Getting Audit-Ready: ISO 27001, SOC 2, Cyber Essentials

Most teams treat a compliance audit like a fire drill that shows up once a year. It doesn't have to be that way, and the frameworks themselves aren't as mysterious as vendors make them sound. Here's what actually matters when you're prepping for ISO 27001, SOC 2, or Cyber Essentials.

Know which framework you're actually being asked for

These three get lumped together but they're solving different problems. ISO 27001 is a management system standard — it certifies that you have a functioning Information Security Management System (ISMS) with risk assessments, policies, and continuous improvement built in. SOC 2 is an attestation report, usually Type II, covering a period of time (commonly 6-12 months) against Trust Services Criteria: security, availability, processing integrity, confidentiality, privacy. Cyber Essentials is a UK government-backed scheme focused on five basic technical controls: firewalls, secure configuration, access control, malware protection, and patch management.

If a customer says "we need you to be SOC 2 compliant," ask which type and which criteria they actually care about. Most B2B SaaS deals only require Security and Availability, not the full five criteria.

Build the evidence trail before the auditor asks

Auditors don't take your word for it — they want artifacts. For ISO 27001 that means a Statement of Applicability mapping all 93 controls in Annex A (2022 revision) to what you've implemented or excluded, with justification. For SOC 2, it means screenshots, logs, and tickets proving controls operated consistently across the audit window, not just on the day someone remembered to configure it.

Set up evidence collection as an ongoing process, not a scramble:

# Example: pull IAM access review evidence monthly via AWS CLI
aws iam generate-credential-report
aws iam get-credential-report --output text --query 'Content' | base64 -d > access-report-$(date +%Y%m).csv

Store these with timestamps in a dedicated evidence repo (Google Drive folder, Vanta, Drata — whatever you use) organized by control ID, not by month. Auditors sample across the period; you need to prove the control was live in March and October, not just when you remembered.

The controls that trip people up every time

Access reviews are the number one finding. If you can't show a quarterly review of who has access to production systems, with evidence someone actually removed stale accounts, expect a finding regardless of framework. Run this as a recurring calendar task, not an ad hoc favor.

Vendor risk management is the second big gap. ISO 27001 clause A.5.19-A.5.23 and SOC 2's vendor management criteria both expect you to assess subprocessors — cloud providers, payment processors, anything touching customer data. A one-page vendor risk questionnaire per critical vendor, reviewed annually, covers most of this.

Incident response plans that exist only as a document nobody's tested are a common finding too. Run a tabletop exercise at least once before your audit window closes and keep the meeting notes. Auditors specifically ask for evidence the plan was exercised, not just written.

For Cyber Essentials, the technical scope questions matter more than people expect. You need to accurately describe your boundary — every device, cloud service, and BYOD policy in scope — because misrepresenting scope is grounds for failing even if the technical controls are fine. Patch management is checked literally: critical and high-severity patches must be applied within 14 days of release for internet-facing services.

Running a realistic internal timeline

For SOC 2 Type II, budget 3-6 months of evidence collection before the audit period even starts, since Type II requires proving controls operated over the observation window itself, not just at a point in time. ISO 27001 certification typically runs 6-12 months from gap assessment to certificate, including a Stage 1 documentation review and Stage 2 on-site (or remote) assessment by the certification body. Cyber Essentials is faster — self-assessment questionnaires can be turned around in weeks if your basics are already in shape, with Cyber Essentials Plus adding an external technical verification.

Don't let the audit be the only time you check your own work

Run an internal readiness assessment against the actual control list 60-90 days before the real audit. Treat findings from that internal pass the same way you'd treat auditor findings — remediate, document the fix, and keep the paper trail. That internal pass is usually where teams catch the access review gaps and stale vendor contracts before someone external does it for them, with a report attached to a customer contract renewal riding on it.

If you want to go deeper on the technical controls behind these frameworks — access control design, logging, incident response — check the Blue Team and Certifications tracks over on Korra Studio.