SOC 2 and ISO 27001 alongside FedRAMP

We prepare SaaS companies for SOC 2 and ISO/IEC 27001, and build the controls on NIST SP 800-53, the catalog FedRAMP tests.

FedRAMP 20x Class A accepts a SOC 2 Type II report from the past 12 months. Classes B, C and D need a FedRAMP independent assessment of their own.

SOC 2, ISO 27001 and FedRAMP compared

SOC 2, ISO/IEC 27001 and FedRAMP compared
Framework	Result	Issued by	Built on
SOC 2	An attestation report: Type 1 on controls as of a date, Type 2 also on how they operated.	An independent CPA firm.	The AICPA’s 2017 Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality and Privacy.
ISO/IEC 27001:2022	A certificate on a three-year cycle, with surveillance audits between.	A certification body, preferably an accredited one.	An information security management system and the 93 Annex A controls, in four themes.
FedRAMP	A FedRAMP Certification, then continuous monitoring and a yearly independent assessment.	A FedRAMP Recognized independent assessor; FedRAMP certifies.	NIST SP 800-53 Rev. 5 for Rev5, or the Key Security Indicators for 20x.

Control set
We build your controls on NIST SP 800-53 and map the Trust Services Criteria and the Annex A controls to them. Each control then has one owner and one set of evidence for all three audits.
Control map
Your controls, with the SOC 2 criteria, Annex A controls and SP 800-53 controls that each one answers.
Readiness assessment
Before the auditor arrives, we test each control the way they will and fix what fails.
ISO management system
The scope, risk assessment, Statement of Applicability, internal audit and management review that ISO/IEC 27001 certification needs.
Audit support
We prepare the evidence and the people, and work through the auditor’s requests alongside you. The SOC 2 report itself comes from an independent CPA firm and the ISO/IEC 27001 certificate from a certification body, so we can’t issue either one.