SOC 2 + ISO 27001-Aligned Attestation
A SOC 2 examination with an added section addressing your controls against ISO/IEC 27001:2022 Annex A, a bridge for buyers who accept one while you pursue certification. Many EU buyers will still require the certificate.
- Criteria
- ISO/IEC 27001:2022 Annex A (licensed text)
- Report
- SOC 2 Type I or II with Annex A section
- Engagement
- Additional criteria in your SOC 2 examination
Timeline: Same period as your SOC 2 when the added controls have operated for that period; otherwise we tell you on the scope call.
Who needs SOC 2 + ISO 27001-aligned?
SaaS with EU and UK customers
European buyers ask for ISO 27001 first. A mapped SOC 2+ report lets you answer in their terms while you decide whether to pursue the certificate. Many will still require it.
Vendors facing Annex A questionnaires
Large enterprise security reviews are often organized by Annex A control number. The mapping answers them row by row.
Companies pursuing certification
You expect to pursue a certificate and want a control set and evidence base that already line up with Annex A.
What is in the report
- Your full SOC 2 opinion on the Trust Services Criteria you select
- An additional section addressing your controls against the 93 Annex A controls of ISO/IEC 27001:2022 across the organizational, people, physical and technological themes, based on the mapping management prepares
- Test results for the Annex A-mapped controls, with any control you do not operate shown as not applicable or as an exception
- A plain statement of what "ISO 27001-aligned" means so readers do not take it for a certificate
What it is not
Not an ISO/IEC 27001 certificate. Only a certification body accredited by a body such as ANAB or UKAS can issue one, after auditing your information security management system. Tang Advisory does not issue ISO certificates. This is an independent CPA attestation that your SOC 2 controls are mapped to and tested against Annex A, and it says so on its face.
We do not design, implement, or operate the controls we examine.
How it works
The framework is addressed as additional criteria in the same SOC 2 examination: one report, one fieldwork window.
- 1
Scope call
Confirm which buyers are asking for ISO and whether a mapped report will clear their review.
- 2
License and map
You license the ISO 27001:2022 text and map your controls to Annex A. We evaluate the mapping and can share a template crosswalk, but the mapping is management’s.
- 3
Examination
Annex A-mapped controls are tested in the same fieldwork as your SOC 2.
- 4
One report
Signed SOC 2+ report with the Annex A section.
Scope, timing and fees
The add-on is scoped together with your SOC 2 during the preliminary scope discussion. Formal scope, timing, and fees are established only after the firm completes its required acceptance and quality gates.
We do not design, implement, or operate the controls we examine.
Frequently asked questions
European buyers asking for ISO 27001?
Schedule a free 30-minute preliminary scope discussion. We will tell you whether an ISO 27001-aligned SOC 2+ report will clear their review or whether you need a certification body.