Advisory

SOC 2 & assurance readiness

A successful audit starts long before the auditor arrives. Normstone helps teams scope the work, establish ownership, implement controls, and build a reliable evidence trail.

The mandate

Build controls and evidence customers can trust.

We prepare service organizations for SOC 2 examinations and design security management systems aligned to ISO/IEC 27001.

Discuss this work

How we help

  • SOC 2 system scoping and readiness
  • Control design and operating evidence
  • ISO/IEC 27001 ISMS implementation
  • Integrated control frameworks
  • Independent examination and certification preparation

What the work produces

  • Defined scope and control ownership
  • Working policies, procedures, and records
  • An evidence plan aligned to independent assessment

Delivery

From the first decision to a working program.

Each stage creates an artifact or operating practice the team can use.

01 / 04

Choose the assurance outcome

Clarify which customers or procurement processes are driving the request, the service they need covered, and whether the objective is a SOC 2 report, ISO/IEC 27001 certification, or both.

Output: Assurance objective and scope decision
02 / 04

Build a common control base

Map overlapping risk, access, change, supplier, incident, and review processes once, then identify the distinct records required for each assessment.

Output: Control matrix, owners, and framework crosswalk
03 / 04

Run the evidence cycle

Put control frequencies and exception handling into normal operations. Sample records early so gaps can be corrected before an independent examiner or certification body begins work.

Output: Evidence calendar, sample results, and remediation log
04 / 04

Prepare the independent handoff

Check the system description or ISMS scope, evidence index, management responsibilities, and open exceptions. Coordinate questions while keeping independent assessment decisions with the qualified third party.

Output: Readiness pack and assessment handoff plan

Common questions

Clarify the mandate before delivery.

Can one project prepare for both SOC 2 and ISO/IEC 27001?

Often yes. Many operating controls and records can serve both goals, but SOC 2 reports on a defined service organization system and ISO/IEC 27001 assesses an information security management system. Scope and evidence must be checked separately.

Who issues a SOC 2 report or ISO/IEC 27001 certificate?

An independent licensed CPA firm performs a SOC 2 examination. An independent certification body makes ISO/IEC 27001 certification decisions. Normstone’s role is implementation and readiness advice.

When should evidence collection begin?

As soon as the controls operate. Collect records in the normal workflow, review samples against the intended assessment scope, and track exceptions while they can still be corrected.

Primary references

Related frameworks

Apply it where it matters.

ISO/IEC 27001SOC 2

Work with Normstone

Let’s build what stands up to scrutiny.

Tell us what you need to achieve. We’ll help define the right first step.

Start a conversation