Markets

Trust travels across borders.

ISO/IEC 42001, SOC 2, and ISO/IEC 27001 serve different buyer and governance needs across Europe, Australia, and Singapore. In Europe, NIS2 adds national cyber duties for covered entities.

Global standards. Specific decisions.

We focus on practical assurance questions for technology and service organizations serving regional and international customers. These guides distinguish customer requests, independent assessment, and local obligations.

EuropeA practical route to SOC 2 customer assurance and ISO/IEC 42001 AI governance for European technology teams, with ISO/IEC 27001 as a security foundation.AustraliaHow Australian SaaS and service organizations can approach SOC 2, ISO/IEC 42001, and ISO/IEC 27001 alongside local security and privacy expectations.SingaporeA practical assurance and AI governance path for Singapore-based technology and service organizations serving regional and international customers.

European country guidance

Local context changes the implementation.

Each guide addresses a distinct national authority, buyer requirement, or assurance question.

GermanyAI management system and service assurance implementation for German technology providers, with BSI cloud criteria and ISO/IEC 27001 context. Includes national NIS2 status and implementation context.FranceAI governance, service assurance, privacy, and cloud security implementation considerations for French technology providers. Includes national NIS2 status and implementation context.United KingdomA UK implementation route for AI governance, customer-requested SOC 2 assurance, and security management with public UK AI guidance.NetherlandsAI governance and service assurance implementation for Dutch technology providers, with BIO2 and Cyberbeveiligingswet context where relevant.SpainAI management, service assurance, and security management for Spanish technology providers, with ENS and AEPD context where applicable. Includes national NIS2 status and implementation context.ItalyAI management and customer assurance implementation for Italian technology providers, with AgID public-sector AI context where relevant. Includes national NIS2 status and implementation context.PolandAI management, service assurance, and information security implementation for Polish organizations assessing KSC/NIS2 duties.BelgiumBelgian AI governance and service assurance implementation alongside CCB CyberFundamentals and NIS2 context.

Where the paths meet

Start with the outcome you need.

ISO/IEC 42001 governs AI management. SOC 2 reports on controls for a defined service. ISO/IEC 27001 provides information security management. NIS2 adds national cyber duties for covered EU entities. Shared controls can support these paths, while each scope and obligation stays explicit.

Explore the four priorities
ISO/IEC 42001AI governanceSOC 2Service organization assuranceISO/IEC 27001Information securityNIS2EU cybersecurity

Work with Normstone

Let’s build what stands up to scrutiny.

Tell us what you need to achieve. We’ll help define the right first step.

Start a conversation