Komplyo

Komplyo blog

Certification and audit

ISO 27001 and SOC 2 are voluntary, and most companies start one because a customer or an investor asked for it. This section compares the two standards, documents what a certification cycle actually costs and how long it takes, and describes how nonconformities raised in an audit are handled. The figures quoted apply to organisations under 250 people.

5 min read

ISO 27001 or SOC 2 for an SME: deliverables, recognition and how to choose

ISO 27001 produces a certificate issued by an accredited body, valid three years with annual surveillance. SOC 2 produces an attestation report issued by a CPA firm, renewed every year. What each framework requires and produces, what it costs under the published rules, and the criteria that determine the choice for an SME.

  • ISO 27001
  • SOC 2
  • Compliance
Read article →

Get the security policy template

An information security policy template in .docx format, structured around NIST CSF 2.0 and ISO 27001. Delivered by email, usable as a documentation baseline.

No spam. Unsubscribe in one click.

Measure your security maturity →