There is a lot of overlap between ISO 27001:2022 and SOC 2. So, if your organisation has an ISO 27001-conformant ISMS in place, this will be a great starting point for meeting the requirements of SOC 2, although some extra effort will be required to become fully compliant. As a very rough ‘rule of thumb’, having an ISMS that is fully conformant to ISO 27001 represents around 75% of what will be required to achieve a successful SOC 2 audit. However, further work will be needed to ensure that you can fully evidence the operational effectiveness of your information security controls over the defined reporting period, and to ensure that you have appropriate processes and controls in place for the areas of people management, organisational governance and communication that are not included in ISO 27001.
The whole gap analysis process was very informative for all departments of the business. Our URM consultant was great at explaining the SOC2 audit process and what evidence may be required for each area. As a business, it has really assisted us in our implementation strategy and improving our compliance programme as a whole.
Cyber security services provider
All you need to meet SOC 2 requirements
If your organisation has received a request for a SOC 2 report and is looking to meet all the necessary requirements, URM can offer you informed guidance and practical support.
Find out more
related BLog
Preparing for a Successful SOC 2 Audit
Published on
17 Oct
2025
URM’s blog offers key advice on what to expect from your SOC 2 audit in practice, the types of evidence you will need to provide, how best to prepare, and more.
Read more
Information Security
Published on
29/8/2025
SOC 2 ExplainedURM’s blog answers key questions about SOC 2, including what it is & who it applies to, why it is beneficial, how SOC 2 reports are structured & more.
Read more
"
I thought the training was very good. It was clear and logical. The trainer was very knowledgeable, approachable and friendly, which makes it easy to stop and ask questions or to clarify a point. I was particularly impressed by his explanation of why we need to be mindful of the language we use and what the standard is actually asking for; most of it is common sense, but understanding what it actually means and what is required is key, so that really resonated with me.
contact US
Let us help you
Let us help you in your compliance journey by completing the form and letting us know how we can best support you.