Services
Security and compliance for B2B SaaS. The deal that is waiting on a security review gets signed.
Send the buyer's requirements and the deadline.
marius@keibisoft.com · Telegram · LinkedIn
Reply within 24 hours. Start within two weeks, or within 48 hours for an urgency fee.
SOC 2 Type II and ISO 27001 in six months
| Option | Duration after the assessment | Outcome |
|---|---|---|
| ISO 27001 | Three to four months | Certificate |
| SOC 2 Type II | Five months, with a three-month observation window | Type II report |
| Both | Five months | Certificate and report from one set of controls |
Readiness assessment
Two weeks, read-only. Gap analysis, architecture map, penetration test plan, roadmap and proposal for the implementation.
Implementation
Policies, cloud in Terraform, security checks in the pipeline, code fixes, penetration test, Vanta or Drata, and the audits to certificate, report, or both.
Managed security
After the certificate. The yearly audits, questionnaires and customer calls, vendor reviews, incident lead. Monthly retainer, cancel anytime. Also available without the implementation.
Add-on: deal support during the implementation
For package clients, at a discounted rate instead of the full fractional CISO rate. Customer security questionnaires answered and calls with their security teams taken while the controls are being built, so deals close before the certificate is issued.
On their own
Security questionnaires and customer calls
Questionnaires answered and the call with your customer's security team attended. Turnaround in days.
Cloud security and DevSecOps
AWS, GCP or Azure reviewed, put in Terraform, and security checks added to your pipeline. Four to eight weeks.
AI and LLM security governance
Policy and controls for the AI features in your product, and the AI section of your customers' questionnaires.
Cloud cost and commitment review
Before you sign a multi-year cloud commitment, someone checks it covers what you run.
Post-quantum cryptography
Your encryption checked for quantum exposure, with a migration path. KeibiDrop runs on ML-KEM-1024 with X25519.
Track record
- ISO 27001 in under four months, twice
- A stalled ISO 27001 closed in 18 days
- SOC 2 Type II, unqualified opinion, first audit
- NIS2 requirements met in the first month
- Security reviews passed for ABB, Siemens, IBM, Palo Alto Networks, BCG, Vodafone and many more
- Two employers acquired: Krizo by Dataminr, Omnio by IBM
- Azure estate moved into Terraform
- CI/CD security gates built from scratch
- CISO, Omnio · Acting CISO, Krizo · Head of Security, UK SaaS · Senior Security Engineer, IBM
- CISSP · MSc Computer Science, Copenhagen
- Speaker, Pass the SALT 2026 · Revolgy · Bharat CXO
- Author of KeibiDrop
Common questions
How long do SOC 2 Type II and ISO 27001 take together?
Six months. Two weeks of assessment, five months of implementation. ISO 27001 alone takes three to four months.
Which one does my buyer want?
US buyers ask for SOC 2. European and UK buyers and public tenders ask for ISO 27001. Each is available on its own. Selling on both sides means both, and together they cost one implementation plus a second auditor, in the same five months SOC 2 takes alone.
Do I need this at all?
Only when a buyer has asked. If nobody is asking, you will hear that first.
What do you not do?
Run the penetration test or sign the audit opinion. An independent firm tests; an accredited certification body and a licensed CPA firm certify. KeibiSoft scopes the test, manages the auditors and remediates the findings.
Send the buyer's requirements and the deadline.
marius@keibisoft.com · Telegram · LinkedIn
Reply within 24 hours. Writing on this.