Skip to main content

Enterprise cybersecurity, cloud security and compliance

Request Assessment

ISO 27001 & SOC 2 Readiness

Get audit-ready for ISO 27001 and SOC 2, without the guesswork.

ThreatGaurd guides you from the first gap assessment to audit day: scoping, risk assessment, policies, controls and evidence, so you walk into your certification or attestation audit prepared and confident.

Request Assessment See what we cover

Why it matters

Customers increasingly ask for proof, not promises.

Enterprise buyers, partners and regulators increasingly expect an ISO 27001 certificate or a SOC 2 report before they share data or sign a contract. Without one, sales cycles slow down and security questionnaires multiply.

Readiness support helps you build a security programme that genuinely works, gather the evidence auditors expect and avoid costly surprises during the audit.

  • Unclear where to start

    Clauses, controls and criteria are hard to translate into concrete tasks for your teams.

  • Documents without practice

    Policies are written, but the evidence that they are followed is missing when the auditor asks.

  • Audits that take longer than planned

    Gaps found during the audit lead to non-conformities, delays and extra cost.

Your path to audit-ready

From the first gap assessment to audit day.

Every organisation starts from a different place. This is the typical journey, and where we help at each stage.

  1. Step 1: Gap assessment

    We compare your current controls with ISO 27001 or the SOC 2 criteria.

    What you get

    A clear gap list and readiness plan

  2. Step 2: Design and document

    We define scope, assess risks and write the policies and procedures you need.

    What you get

    Risk assessment, Statement of Applicability and policies

  3. Step 3: Implement controls

    Your teams put controls in place, with our guidance at every step.

    What you get

    Practical guidance and progress tracking

  4. Step 4: Operate and evidence

    Controls run day to day and produce the evidence auditors expect.

    What you get

    Evidence checklist and internal audit

  5. Step 5: Audit support

    You choose an independent certification body or CPA firm to carry out the audit.

    What you get

    Mock audit, auditor liaison and fix support

What we assess

Everything you need to be ready, in one programme.

We support each part of the journey, from scoping to audit day. The level of hands-on help is agreed with you.

  • Scope and context

    Define what your ISMS or SOC 2 report covers, and why.

    • Business, system and location scope
    • Interested parties and their requirements
    • Trust Services Criteria selection for SOC 2

  • Risk assessment and treatment

    The risk-based foundation that auditors examine first.

    • Asset and risk assessment method
    • Risk treatment plan and owners
    • Statement of Applicability for ISO 27001

  • Policies and procedures

    Clear, right-sized documents your teams will actually follow.

    • Information security policy set
    • Procedures for access, change and incidents
    • Supplier, HR and acceptable use policies

  • Control implementation

    Technical and organisational controls that work in practice.

    • Access control, multi-factor and logging
    • Vulnerability, change and backup management
    • Security awareness and onboarding

  • Evidence and internal audit

    Proof that controls operate, ready before the auditor asks.

    • Evidence collection and organisation
    • Internal audit against the standard
    • Management review and corrective actions

  • Audit readiness

    Preparation that makes audit week calm and predictable.

    • Mock audit and interview preparation
    • Support in selecting an independent auditor
    • Closing findings between audit stages

ISO 27001 or SOC 2?

Two respected standards, built for different audiences.

Many organisations need both. Most controls overlap, so one well-planned programme can prepare you for each.

ISO 27001 and SOC 2 compared
TopicISO/IEC 27001SOC 2
What it is An international standard for an information security management system (ISMS). An attestation report on your controls, based on the AICPA Trust Services Criteria.
Who issues it An accredited certification body. An independent CPA firm.
What you receive A certificate, valid for three years, with annual surveillance audits. A Type 1 or Type 2 report, usually renewed every year.
Commonly requested by Customers worldwide, especially in Europe, the Middle East and Asia. Customers in North America, especially for SaaS and cloud services.
Focus A risk-based management system plus Annex A controls. How controls are designed (Type 1) and how they operate over time (Type 2).

ThreatGaurd prepares you for both. The certificate or report itself is always issued by an independent certification body or CPA firm.

Methodology

Choose the path that matches your customers.

