There is a lot of overlap between ISO 27001:2022 and SOC 2. So, if your organisation has an ISO 27001-conformant ISMS in place, this will be a great starting point for meeting the requirements of SOC 2, although some extra effort will be required to become fully compliant. As a very rough ‘rule of thumb’, having an ISMS that is fully conformant to ISO 27001 represents around 75% of what will be required to achieve a successful SOC 2 audit. However, further work will be needed to ensure that you can fully evidence the operational effectiveness of your information security controls over the defined reporting period, and to ensure that you have appropriate processes and controls in place for the areas of people management, organisational governance and communication that are not included in ISO 27001.
The whole gap analysis process was very informative for all departments of the business. Our URM consultant was great at explaining the SOC2 audit process and what evidence may be required for each area. As a business, it has really assisted us in our implementation strategy and improving our compliance programme as a whole.
Cyber security services provider
All you need to meet SOC 2 requirements
If your organisation has received a request for a SOC 2 report and is looking to meet all the necessary requirements, URM can offer you informed guidance and practical support.
Find out more
related BLog
SOC 2 Explained
Published on
27 Mar
2025
URM’s blog answers key questions about SOC 2, including what it is & who it applies to, why it is beneficial, how SOC 2 reports are structured & more.
Read more
"
Whenever we have asked our QSA and account manager whether additional work is required outside of the annual cycle, there has never been a hard sell of any of URM’s services, and instead offer advice based on our compliance requirements and business needs.
CISO at University of Surrey
contact US
Let us help you
Let us help you in your compliance journey by completing the form and letting us know how we can best support you.