Certification · ISO 27001 · SOC 2
Enterprise-ready roadmap
An enterprise customer has made ISO 27001 certification or a SOC 2 report a condition of signing or renewing. In about three weeks, I measure the gap, build the plan to get there in 6 to 9 months, and help you choose the GRC tool, the auditor and the budget.
Who it is for
- Small and mid-sized companies in any sector asked for certification by an enterprise customer
- Companies outside the EU selling to European enterprises, where ISO 27001 is usually the expected credential
- Teams without a full-time CISO or compliance lead, where the topic sits with the CIO, the CTO or a senior executive
Typical situation
A prospect or enterprise customer asks for ISO 27001 certification or a SOC 2 report, in a tender, a security questionnaire or at renewal time.
Then come the practical questions: how long, how much, which tool, which auditor, and who owns it. You need an answer for the customer, and a plan the team can deliver without putting the business on hold.
What I do
A short, fixed-fee engagement that ends with decisions made and a plan ready to start.
Scoping and choice of framework
What the customer requires (ISO 27001, SOC 2 or both), the scope to certify (activities, sites, teams, systems) and the commercial deadline to meet.
Gap assessment
Interviews with the teams, review of current practice (access, development, hosting, backups, incident handling, documentation) and gaps ranked by priority and effort.
6 to 9 month plan
Milestones, owners, estimated internal effort and the sequence leading to the certification or attestation audit.
Tool, auditor, budget
Selection criteria for a GRC tool that fits your size, for the certification body or SOC 2 audit firm, and a full budget: licences, audit fees, internal time and any outside support. The comparison always covers several tools (see the partnership disclosure below).
Deliverables
- A prioritised gap assessment report
- A 6 to 9 month compliance plan with milestones and owners
- A reasoned recommendation on the GRC tool and the auditor
- A complete budget estimate
- A short note you can send to the customer asking for certification
- A read-out session with management
Format and duration
- Format
- Fixed-fee engagement, fully remote: video-call interviews and a read-out session
- Indicative duration
- About 3 weeks
- Fees
- Fixed fee, quoted on requestEstimate the budget for this service
- Independence
- Cybertarian is a Drata partner (Drata publishes a GRC platform) and may be paid under that partnership. I also disclose this in every proposal. The comparison covers several tools and the choice is yours.
Frequently asked questions
ISO 27001 or SOC 2?
It depends on your customers. European enterprises most often ask for ISO 27001; North American customers usually expect a SOC 2 report. The two overlap heavily: if you need both, the plan builds one shared set of controls.
We are not based in the EU. Why ISO 27001?
Because it is the credential European procurement and security teams know and ask for. It also gives you a sound basis for the EU rules your customers will raise: GDPR, NIS2 and, if you use AI in your products or services, the AI Act.
Is three weeks enough to get certified?
No. The three weeks produce the assessment, the plan and the decisions. Getting compliant usually takes 6 to 9 months, depending on your starting point and the scope chosen.
Are you tied to a GRC tool vendor?
Yes: Cybertarian is a Drata partner. I say so from the first call and in the proposal. The recommendation compares several tools against your criteria (size, frameworks, budget, integrations); if another tool suits you better, that is the one I recommend.
First call
In 30 minutes we can go through what your customer is asking for, your deadline and the scope involved, and check whether the roadmap is the right first step.