Implementation
ISO 27001, SOC 2 Type II, or both from one set of controls. Scoped and scheduled at the end of the readiness assessment.
Options
| Option | Duration | Audits |
|---|---|---|
| ISO 27001 | Three to four months | Stage 1 and Stage 2 by an accredited certification body |
| SOC 2 Type II | Five months | Observation window of at least three months, then fieldwork by a licensed CPA firm |
| Both | Five months | All of the above on one evidence set; the second framework adds an auditor, not a second implementation |
What you get
- An ISO 27001 certificate and a SOC 2 Type II report with an unqualified opinion
- Policies written, adopted by management, owned by named people on your team
- Cloud in Terraform, changed through pull requests from then on
- Security checks in your pipeline: code, dependencies, secrets, infrastructure
- Code fixes merged in your repositories: authentication, authorisation, logging, encryption
- Vanta or Drata collecting the evidence, every test green or with a written exception
- Penetration test by an independent firm, findings fixed, retest passed
- A questionnaire answer set, so the next buyer's review takes an afternoon
Your buyer's security team reviews you against their own risk profile. The controls are built for the customers you sell to first, and the certification runs on top. That is what keeps the review from coming back with a list.
Month by month
The calendar below is the combined option. ISO 27001 alone finishes at month three or four; SOC 2 Type II alone follows the same months without the Stage 1 and Stage 2 rows.
| Month | Work | Audits |
|---|---|---|
| 1 | Scope, risk assessment, policies, control owners. Cloud imported into Terraform. Vanta or Drata connected. | Auditors shortlisted, you choose. |
| 2 | Pipeline checks, code fixes, access reviews, logging, backups, incident process running. | SOC 2 observation window opens. |
| 3 | Penetration test, findings fixed. Internal audit and management review. | ISO 27001 Stage 1. |
| 4 | Stage 1 findings closed. Evidence checked the way the SOC 2 auditor will check it. | ISO 27001 Stage 2. |
| 5 | Nonconformities closed. Questionnaire answer set. Handover to your named owners. | Window closes, SOC 2 fieldwork. Certificate issued. Report follows fieldwork. |
The SOC 2 window is at least three months. If a buyer needs a document before it closes, a Type I report at the window's opening covers the gap.
Who invoices you
| Item | Paid to |
|---|---|
| Readiness assessment and implementation | KeibiSoft |
| Vanta or Drata licence | The platform, in your name |
| Penetration test | An independent CREST-accredited firm, in your name |
| ISO 27001 audit and SOC 2 examination | An accredited certification body and a licensed CPA firm, in your name |
Add-on: deal support during the implementation
For package clients, at a discounted rate instead of the full fractional CISO rate. Customer security questionnaires answered and calls with their security teams taken while the controls are being built, so deals close before the certificate is issued. Deal support.
After the certificate: managed security
Optional third phase. KeibiSoft runs the security programme on a monthly retainer: the yearly ISO 27001 surveillance audit and SOC 2 observation window, the annual penetration test, security questionnaires and customer security calls, vendor reviews and DPAs, incident lead and board reporting. Managed security.
Common questions
Do we have to use your auditor?
No. Three certification bodies and three CPA firms are shortlisted with their fees, and you choose.
What happens when the auditor finds a nonconformity?
Remediation is part of the engagement. A minor nonconformity is closed within the audit window and does not delay the certificate. A major nonconformity is remediated and re-audited.
How much of my engineers' time does this take?
A reviewer on each pull request and one hour per week. The engineering work is delivered by KeibiSoft.
What about NIS2, GDPR and DORA?
Answered from the same controls. NIS2 and DORA arrive as questionnaires from your customers, and the ISMS answers them. GDPR mapping is in the policy set.
Start with the readiness assessment.
Request the readiness assessment, or send the buyer's requirements and the deadline.
marius@keibisoft.com · Telegram · LinkedIn
Reply within 24 hours. All services · ISO 27001 in 90 days