Komplyo blog
Certification and audit
ISO 27001 and SOC 2 are voluntary, and most companies start one because a customer or an investor asked for it. This section compares the two standards, documents what a certification cycle actually costs and how long it takes, and describes how nonconformities raised in an audit are handled. The figures quoted apply to organisations under 250 people.
ISO 27001 audit: the most frequent nonconformities (and how an SME avoids them)
Published analyses by the certification bodies DNV and NQA converge: risk assessment, internal audit, scope and day-to-day operations concentrate the nonconformities in ISO 27001 audits. What the data shows, what the standard requires clause by clause and how to prepare each area.
- ISO 27001
- Audit
- Certification
- SoA
ISO 27001 or SOC 2 for an SME: deliverables, recognition and how to choose
ISO 27001 produces a certificate issued by an accredited body, valid three years with annual surveillance. SOC 2 produces an attestation report issued by a CPA firm, renewed every year. What each framework requires and produces, what it costs under the published rules, and the criteria that determine the choice for an SME.
- ISO 27001
- SOC 2
- Compliance
Get the security policy template
An information security policy template in .docx format, structured around NIST CSF 2.0 and ISO 27001. Delivered by email, usable as a documentation baseline.