How CrowdComms and Henchman use ISO 27001 and SOC 2 together

If you’re a growing start up, chances are you’ll need to demonstrate trust to your customers. To ensure you have strong data protection measures in place and a robust security posture, they’ll often ask to review either your ISO 27001 certification or your SOC 2 report. For a while, you may get by by filling out their lengthy security questionnaires, but eventually you’ll need to get your ISO 27001 or SOC 2, depending on your product, industry, and region.

‍

This is where you may be asking yourself a few questions: Where do I start? Do I need one of these frameworks or both?

‍

I recently spoke to two Vanta customers — Donna Fielding, Information Security Manager from CrowdComms and Louis Opsomer, Head of Finance and Operations at Henchman — to understand their process of attaining these two frameworks and to see how they use ISO 27001 and SOC 2 together.

‍

ISO 27001 vs. SOC 2

Established by the International Electrotechnical Commission and the International Organization for Standardization (ISO), ISO 27001 helps organizations protect their information through the adoption of an information security management system (ISMS). It helps businesses organize their people, processes, and technology and was designed to ensure the confidentiality, integrity of information, and availability. Following an audit, your organization would get a certification that attests to your security. 

‍

The SOC 2 standard was created by the American Institute of CPAs (AICPA) and provides a framework for ensuring companies securely manage customer data based on five Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. Following an audit, an organization will get a SOC 2 report which assures your customers, prospects, and business partners that services are reliable and trustworthy. SOC 2 is most common in North America.

‍

‍

How Henchman and CrowdComms use ISO 27001 and SOC 2

Henchmen is an AI-powered legal contract drafting company based in Belgium. The company’s initial sales happened in Belgium and quickly expanded across Europe. Since ISO 27001 is commonplace in Europe, Henchman got their ISO 27001 certification first during their expansion in this region. 

‍

Eventually the product evolved and Henchman was ready to take on the US market. Louis knew that expansion into the US would require the business to obtain a SOC 2 report. “We’d already laid the foundation of our information security framework with ISO 27001 and that helped us speed up the process of getting a SOC 2 report,” Louis says. 

‍

CrowdComms is an end-to-end event tech company based in the UK with a similar journey. Given the company’s base in the UK, CrowdComms’ initial customers were looking for ISO 27001 compliance. As the business expanded into the US, many of the supplier contracts the team received stated that they would need to obtain and maintain a SOC 2 in order to be onboarded as a vendor. "Our clients wanted us to have a robust security platform,” Donna says, “To do this, and to show our clients that we were taking security seriously we decided to look into getting a SOC 2."

‍

CrowdComms first got its SOC 2 Type 1 to show evidence of the necessary controls and eventually got a SOC 2 Type 2 report. “We saw this as a way of speeding up the onboarding sales process too and helping our team get through security questionnaires from our suppliers,” Donna says, “Having that SOC 2 just opened those doors to us that we never had before." 

‍

Why ISO 27001 and SOC 2 are better together

While these two frameworks have their differences, they also have a lot in common. 

‍

Both guide you toward implementing crucial best practices for your information security so your data (and your customers’ data) stays safe. The protocols for both ISO 27001 and SOC 2 are designed to help you document your security controls and practices. Both require you to undergo an external audit. And several of the security controls listed in these frameworks overlap. If you’re pursuing both an ISO 27001 and a SOC 2 at the same time and your audit windows align, it’s possible to work with the same auditor.

‍

“These two standards elevate each other,” Louis says. Since ISO 27001 is framework-focused and SOC 2 is about ensuring the processes and standards your business builds are being adhered to, these frameworks can complement each other well. “On one hand you’re developing a good framework that serves as a basis with ISO 27001, while SOC 2 is keeping you accountable for what you actually built.” 

‍

Donna agrees, “There is very much an overlap between the two standards, especially some of the processes and policies that they both have in place.” Donna says that in her experience, it’s been easier to implement SOC 2 after obtaining ISO 27001 compliance given the foundational approach of ISO 27001. 

‍

Accelerated compliance with Vanta

Since these two standards have several overlapping requirements and controls, you can easily get compliant in both, especially with the help of a compliance automation tool like Vanta. Louis says that Vanta made it easy for the team to replicate the controls they already had in place for ISO 27001 that could be used for SOC 2. “It actually allows you to make speed on that second standard.”

‍

Donna says Vanta helped CrowdComms easily provide evidence for its SOC 2 audit using the same evidence the team used for ISO 27001. “I wasn’t having to duplicate work. I could use the same things when I used the Vanta tool,” Donna says. During her SOC 2 process, she was able to get all the information, upload it to Vanta, and provide evidence quickly and easily.

‍

By repurposing the controls and evidence across both frameworks, it can also save your business time and money. "Having Vanta saved me time and allowed me to get to the basics of what an ISO framework meant through Vanta,” Louis says, “It saved me a bunch of time. The combination of doing the work and the audit in Vanta speeds up the process and allows me to spend time on other things.”

‍

The reality is that you’ll likely need both SOC 2 and ISO 27001 once your business reaches product maturity. If you’re not there yet, you’ll need to decide which one is a bigger priority depending on the needs of your clients — some organizations want you to have both standards as they cover different aspects of your security posture — and get the other further down the road. 

‍

At Vanta, we advise our customers to understand their industry and their client and product needs before deciding which frameworks to move forward with. Our team is always available to have that detailed discussion.

‍

To hear more from our customers about how ISO 27001 and SOC 2 can work together, watch the webinar recording. If you’re ready to start automating your compliance, request a demo.