SOC 2 and ISO 27001
The two security attestations enterprise buyers ask vendors for: an auditor’s SOC 2 report and an ISO/IEC 27001 certificate.
SOC 2 is an AICPA framework: an independent auditor reports on a company’s controls, either at one point in time (Type I) or over a period of months (Type II). ISO/IEC 27001 is an international standard for an information security management system; certification lasts three years with yearly surveillance audits. Both take months and real money, so small vendors usually answer the security questionnaire with evidence instead.
Related terms
- NIS2: The EU cybersecurity directive that requires medium and large organizations in 18 sectors to manage cyber risk and report incidents.
- Data processing agreement (DPA): The contract GDPR requires when a vendor processes personal data on your behalf: what, why, how it is protected, who else gets it.
- security.txt: A small file at /.well-known/security.txt that tells security researchers how to report a vulnerability to you.
