Back to all articles
Compliance Feb 4, 2026 · 9 min read
SOC 2 + ISO 27001: how we got both certifications without doubling the work
Our CISO breaks down the unified control framework that let us achieve SOC 2 Type II and ISO 27001 in the same audit cycle, with one set of evidence.
Most companies treat SOC 2 and ISO 27001 as two separate projects. That’s a costly mistake. Here’s how we ran them as one.
The 80% overlap
Of the 114 ISO 27001 Annex A controls and the 100+ SOC 2 control activities, roughly 80% map cleanly to a single underlying control. The rest is mostly framing.
Our 4-step approach
- Build a unified control catalog mapped to both frameworks.
- Run a single internal audit cycle, generating one evidence package.
- Engage one auditor licensed for both (yes, they exist).
- Use Quays Audit Workspace to share the same evidence with both audit streams.
ET
Written by
Emma Thompson
CISO
