GRC Frameworks: SOC 2 and ISO 27001

SOC 2: Trust Services Criteria

SOC 2 is the most common compliance framework for SaaS companies and service providers. It evaluates whether a service organization's controls meet the AICPA's Trust Services Criteria — security, availability, processing integrity, confidentiality, and privacy.

The five Trust Services Criteria

Security (Common Criteria) — The only mandatory criterion. Protects against unauthorized access, disclosure, and damage:

• CC1: Control environment (governance, policies, organizational structure)
• CC2: Communication and information (security awareness, incident communication)
• CC3: Risk assessment (risk identification, analysis, and response)
• CC4: Monitoring activities (ongoing evaluation of controls)
• CC5: Control activities (policies, procedures, technical controls)
• CC6: Logical and physical access controls (authentication, authorization, access review)
• CC7: System operations and monitoring (vulnerability management, logging, incident response)
• CC8: Change management (change approval, testing, deployment)
• CC9: Risk mitigation (vendor management, business continuity)

Availability — Systems are available for operation and use as agreed:

• Capacity planning, monitoring, and recovery objectives

Processing Integrity — System processing is complete, accurate, timely, and authorized:

• Data quality, processing monitoring, and error handling

Confidentiality — Information designated as confidential is protected:

• Data classification, encryption, retention, and disposal

Privacy — Personal information is collected, used, retained, and disposed of in accordance with privacy principles:

• Notice, choice, consent, data subject rights

SOC 2 Type I vs. Type II

Type I evaluates the design of controls at a single point in time:

• "Are the controls designed appropriately?"
• Faster to complete (weeks)
• Less valuable to customers

Type II evaluates the operating effectiveness of controls over a period (typically 6-12 months):

• "Are the controls operating effectively over time?"
• Requires evidence collection throughout the period
• More valuable to customers and prospects

Type I:  Design evaluation → Point in time → Weeks to complete
Type II: Operating effectiveness → 6-12 month period → Months to complete

The audit process

A SOC 2 audit is performed by a licensed CPA firm:

1. Scoping: Define which Trust Services Criteria apply and which systems are in scope
2. Readiness assessment: Internal review to identify gaps before the formal audit
3. Evidence collection: Gather documentation, logs, and artifacts demonstrating control operation
4. Auditor testing: The CPA firm tests controls and reviews evidence
5. Report issuance: The auditor issues a SOC 2 report with an opinion

Mapping controls to criteria

A single control often satisfies multiple criteria:

control: MFA Enforcement for All Users
criteria:
  - CC6.1: Logical access controls restrict access to authorized users
  - CC6.3: Access is revoked when no longer needed
evidence:
  - IAM policy requiring MFA
  - Screenshot of MFA configuration
  - Access review showing MFA compliance

This mapping is the key to efficient compliance — one piece of evidence can satisfy multiple criteria across multiple frameworks.

ISO 27001: The ISMS and Annex A Controls

ISO 27001 is an international standard for establishing, implementing, and maintaining an Information Security Management System (ISMS). Unlike SOC 2, which is a point-in-time audit, ISO 27001 is a certifiable standard that requires ongoing operation of a management system.

The ISMS framework

An ISMS is a systematic approach to managing sensitive company information:

Plan:    Define scope, risk assessment, risk treatment, Statement of Applicability
Do:      Implement controls, training, and operational processes
Check:    Monitor, measure, and review control effectiveness
Act:     Continuously improve based on findings and changes

The ISMS follows the Plan-Do-Check-Act (PDCA) cycle — the same continuous improvement model used in quality management.

The Statement of Applicability (SoA)

The SoA is the central document of an ISO 27001 ISMS. It lists:

• All Annex A controls (or custom controls)
• Whether each control is included or excluded
• The rationale for inclusion or exclusion
• How each control is implemented

control_id: A.9.4.2
control_name: Secure log-on procedures
description: >
  Use of secret authentication information when users sign on to systems.
included: true
rationale: Required for all systems with user authentication
implementation: >
  - SSO with MFA enforced via Okta
  - Password policy: 14+ characters, no complexity requirements
  - Account lockout after 5 failed attempts
evidence:
  - Okta configuration screenshot
  - Password policy document
  - Account lockout configuration

Annex A controls

ISO 27001:2022 has 93 controls organized into 4 themes:

Organizational controls (37):

• Policies, roles, threat intelligence, supplier relationships, incident management, business continuity

People controls (8):

• Screening, terms of employment, awareness training, disciplinary process, confidentiality agreements

Technological controls (34):

• Endpoint protection, malware prevention, vulnerability management, logging, monitoring, data masking, DLP

Physical controls (14):

• Physical entry controls, cabling security, equipment maintenance, secure disposal

ISO 27001 certification process

1. Define scope: Which parts of the organization are covered by the ISMS
2. Risk assessment: Identify risks to information assets
3. Risk treatment: Select controls to mitigate risks (documented in SoA)
4. Implement controls: Deploy the selected controls
5. Internal audit: Verify the ISMS is operating effectively
6. Management review: Leadership reviews ISMS performance
7. Certification audit: An accredited certification body audits the ISMS
8. Surveillance audits: Annual audits to maintain certification

SOC 2 vs. ISO 27001

Mapping one control set to multiple frameworks

The most efficient approach to compliance is a unified control framework:

control: Vulnerability Management
soc2_criteria:
  - CC7.1: Vulnerability identification and remediation
iso27001_controls:
  - A.8.8: Technical vulnerability management
  - A.8.9: Configuration management
evidence:
  - Vulnerability scan reports (Trivy, Qualys)
  - Remediation tickets with SLAs
  - Patch management policy
  - Scan configuration and schedule

One set of evidence satisfies both frameworks. This reduces audit preparation time and ensures consistency across compliance programs.