We recommend the right path during scoping, based on where your customers are and what they ask for.

  • ISO 27001 readiness

    Preparation for ISO/IEC 27001:2022 certification, from ISMS scope to the certification audit.

    Best for

    Organisations selling globally or into regulated sectors.

  • Most common

    Combined ISO 27001 and SOC 2

    One programme that maps shared controls to both, so evidence is collected once.

    Best for

    Most growing SaaS and service companies.

  • SOC 2 readiness

    Preparation for a SOC 2 Type 1 or Type 2 examination against the Trust Services Criteria.

    Best for

    Companies selling to customers in North America.

Standards we follow

  • ISO/IEC 27001:2022
  • ISO/IEC 27002:2022
  • ISO/IEC 27005
  • AICPA Trust Services Criteria
  • ISO/IEC 27017
  • ISO/IEC 27701

Deliverables

Everything your auditor will ask for, prepared in advance.

  1. Gap assessment and readiness plan Where you stand against the standard, and the steps to close each gap.
  2. Risk assessment and Statement of Applicability Your risk register, treatment plan and justified control selection.
  3. Policy and procedure set Right-sized documents tailored to your organisation, ready for approval.
  4. Evidence tracker Every control mapped to the evidence an auditor will ask for.
  5. Internal audit and mock audit reports An independent check before the real audit, with findings to close.
Readiness by ISO 27001 Annex A theme Sample report
At gap assessment Before the audit
  • Organisational controls 42% to 95%
  • People controls 50% to 100%
  • Physical controls 64% to 100%
  • Technological controls 38% to 92%

Average compliance

48%at gap assessment,97%before the audit

Statement of Applicability

All 93 Annex A controls assessed and justified

Related services

Build on your certification.

All risk and compliance services

FAQ

Questions leaders ask about ISO 27001 and SOC 2

Can’t find your answer? Our team is happy to help.

Contact our experts
Is ThreatGaurd a certification body or audit firm?

No. ThreatGaurd is a readiness and advisory partner. ISO 27001 certificates are issued by accredited certification bodies, and SOC 2 reports by independent CPA firms. We prepare you for the audit and support you while you work with the auditor you choose.

Can you guarantee that we will pass the audit?

No one can honestly guarantee an audit outcome, because the decision belongs to the independent auditor. What we do is make sure your controls, documents and evidence meet the requirements before the audit, so there are no surprises.

What is the difference between SOC 2 Type 1 and Type 2?

A Type 1 report looks at whether your controls are designed properly at a point in time. A Type 2 report also tests whether they operated effectively over a period, usually between three and twelve months. Many customers ask for Type 2.

How long does it take to get ready?

It depends on your starting point and size. Many organisations become ready for an ISO 27001 audit in three to six months. For SOC 2 Type 2, the observation period comes on top of the preparation time.

Should we choose ISO 27001 or SOC 2?

It depends on your customers. ISO 27001 is recognised worldwide, while SOC 2 is commonly requested by customers in North America. Many organisations need both, and a combined programme lets you prepare for each without duplicating effort.

How much of the work do our teams do?

Your teams own and operate the controls, because auditors will speak to them. We provide the framework, documents, guidance and checks, and can take on as much of the preparation as you need.

Do we need a penetration test for ISO 27001 or SOC 2?

Neither standard requires a penetration test in every case, but auditors commonly expect evidence of technical vulnerability management, and many customers ask for a recent penetration test. Our VAPT service can provide that evidence.

How is the cost calculated?

Cost depends on the size of your organisation, the scope of the ISMS or SOC 2 report, the standards chosen and how much hands-on support you need. After the scoping call you receive a fixed-scope proposal. Audit fees are paid separately to the certification body or CPA firm.

Get started

Start your path to ISO 27001 or SOC 2 with a clear plan.

Tell us about your organisation and what your customers are asking for. We will come back with a clear scope and proposal, with no obligation.

Request Assessment Ask a question

What happens next

  1. A short scoping callWe learn your goals, environment and timelines.
  2. A fixed-scope proposalClear scope, approach, timeline and cost, in writing.
  3. Testing on your scheduleTesting starts on the agreed date, with regular updates.