Security & Compliance
ISO 27001 readiness
Build the ISMS an ISO 27001 certification actually requires — not just a folder of policy documents.
Who this is for
- Companies selling into Europe or other markets where ISO 27001 is the expected framework
- Teams that already hold or are pursuing SOC 2 and want to extend into ISO without duplicating the work
- Organizations that need an accredited certification body's certificate, not just an internal attestation
What this addresses
- A European or multinational customer's procurement process requires ISO 27001, not SOC 2
- Policy documents exist but there's no real Information Security Management System operating behind them
- It's unclear how much of an existing SOC 2 program can be reused for ISO 27001
Our approach
We build the ISMS itself — risk assessment methodology, Statement of Applicability, and the operating cadence a certification body will actually test — rather than treating ISO as a documentation exercise.
Where SOC 2 work already exists, we map the overlapping Annex A controls so the same evidence supports both, instead of duplicating effort.
We help prepare for the certification audit itself: Stage 1 documentation review and Stage 2 operational review, both run by an accredited certification body.
Every engagement follows the same six-step methodology — see our approach.
What to expect
ISO 27001 certification is issued by an accredited certification body, not by OCPL. Timeline depends heavily on how mature the ISMS needs to be and whether SOC 2 work already exists to build on — we give a realistic estimate once we've seen the environment, not before.
Frequently asked
Is ISO 27001 the same as SOC 2?
No, though they overlap significantly. SOC 2 is an attestation report against the AICPA's Trust Services Criteria; ISO 27001 is a certifiable management system standard with its own Annex A controls. Many companies pursue one and later extend into the other.
Does OCPL issue the ISO 27001 certificate?
No — certification is issued by an accredited certification body after an independent audit. We prepare the ISMS and evidence so that audit goes well.
Can we pursue ISO 27001 without already having SOC 2?
Yes, they're independent frameworks. Starting with ISO 27001 first is common for companies selling primarily into Europe.
Related
SOC 2 readiness
Significant control overlap — worth scoping together if both frameworks are on the table.
Fractional CISO
An ISMS needs an accountable owner after certification, not just during the initial build.
Standards & methodologies
How ISO 27001 fits alongside the other frameworks OCPL's methodology draws on.
SOC 2 vs ISO 27001
Which framework your customers are actually asking for.
Weighing ISO 27001 against SOC 2?
We can help figure out which framework — or both — actually matches what your customers are asking for.