Enterprise customers demand security compliance. Learn why startups must choose ISO 27001, SOC 2, or both — and how to keep costs in check.

Why Bother with ISO 27001 and SOC 2?

More and more customers demand their suppliers to be ISO 27001 or SOC 2 certified. While that might be easy for large corporations, it isn’t so for startups and mid-sized companies.

Nevertheless, as a startup serving enterprise customers, there is no way you can choose. If you want those contracts to materialize, you will have to find a way to comply with all the clauses suggested by the legal department of your new customer.

To illustrate this, here are two examples of customer contract clauses we had to agree to before we were ISO 27001 certified:

“SUPPLIER should be certified against either the SOC 2 type II framework, ISO 27001, (or an equivalent level of certification as agreed with CUSTOMER), and shall provide evidence of its certification in due time. The certification will be finalized by end of 2021.”

“SUPPLIER must also provide proof of currently valid, internationally recognised certification in accordance with the ISO/IEC 27001 standard. SUPPLIER is currently undergoing ISO 27001 certification, expected date of stage 2 audit May 2021. In case stage 2 audit should fail, the provider will immediately inform CUSTOMER.”

Nowadays, after our ISO 27001 certification, we can just tick the box when customer contracts contain clauses such as the example below:

“SUPPLIER has robust internal information security policies and procedures based on ISO 27002 at minimum, or be ISO 27001 certified.”

Enter SOC 2. The ISO 27001 certification has helped us with our customers in Europe, but the United States and the Middle East ask for SOC 2. Here is what we are confronted with now during RFP processes:

a. Based on your Technical Compliance Response, you currently do not have SOC 2 Type IIcertification. This certification is mandatory without which a supplier may be disqualified.

b. If you’re selected, do you commit to achieve the certification within a span of 12 to 18 months from the Effective Date of the Agreement?

c. If Yes, please confirm your acceptance & specify if you are willing to move forward towards achieving the certification.

Just Do It

You see from the examples above that there is no way to ignore ISO 27001 and SOC 2 requirements from enterprise customers. Just do it, instead of only talking about it. Because you’ll lose large deals if you don’t do it.

At the same time, getting ISO 27001 certified or SOC 2 attested isn’t your core business. So you will need to find a way to deal with those frameworks in a lean and pragmatic way.

Don’t try to google “ISO 27001” or “SOC 2” and hope for a lean and pragmatic solution. There are tons of consultants and tool providers out there who are eager to sell their services and solutions, respectively. Such offerings are geared towards larger organizations; they will overwhelm your startup both in terms of effort and costs.

Instead, I am urging you to use a very simple method to set up your ISO 27001 certification: common sense. Read the requirements, think about what steps are required to become compliant, and implement the steps accordingly. There is always a low-cost way to do things; upgrading later when it’s necessary is easier than starting too big and downgrading later.

ISO 27001 or SOC 2?

One way of being pragmatic about ISO 27001 and SOC 2 is to choose either framework. For this, you first need to understand the commonalities and differences between the frameworks.

  • Geographic focus: ISO 27001 is not well-known in some parts of the world (for example in the United States or the Middle East), but a de-facto standard in some other parts of the world (for example in Europe). In contrast, SOC 2 is well-known in the United States and the Middle East.
  • Certificate vs. report: When you passed ISO 27001 certification, you get a certificate that you can stick to the wall in your entrance hall, and send a scan of it to your customers. The certificate says that you are certified, but it doesn’t say what you are doing to uphold information security. In contrast, for SOC 2 you cet a report in prose text, outlining in detail what you are doing to uphold information security. It goes without saying that passing on a SOC 2 report to your customers builds much more trust than handing over a 1-page ISO 27001 certificate.
  • Standard controls vs. company-specific controls: You must be audited on all the numerous controls outlined in Annex A of the ISO 27001 norm to obtain your ISO 27001 certificate — even if some of them are not relevant to your business. In contrast, for a SOC 2 report, each organization designs its own controls to comply with SOC 2 — the only topic that is not optional under SOC 2 is security. In this way, a SOC 2 report is much more tailor-made than a standardized ISO 27001 certificate.
  • Time: An ISO 27001 certification audit is a matter of 2 days, and it’s done. In contrast to an ISO 27001 audit, a SOC 2 audit takes 3–12 months. In this way, an independent auditor doesn’t just get a glimpse of your information security mechanisms on a single day, but over an extended period. This increases the trust level of SOC 2, as it is much harder for shortcomings to stay hidden over such a long period.
  • Costs: SOC 2 is possibly the most expensive framework, as audits take a long time and need to be carried out in full each year to uphold the attestation. In contrast to SOC 2, the costs for achieving and maintaining an ISO 27001 certification are moderate.

One or the other, or both frameworks? The answer to this question will be unique for your business and your circumstances.

For us at Yonder, we started with ISO 27001, as we primarily had customers in Europe in our early years. With the currently ongoing expansion beyond Europe, there is no other way than to obtain a SOC 2 attestation on top of our ISO 27001 certification to satisfy those markets.

The good news in using two frameworks is that you can reuse much of the stuff you already implemented for your ISO 27001 certification for your SOC 2 attestation.

Over to you, you choose what approach is most suitable for your organization.