defining what's in scope — products, locations, systems — and measuring where you stand against ISO 27001 or the SOC 2 Trust Services Criteria.
ISMS & control implementation
Risk assessment, Statement of Applicability, and the technical and organizational controls you need — implemented to fit how your company actually works.
Policies & evidence
The policies, procedures, and records auditors expect, written for your organization rather than copied from a template, with an evidence trail that's easy to maintain.
Internal audit & readiness
The internal audit and management review ISO 27001 requires before certification, plus a mock audit so the real one holds no surprises.
Choosing an auditor & applying
Help selecting an accredited ISO certification body or a CPA firm for SOC 2, preparing the application, and agreeing on audit scope and timing.
Audit support & beyond
On hand during the certification audit or SOC 2 examination to answer auditor requests and close any findings — and after it, for surveillance audits and renewals.
What you get
- Scope definition and gap assessment report
- Implementation roadmap with owners and priorities
- Risk assessment and Statement of Applicability (ISO 27001)
- Policy and procedure set tailored to your organization
- Evidence repository structured the way auditors expect
- Internal audit and mock audit before the real one
- Auditor shortlist and support with the application
- Support through the audit and remediation of any findings
- Methodology
- ISO/IEC 27001:2022 and the AICPA SOC 2 Trust Services Criteria
- Timeline
- Depends on your starting point and scope — the gap assessment gives you a realistic plan all the way to certification.
- Confidentiality
- NDA signed before scoping. Evidence encrypted and deleted on an agreed schedule.
ISO 27001 & SOC 2 Certification FAQ
Can you certify us or issue the SOC 2 report?
No. ISO 27001 certificates can only be issued by accredited certification bodies, and SOC 2 reports by licensed CPA firms. We prepare you and guide you through the process — which keeps our advice independent of the audit outcome.
ISO 27001 or SOC 2 — which one do we need?
Usually your customers decide: SOC 2 is common with US clients, ISO 27001 internationally and in Europe. The controls overlap significantly, so if you need both we plan them together and reuse most of the work.
What's the difference between SOC 2 Type I and Type II?
Type I assesses whether controls are designed properly at a single point in time. Type II also tests that they operated effectively over an observation period, typically 3–12 months. Many companies start with Type I and move to Type II.
How much of our team's time will this take?
We do the heavy lifting on planning and documentation, but controls have to be owned by your people — auditors will talk to them. We keep requests focused so certification doesn't take over everyone's day job.
What happens after certification?
An ISO 27001 certificate is valid for three years, with surveillance audits in between. SOC 2 Type II reports are usually renewed every year. We can support you through both so compliance doesn't drift.
Talk to us about ISO 27001 & SOC 2 Certification.
Tell us what you're trying to protect. We'll tell you honestly whether we're the right fit.
contact@ironclav.com · Response within one business day