Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

If…, then how…

A customer asks for SOC 2 and we hold ISO 27001: what do we send?

6 decision pointsThe pack behind this answer: SOC 2 Report Readiness

Add to board memo

The short answer

Recommendation
Name the ISO/IEC 27001 certificate by title, scope, issuer and dates, and any SOC 2 report by type, categories, system and period. Send each under its own terms, answer the customer's questions on their own terms, and let the customer decide what it accepts.
Reasoning
ISO/IEC 27001 certification and a SOC 2 report are different things, from different bodies, about different subjects. Neither equals or replaces the other, so a reply that says one answers the other is not true. A SOC 2 report is an attestation by a licensed CPA firm, not a certificate. What a customer accepts is the customer's decision.
Considerations
  • If you hold no SOC 2 report, say so in the first sentence and say what you do hold.
  • A report that is restricted in use goes only under a confidentiality agreement or the terms the report states.
  • Any date you give for a future report is a commitment, so log it with an owner.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartA customer asks for SOC 2 and we hold ISO 27001DecisionIs our ISO/IEC 27001 certificate current and in scope here?StepDescribe it by its own scope, or leave it out if expiredStepName each document exactly and keep the two apartStepAnswer the customer's questions on their own termsDecisionHas the customer agreed in writing to accept the certificate alone?OutcomeSend the certificate details and answers, and keep the replyDecisionDo we hold a SOC 2 report for this service?DecisionIs a SOC 2 examination under way or planned?OutcomeSend the answers, the certificate details and the SOC 2 datesOutcomeSay we hold none, and answer on our own termsDecisionDo the report's terms and an NDA let us send it to this customer?OutcomeOffer the Public items and ask Legal for an agreementDecisionDid the report period end within about 12 months?OutcomeSend the report and certificate details, with any bridge letterOutcomeSend the report as it is and say when the next is expected

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one. A code beside a source, such as RR-17, is the number of a rule in that pack document; the document lists its rules.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 16 steps.

  1. Start

    A customer asks for SOC 2 and we hold ISO 27001

    ISO/IEC 27001 certification and a SOC 2 report are different things, from different bodies, about different subjects. Neither equals or replaces the other, in either direction. So the reply says what you hold, exactly, and lets the customer decide what it accepts.

    In the pack

  2. Decision

    Is our ISO/IEC 27001 certificate current and in scope here?

    Name a certificate by its exact title, scope, issuer and dates, and say whose it is. A document never covers more than its own scope statement, and one past its expiry is not sent. If the customer's service sits outside the scope, say so.

    In the pack

  3. Step

    Describe it by its own scope, or leave it out if expired

    If it covers only part of the service, say what it covers and no more. If it has expired or been withdrawn, do not send it, and the answers that cite it wait until the owner renews it or changes them. If you do not hold what the customer assumes you hold, say so in the first sentence and say what you do hold.

    In the pack

  4. Step

    Name each document exactly and keep the two apart

    Describe the ISO/IEC 27001 certificate by its title, scope, issuer and dates, and a SOC 2 report by its type, categories, system and period. Never call a SOC 2 report a certificate, and never say that one document equals or replaces the other. Legal reads the wording before the first use.

    In the pack

  5. Step

    Answer the customer's questions on their own terms

    If the questionnaire follows ISO/IEC 27001, answer each question on its own terms and state the SOC 2 position separately. Do not claim that an ISO/IEC 27001 control meets or equals a SOC 2 criterion. The AICPA & CIMA publishes a document titled Mapping: 2017 Trust Services Criteria to ISO 27001, a members' download, and the customer may ask for it. The customer decides what it accepts. Other documents you hold, such as a Statement of Applicability or a penetration-test summary, go under their own sharing terms.

    In the pack

    See also

  6. Decision

    Has the customer agreed in writing to accept the certificate alone?

