Security and compliance
ISO 27001 and SOC 2 for software companies, with Certenza
We work on ISO 27001 and SOC 2 together with Certenza: controls, evidence and readiness for an independent audit. Tell us where you are starting from.
The problem
A large customer sends you a security questionnaire, or asks for ISO 27001 or a SOC 2 report before moving forward, and the deal stalls. Without documented controls and evidence at hand, every answer is rebuilt from scratch and every audit request becomes an emergency.
Getting ready for an ISO 27001 certification or a SOC 2 report is not filling in spreadsheets during the last month: it is controls that run all year and evidence that gets collected while the team keeps building product.
ISO 27001 and SOC 2: what each one is
ISO 27001
Certification
International standard (ISO/IEC 27001) for building and maintaining an information security management system. An independent, accredited certification body audits that system and, if the audit confirms it, issues the certificate.
SOC 2
Type I or Type II report
An AICPA framework covering security and other trust criteria. It does not end in a certificate but in a report issued by an independent CPA firm. Type I assesses the design of the controls at a date; Type II, how they operated over a period.
How we solve it
We work on ISO 27001 and SOC 2 together with Certenza, a compliance management platform where your company's requirements, controls, owners and evidence are kept in order. So that compliance does not depend on a single person or a spreadsheet.
Our part is the technical side, the same work we already do in cloud infrastructure and DevOps: infrastructure security, the deployment pipeline and documented architecture. How the work is split with Certenza we define in a first conversation.
More about the platform at certenza.com.
What's included
- Technical hardening of the infrastructure and deployments
- A tidy deployment pipeline and documented architecture
- Monitoring of what runs in production
- Requirements, controls and evidence kept in order in Certenza
- Readiness for an independent third-party audit
Who issues what
Neither WAIA nor Certenza issues the certification or the report: the ISO 27001 certificate is issued by an accredited certification body and the SOC 2 report by an independent CPA firm. We do not promise results: the audit and its outcome belong to a third party.
Behind the scenes, we are also organising and auditing our own internal processes, with ISO 27001 and SOC 2 on the horizon.
Who it is for
- Startups, SaaS and software companies answering security reviews from corporate customers.
- Companies that need ISO 27001 for tenders or to sell to large organisations.
- Technical teams that answer security questionnaires by hand today and want to stop starting from scratch every time.
Frequently asked questions
What is ISO 27001 and what is the certification for?
ISO/IEC 27001 is the international standard for building and maintaining an information security management system (ISMS). The certification shows customers and tenders that your security controls were audited by a third party. The certificate is issued by an independent, accredited certification body, not by the company that helps you prepare.
What is a SOC 2 report, and what is the difference between Type I and Type II?
SOC 2 is an AICPA framework covering security and other trust criteria: availability, processing integrity, confidentiality and privacy. People often search for it as “SOC 2 certification”, but technically it is not a certificate: it is a report issued by an independent CPA firm. Type I assesses whether the controls are well designed at a specific date; Type II also assesses whether they operated over a period of time.
Should we start with ISO 27001 or with SOC 2?
It depends on what your customers ask for. ISO 27001 is the one that shows up most in tenders and with companies outside the United States; the SOC 2 report is what US companies usually ask of their software vendors. Many controls overlap, so the work done for one carries over to the other. In a first conversation we look at what you are being asked for and where it makes sense to begin.
Who issues the ISO 27001 certificate or the SOC 2 report?
Neither WAIA nor Certenza. The ISO 27001 certificate is issued by an accredited certification body, and the SOC 2 report is issued by an independent CPA firm. We work together with Certenza so you arrive prepared for that audit; the audit and its outcome belong to a third party.
What does Certenza do and what does WAIA do?
Certenza is a compliance management platform: it keeps requirements, controls, owners and evidence in order. WAIA's part is the technical side, the same work we already do in cloud infrastructure and DevOps. We work on both standards together, and how the work is split in your case we define with you in a first conversation.
Does it help with vendor security questionnaires?
It can help: with documented controls and organised evidence, many answers come from material that already exists instead of being built from scratch. It does not replace the ISO 27001 certification or the SOC 2 report.
How long does it take and how much does it cost?
It depends on the scope and on your starting point: a startup with a few systems is not the same as a company with several applications and teams. That is why we do not give timelines or prices without first understanding your situation. The audit also has its own cost and calendar, set by the body or firm you choose.
Is ISO 27001 suitable for a software development company or a small business?
Yes. The standard adapts to the size and risks of each organisation, and it is common among software companies, from small teams to large ones. What matters is defining the scope well, meaning which systems, teams and processes are included, so the effort stays proportionate. That is defined at the start.
I want to assess ISO 27001 or SOC 2 for my company
We start with a conversation: what your customers are asking for, what you already have in place and where it makes sense to begin.
