Building One Security Control Programme for SOC 2 and ISO 27001
A technology organisation replaced fragmented audit preparation with accountable control owners, reusable evidence and a recurring assurance process.
Client: Enterprise Software Organisation
The challenge
Two Assurance Frameworks, Multiple Evidence Requests and No Single Owner
The organisation needed to prepare for SOC 2 and ISO 27001 assurance activities while maintaining day-to-day engineering delivery. Many security controls supported both objectives, but evidence collection remained fragmented. Access reviews, vulnerability remediation, change approvals and supplier assessments were documented differently by different teams.
- Similar evidence was repeatedly collected for different assurance requests.
- Control ownership was unclear when evidence crossed engineering, IT, HR and security.
- Policy documents did not always demonstrate that controls were operating in practice.
- Audit preparation depended on last-minute collection rather than a repeatable process.
The solution
Build the Control Once. Maintain the Evidence Throughout the Year.
Security Brigade developed a common control and evidence structure mapped to SOC 2 Trust Services Criteria and relevant ISO/IEC 27001 requirements. Shared operational controls were documented together, while framework-specific requirements, audit boundaries and independent assurance responsibilities remained distinct.
Our approach
- 01Assess the existing control environment and identify gaps in ownership, implementation and evidence.
- 02Map overlapping requirements into a consolidated control register without treating the two frameworks as interchangeable.
- 03Establish evidence owners, collection schedules and review procedures for access, changes, vulnerabilities, incidents and suppliers.
- 04Conduct readiness testing, review deficiencies and prepare the relevant evidence for independent attestation and certification processes.
The results
Audit Readiness Became an Operating Process, Not a One-Off Project
The composite engagement illustrates how shared control implementation can reduce duplicated work while improving the quality of evidence. Control owners receive clear responsibilities, security teams can identify missing evidence earlier, and external auditors receive records that connect a control's stated purpose with its actual operation. Formal SOC 2 attestation and ISO 27001 certification remain decisions of the respective independent assurance bodies.
Ready to discuss your security needs?
Talk to our team about a similar engagement for your organisation.
Request a scoping call