SOC 2 on the same control set
SOC 2 is the report American buyers ask for before they sign. NorthIron maps the Trust Services Criteria to the same atomic control set as ISO 27001, so the evidence you already hold carries over and your CPA firm reviews it inside the platform instead of in a shared drive.
What this looks like today
A deal is waiting on the report
The buyer's security team wants a SOC 2 report, and until there is one the contract sits in procurement.
Type II means proving it over time
A Type I report looks at design on a single date. Type II tests that controls operated across an observation period, so evidence gathered in the final fortnight does not count.
It feels like starting again
Teams that already hold ISO 27001 are handed a fresh spreadsheet of criteria and asked to evidence the same controls a second time.
The Trust Services Criteria on shared controls
All five Trust Services Criteria
Security is required in every SOC 2 report. The other four are chosen by scope. NorthIron maps each one you select to the atomic controls behind it.
- Security
- Availability
- Processing integrity
- Confidentiality
- Privacy
One control set with ISO 27001
The criteria resolve to the same 144 atomic controls ISO 27001 uses. Evidence accepted for one framework counts for the other, so a second report is a delta, not a restart.
Built for Type I and Type II
Connected systems keep collecting evidence through the observation period, and each artefact carries a collection date and refresh cycle. Items that age past their cycle are flagged before the auditor finds them.
Your CPA firm works in the platform
Package the evidence for the examination and share it as a scoped, watermarked, view-only link. Findings and responses are recorded against the evidence they concern, so the audit trail writes itself.
SOC 2 is not a separate programme
It is a second view of the controls you already run. On one atomic control set, NorthIron shows you what the criteria need that ISO 27001 did not, and nothing else.
What you have at examination time
- Each selected Trust Services Criterion mapped to its controls
- Evidence collected continuously through the observation period
- Reuse of everything already accepted for ISO 27001
- A named practitioner approval on every accepted item
- Scoped, view-only access for your CPA firm
Questions we are asked about SOC 2
Who issues the SOC 2 report?
A licensed CPA firm, after its own examination. NorthIron prepares and presents the evidence; it does not issue the report.
Should we start with Type I or Type II?
It depends on what your buyer will accept. Many teams take a Type I first to unblock a deal, then move to Type II. The same controls and evidence serve both.
Do we have to include all five criteria?
No. Security is always in scope. Availability, processing integrity, confidentiality and privacy are added when your commitments to customers call for them.
See it against your own programme
The call opens the product, not a deck. A practitioner walks you through the Trust Services Criteria against the controls you already run.