For SaaS companies entering enterprise sales motions, ISO 27001 certification and SOC 2 attestation are typically sales prerequisites. Enterprise procurement teams ask for one or both before committing to anything beyond a proof-of-concept; ISO 27001 dominates outside the United States and SOC 2 dominates inside it; many companies need both.
This solution covers the readiness path: pre-audit gap assessment, control-design and operational-evidence remediation, and engagement-cadence coordination with the accredited auditor.
ISO 27001 vs SOC 2 — what’s different
The two frameworks address overlapping but distinct objectives.
ISO/IEC 27001 is the international certification standard for Information Security Management Systems (ISMS). Certification is issued by accredited certification bodies after a two-stage audit (Stage 1 documentation review, Stage 2 implementation assessment), followed by annual surveillance audits and triennial recertification. The 2022 edition (ISO/IEC 27001:2022) replaced the 2013 edition and is the active certification target.
SOC 2 is an attestation report (not a certification) issued by a CPA firm against the AICPA Trust Services Criteria. Two report types exist: Type I (point-in-time control design) and Type II (control operating effectiveness over a measurement period, typically 6-12 months). Enterprise customers typically require SOC 2 Type II.
The two frameworks share structural patterns but differ in important details — ISO 27001 requires a documented Statement of Applicability and risk-treatment plan, SOC 2 requires evidence of operating effectiveness over time. Most SaaS readiness engagements address both because the operational work overlaps.
Where Melina engages on ISO 27001 / SOC 2 readiness
Pre-audit gap assessment
We assess the existing security and operations posture against the applicable controls — ISO/IEC 27001:2022 Annex A controls plus the management-system requirements, and the AICPA Trust Services Criteria for SOC 2. The output is a remediation plan with specific gaps, evidence requirements, and timeline estimates.
Control-design and policy gap remediation
For controls without sufficient design documentation, we support policy and procedure drafting alongside the engineering and operations teams. The documentation produced is integrated with the existing organizational documentation rather than added as a separate compliance shelf.
Technical control remediation
Where the gap is technical rather than documentary — missing audit logging, insufficient access-control enforcement, inadequate encryption-key management — we work alongside the engineering team on remediation.
Auditor coordination
We coordinate with the client’s chosen audit firm to ensure evidence packages, control descriptions, and testing schedules are structured to match auditor expectations. We are not the auditor — the attestation is issued by the accredited audit firm — but our work is structured to integrate cleanly with their process.
What this solution does not include
- The ISO 27001 certification audit or SOC 2 attestation itself — issued by the accredited audit firm
- Selection of the audit firm — operator-driven (with our input where requested)
- Ongoing ISMS operation post-certification — though we support transition to operational handoff
Service mapping
ISO 27001 / SOC 2 readiness draws across:
- Architecture & Cloud Review
- GRC services — primary service for management-system documentation
- Mobile & App Security — for technical-control validation
Compliance and standards frame
- ISO/IEC 27001:2022 (Information Security Management Systems)
- ISO/IEC 27002:2022 (Information Security Controls)
- AICPA Trust Services Criteria (SOC 2)
- ISO/IEC 27017 (cloud-services security controls — frequent companion control set)
- ISO/IEC 27018 (cloud personal-information processing)
- CSA STAR (frequent companion certification)
Engagement model
End-to-end readiness is typically Custom Engagement. Targeted control-set remediation can run as Scoped Assessment. Ongoing engagement through annual surveillance and SOC 2 Type II measurement periods is typically Retainer.
“ISO 27001 and SOC 2 readiness work that produces durable outcomes treats the frameworks as forcing functions for engineering posture improvements, not as documentation exercises. Teams that ship strong controls and clean evidence as a side effect of running the business outperform teams that try to retrofit compliance documentation onto an unchanged technical posture.” — Gleb Z., CTO, Melina Security
What buyers ask us first
Three questions surface in nearly every initial readiness discovery call:
“Do we need ISO 27001 and SOC 2, or can we pick one?” Depends on customer geography. US-heavy customer base — SOC 2 typically suffices for early enterprise sales. EU and APAC customers usually require ISO 27001. International SaaS targeting enterprise customers in multiple regions typically needs both within 12-18 months of the first enterprise commitment. The cost of running both is materially less than 2x the cost of running one because the underlying controls overlap heavily.
“How does pre-audit readiness coordinate with active enterprise sales?” Strategically — many enterprise sales motions can proceed with a documented readiness plan and a target audit date rather than waiting for the completed audit. We structure readiness engagements to produce intermediate artifacts (risk assessment, Statement of Applicability, gap-closure roadmap) that enterprise procurement teams accept as evidence of audit-track commitment. The first enterprise contract usually closes before the first audit completes.
“What’s the actual engineering cost of readiness?” Variable, but the structural answer: teams with mature engineering practices and modest existing security posture typically need 4-7 months of part-time engineering attention across 2-3 engineers, plus ongoing operational commitment for evidence-collection routines. Teams starting from low compliance maturity should plan for longer engagement and broader engineering disruption.
Frequently asked questions
How long does ISO 27001 or SOC 2 readiness take?
For a SaaS company with modern engineering practices and reasonable starting security posture: 4-7 months to certification or first Type II report. For companies starting from low compliance maturity, longer. SOC 2 Type II requires the audit measurement period itself (typically 6 months minimum) — that is sequential, not parallelizable.
Should we pursue ISO 27001 or SOC 2 first?
The right answer depends on customer geography. US-heavy customer base — SOC 2 first. EU-heavy and APAC-heavy — ISO 27001 first. If both are needed, ISO 27001 first is often the more efficient path because the management-system documentation requirements are stricter and SOC 2 inherits cleanly from a strong ISMS foundation.
Will the audit firm accept our technical findings from Melina as evidence?
The audit firm makes its own evaluation. We structure our work to integrate with audit-firm expectations — control descriptions in audit-compatible language, evidence packages organized to the auditor’s likely sampling frame, technical findings traceable to specific control objectives. The audit firm still performs its own assessment.
How does readiness coordinate with ongoing engineering velocity?
Pre-audit readiness is structured to integrate with the existing engineering rhythm rather than parallel it. Most successful readiness engagements treat the compliance controls as forcing functions for engineering posture improvements the team would benefit from regardless of compliance pressure. Controls that survive past the first audit cycle are controls that match operational reality; controls designed only to satisfy auditors typically degrade between cycles and surface as findings at the next audit.
What happens after the first audit cycle?
ISO 27001 requires annual surveillance audits and triennial recertification; SOC 2 Type II requires annual report renewal with each new measurement period. Post-certification engagement typically converts to Retainer covering ongoing evidence-collection oversight, control refresh on system changes, and pre-surveillance preparation. Organizations that treat the certification as the end of the work rather than the start of ongoing operations usually struggle at year-two surveillance.
Related
- Architecture & Cloud Review service
- Industries — Cloud and SaaS companies
- What is SBOM? — frequent companion artifact in supply-chain controls
- Solutions — Supply-Chain Security