Compliance readiness program: one control set for every framework you must meet

Duration is driven by four things: the scope in question, how many controls already operate, how much time control owners can give, and how quickly risk treatment decisions are made. A narrow scope with mature IT operations moves fastest. Auditors also expect a management system to be running before a certification audit, including an internal audit and a management review, so some operating history is unavoidable. The gap assessment produces a dated plan for your situation, per framework.

Start with the one your buyers or regulators ask for. ISO 27001 leads to a certificate for an information security management system and is recognized internationally. SOC 2 is an attestation report on controls against the AICPA Trust Services Criteria, requested most often in North American procurement. The control work overlaps heavily, so the second framework takes far less effort when both are planned together. See one control set for ISO 27001 and SOC 2.

A readiness assessment is advisory work. It measures your controls against the framework, lists the gaps and helps you close them. The certification audit is an independent examination. For ISO 27001, an accredited certification body performs the Stage 1 and Stage 2 audits and issues the certificate. For SOC 2, a licensed CPA firm issues the report. Onion Infosec provides readiness and audit support and does not issue certificates or reports. That separation keeps the audit independent.

Largely, yes. Access control, change management, logging, supplier management and incident handling appear in ISO 27001 Annex A, the SOC 2 Trust Services Criteria, PCI DSS and most sector rules under different wording. Each control is implemented once and mapped to every requirement it satisfies, so one piece of evidence serves several audits. Framework-specific items remain, such as the ISO 27001 Statement of Applicability or PCI DSS scoping. The frameworks we align to are listed under compliance frameworks.

Auditors look for proof that a control operated, as well as a policy saying it should. Typical samples include access reviews with sign-off, joiner and leaver tickets, change approvals, backup restore tests, vulnerability remediation records, incident logs, supplier reviews and training records. ISO 27001 also requires the risk assessment, the Statement of Applicability, internal audit reports and management review minutes. A SOC 2 Type 2 report samples evidence across the whole review period, so a gap in the middle still counts.