What we do
Pick a service, find your industry, or start from what you are trying to get done.
Explore What we doBrowse What we do
View allProfit360™
Our way of turning your finance function into a source of profit.
Explore Profit360™Browse Profit360™
View allGlobal
A coordinated approach to cross-border finance, tax and assurance questions.
Explore GlobalBrowse Global
View allInsights
Tax changes, finance thinking and what they mean for your business.
Explore InsightsBrowse Insights
View allAbout
Who we are, who you will work with, and how we hold ourselves to account.
Explore AboutBrowse About
View allCareers
Build a career in US accounting, tax and advisory.
Explore CareersBrowse Careers
View allServices
Specialist work across compliance, assurance, finance and growth.
Explore ServicesBrowse Services
View allAudit & Attestation
ISO 27001 Readiness
AT&F helps with readiness and preparation for the certification audit of an ISO/IEC 27001 information security management system. An accredited certification body issues the certificate, not AT&F. Other ISO standards are covered on the ISO readiness page.
The value
What does ISO 27001 readiness cover?
Separate the work a company must own—the information security management system, risk decisions, controls, and evidence—from the certificate.
Typical scope
What is included in ISO 27001 readiness?
The final engagement is tailored to your facts. These are the core workstreams we use to define a useful, responsible scope.
01
Why certification is being requested, and by whom
02
ISMS scope discussion
03
Risk assessment and control-ownership readiness
04
Evidence and policy gaps
05
Points of alignment and difference with SOC 2
06
Coordination notes for a later certification audit
How the engagement moves
How does ISO 27001 readiness move toward certification?
- 1→
Confirm the request
We start with who asked for ISO 27001 and what decision they are making. A customer clause and a SOC 2 request are different asks, even when the underlying controls overlap.
- 2→
Describe the ISMS scope
The products, locations, teams, and information in view need an owner. Scope is a management decision. It is not assumed from a template or from a SOC 2 boundary.
- 3→
Map risks, controls, and evidence
A readiness discussion looks at the risk assessment, selected controls, policies, and the records that show the management system is operating. Missing pieces are listed with owners.
- 4
Prepare for the certification audit
AT&F helps with readiness. An accredited certification body issues the ISO/IEC 27001 certificate, not AT&F.
Compare
How do ISO 27001 and SOC 2 readiness steps differ?
These are the readiness steps already described on this site. Controls can overlap. One does not replace the other unless the person who asked for it says so.
| Step | ISO 27001 readiness | SOC 2 readiness |
|---|---|---|
| 1. Start with the request | Who asked for ISO 27001, and what decision a certificate is meant to support. A customer clause and a SOC 2 request are different asks, even when the controls overlap. | Who will use the SOC 2 report, and what decision they are making. |
| 2. Describe the boundary | Scope is a management decision: the products, locations, teams, and information in view. It is not copied from a SOC 2 boundary. | Management’s description of the service, the systems that deliver it, and the control owners. |
| 3. Map the system | The risk assessment, selected controls, policies, and the records that show the management system is operating. Missing pieces are listed with owners. | The Trust Services Criteria selected for that audience, the control owners, and the records those controls produce. Security is always in scope; other categories are added only when relevant. |
| 4. Who issues the result | An accredited certification body issues the certificate, not AT&F. AT&F helps with readiness and preparation for the certification audit. | AT&F signs its own SOC report when an examination is accepted and completed. Readiness does not itself produce the report. |
What to have ready
What should you have ready for ISO 27001?
What you can expect
What do you receive from ISO 27001 readiness?
Common questions
Common questions about ISO 27001 readiness
The quickest way to get a firm answer is to share the facts that make your situation different.
Does AT&F certify companies to ISO 27001?+
No. An accredited certification body issues the certificate, not AT&F. AT&F is a US CPA firm and helps with readiness and preparation for the certification audit. This page is not a certificate or a statement that AT&F is a certification body.
Is ISO 27001 the same as SOC 2?+
No. SOC 2 is an AICPA attestation framework built around a system description, selected Trust Services Criteria, and a CPA firm’s report. ISO/IEC 27001 is an international standard for an information security management system, and certification follows a different audit. Controls can overlap. One report does not substitute for the other unless the person who asked for it says so.
Do we need both SOC 2 and ISO 27001?+
Only if the people relying on the assurance ask for both, or if the business decides the management system and the SOC 2 report serve different users. List who asked, and what decision each request supports, before scoping either piece of work.
What should be in place before a certification audit?+
Typically an agreed ISMS scope, a risk assessment, selected controls, evidence that the management system operates, and the internal review activity a certification body expects to see. The exact expectations depend on the body and the scope. This page does not set those requirements.
Can readiness start if the policies are incomplete?+
Yes. An early conversation can identify missing scope, ownership, and evidence. Management remains responsible for the ISMS and for deciding what to implement. Readiness does not itself create a certifiable system.
What if we were asked for a different ISO standard?+
ISO/IEC 27001 is one management-system standard. Readiness for other ISO certifications, including quality, privacy, business continuity, artificial intelligence, environmental, and occupational health and safety management systems, is described on the ISO readiness page.
Related assurance
How does ISO 27001 readiness relate to SOC 2?
SOC 1, SOC 2, a startup buyer request, and ISO certification readiness are related. They are not the same engagement.
ISO readiness
Quality, privacy, continuity, AI, environmental, and occupational health and safety standards, and the rule that applies to all of them.
Read the pageSOC 2 audit
The AICPA report many customers ask for alongside, or instead of, ISO 27001.
Read the pageSOC 2 for startups
A practical route when the immediate pressure is an enterprise security review.
Read the pageUseful reading
What should you read before an ISO 27001 decision?
Practical perspectives that may help frame the next question. They are general information, not advice based on your particular records, facts or current rules.
Audit & assurance
SOC 2 readiness: build an evidence plan before you need it
A practical, non-technical way to organise ownership, controls and evidence before a SOC 2 examination begins.
Read articleAudit & assurance
SOC 2 evidence walkthroughs: help control owners show the work, not recreate it
A practical way to prepare control owners for evidence walkthroughs by connecting each activity to its trigger, record, reviewer and exceptions.
Read articleAudit & assurance
Customer due diligence: prepare the controls and evidence behind the security questionnaire
A practical operating framework for SaaS and technology teams responding to customer security, risk and assurance questions without turning every questionnaire into a one-off project.
Read articleStart with a conversation
What is the next step toward ISO 27001?
An accredited certification body issues the ISO/IEC 27001 certificate, not AT&F. AT&F helps with readiness and preparation for the certification audit: scope, ownership, controls, and evidence. Any engagement is confirmed separately and does not imply a certification outcome. Other ISO standards are described on the ISO readiness page.