    What a customer accepts is the customer's decision. Ask it plainly and keep the reply. Do not claim that the certificate answers a SOC 2 request. If the certificate has expired there is nothing to accept, so answer No.

    In the pack

  7. Outcome

    Send the certificate details and answers, and keep the reply

    Send what you hold, named exactly, with your answers, under the sharing tier the evidence index sets. Keep the customer's written agreement with the response. It records what the customer accepted and says nothing about any other customer.

    In the pack

  8. Decision

    Do we hold a SOC 2 report for this service?

    A SOC 2 report is an attestation by a licensed CPA firm on management's description of one system and its controls, for the categories and the period it states. A report on another system or another period is not a report on this service.

    In the pack

  9. Decision

    Is a SOC 2 examination under way or planned?

    If you hold no report, say so in the first sentence. If an examination is under way or planned, give the period and the expected report date as an expectation. If none is planned, say that and do not imply one.

    In the pack

    See also

  10. Outcome

    Send the answers, the certificate details and the SOC 2 dates

    Use the first reply as a start with the second reply's ISO wording. Say you do not yet hold a report, that you have engaged or are choosing a licensed CPA firm, and the type, categories, period and expected date as an expectation. Send the security overview, the standard commitments schedule and your answers meanwhile. Log the date as a commitment.

    In the pack

  11. Outcome

    Say we hold none, and answer on our own terms

    Say in the first sentence that you do not hold a SOC 2 report, and say what you do hold. Send the certificate details, the security overview and the standard commitments schedule, and complete the questionnaire. Do not promise a report or a date that no plan supports.

    In the pack

    See also

  12. Decision

    Do the report's terms and an NDA let us send it to this customer?

    A SOC 2 report is generally restricted in use, and the report states who may receive it. Share it only under a confidentiality agreement or the terms the report states, by the sharing tier your evidence index sets. If the terms are unclear, ask the CPA firm and do not guess.

    In the pack

  13. Outcome

    Offer the Public items and ask Legal for an agreement

    A recipient with no agreement in force is offered the Public items, and a summary whose own tier is Public. The request for an agreement goes to Legal. Send the report once an agreement covers the customer on the day you send it.

    In the pack

    See also

  14. Decision

    Did the report period end within about 12 months?

    Many customers look for a report whose period ended within the last 12 months. That is market practice, not a rule, and each customer decides what it accepts. Ask the customer if you do not know.

    In the pack

  15. Outcome

    Send the report and certificate details, with any bridge letter

    Send the report by a controlled route, named exactly by type, categories, system and period, and describe the ISO/IEC 27001 certificate separately. Add a bridge letter if the gap since the period ended is within what the customer accepts, and log the release. Remind the customer that the report lists the controls it assumes customers operate.

    In the pack

    See also

  16. Outcome

    Send the report as it is and say when the next is expected

    Do not stretch a bridge letter past its window. Send the report you hold with its period named exactly, say plainly when the next report is expected, and log that date as a commitment. The customer decides what it relies on.

    In the pack

    See also

Practical checklist

  1. Check the ISO/IEC 27001 certificate is in date and its scope covers the customer's service.
  2. Name each document by its exact title, scope, issuer and dates.
  3. Answer the customer's questions on their own terms and state the SOC 2 position separately.
  4. Check the report's terms and the confidentiality agreement before you send it.
  5. Have Legal read the wording before the first use.
  6. Ask the customer in writing what it will accept.

Evidence to have ready

  • The reply as sent, with the documents it named and their dates.
  • The evidence index entry for each document, with its sharing tier.
  • The confidentiality agreement reference and the release route.
  • The customer's written statement of what it will accept, if it gave one.

Assumptions

  • You hold an ISO/IEC 27001 certificate, or believe you do. The first decision checks that it is current and covers the customer's service.
  • You keep an evidence index that sets a sharing tier for each document you may show a customer.
  • What a customer accepts is the customer's decision. Nothing here says that either document answers the other.

Not covered here