Corpfy
SOC 2

Certify trust. Scale globally.

Enterprise certification roadmap and information security management for global scale.

Executive Summary

Global enterprise customers and Series A+ venture investors now mandate SOC 2 Type II and ISO 27001 certifications as proof of security maturity. These independent audits verify that your organization has implemented, documented, and tested controls over data security, availability, processing integrity, confidentiality, and privacy. Without certification, 80%+ of enterprise RFPs are automatically rejected. With certification, deal closure accelerates by 4-6 months and valuations increase 20-30%.

Expected Outcome: SOC 2 Type II certification unlocks ₹5Cr-50Cr in enterprise contracts that were previously blocked. ROI from certification (first deal) typically covers 100% of certification cost.

Certification Standards Comparison

Understanding the differences, overlaps, and strategic sequencing

Standard Audits What? Timeline Cost Valid For Best For
SOC 2 Type I Control design (how security SHOULD work on paper) 5-7 months readiness + 2-3 week audit ₹40-70K total (audit only) One-time (not renewable) Seed stage, early customer trust, proof of concept
SOC 2 Type II Control effectiveness (how security ACTUALLY works for 6-12 months) 6 months observation + 3-4 week audit (12-15 months total) ₹60-100K (requires observation period investment) 12 months (annual re-audit required) Series A+, enterprise customers, serious fundraising
ISO 27001 Complete Information Security Management System (ISMS) 9-12 months build + 2-4 week audit ₹70-120K (includes implementation) 3 years (annual surveillance audits required) International expansion, government contracts, regulated industries
Integrated (Type II + ISO 27001) Both standards using same controls (80% overlap) 12-16 months (single audit covers both) ₹120-180K (saves 20-30% vs separate) Type II: 12 months, ISO: 3 years Scaling startups targeting global enterprise + government deals

Trust Services Criteria (TSC) - The 5 Pillars of SOC 2

What auditors actually test when they audit your company

Principle What It Means Key Controls Required Why Enterprise Customers Care
Security (CC) Systems protected against unauthorized access, disruption, modification, destruction Encryption (AES-256 at rest, TLS 1.3 in transit), MFA, network isolation, vulnerability testing, incident response plan Prevents data theft. Single breach = ₹50L-5Cr liability + customer data theft. This is the #1 concern.
Availability (A) Systems operate reliably and data is accessible when needed (uptime, disaster recovery) Redundancy, automated backups, quarterly DR testing with documented RTO/RPO, load balancing, monitoring Prevents revenue loss. ₹1Cr customer deal with 99.9% SLA = ₹100K penalty per hour of downtime. Can't afford failures.
Processing Integrity (PI) Data is complete, accurate, and authorized throughout processing lifecycle Input validation, transaction logging, change management (approval + testing), audit trails, data reconciliation Prevents fraud and data corruption. Financial data corruption = regulatory penalties. Critical for fintech/healthcare.
Confidentiality (C) Sensitive information restricted to intended users only (no unauthorized access or disclosure) Access control (RBAC with quarterly review), encryption, DLP (Data Loss Prevention), employee NDAs, vendor contracts Protects trade secrets and customer data. Unauthorized disclosure = ₹50L-500L+ regulatory fines (GDPR), customer lawsuits, reputation damage.
Privacy (P) Personal data handled per policy and law (DPDP, GDPR). Users have rights (access, delete, export). Privacy policy, consent mechanism, data subject access process (30-day response SLA), breach notification (30-day), data retention policy Legal requirement in India (DPDP) and EU (GDPR). Non-compliance = government fines. Customer trust critical for B2B SaaS.

Ready to book the external audit?

Once your controls are implemented and evidence is collected, head to SOC 2 Audit for the realistic timeline, auditor selection guide, exception prevention, and gap-analysis tooling that reads live from this control register.

ISO 27001 Certification Path: Month-by-Month Realistic View

Building a certified Information Security Management System (ISMS) from zero

Timeline What You're Doing Effort Required Cost Common Mistake
Months 0-2: Scope & Gap Analysis Define ISMS scope (which systems, processes, locations). Perform gap analysis vs ISO 27001:2022 Annex A. Assign CISO or responsible owner. Executive sign-off on Statement of Applicability (SoA) draft. CTO + Security lead: 30–50 hours. Optional consultant: 20–30 hours. ₹5–15K (consultant gap analysis) Scoping too broadly (entire company vs core product). Larger scope = longer audit, higher cost.
Months 2-5: ISMS Build & Policy Writing Draft all mandatory policies: Information Security Policy, Risk Assessment & Treatment, Acceptable Use, Asset Management, Access Control, Incident Response, Business Continuity, Supplier Security. Complete formal Risk Assessment (identify assets → threats → vulnerabilities → risk score → treatment plan). 0.5 FTE security engineer full-time. 60–80 policy documents required. ₹20–40K (tooling, templates, consultant review) Copy-pasting generic policy templates without customising to your environment. Auditor will ask "show me this in practice" and it won't match.
Months 5-7: Annex A Controls Implementation Implement 93 Annex A controls (ISO 27001:2022). Key technical controls: encryption, MFA, vulnerability management, logging, network segregation. Key organisational controls: background checks, NDA, supplier contracts, security training, change management, VAPT. 0.5–1 FTE engineering + operations. Parallel workstreams recommended. ₹15–35K (VAPT, background checks, tooling) Treating Annex A as a checklist instead of a risk-driven exercise. Auditor asks "why is this control relevant?" You need documented justification in Statement of Applicability.
Months 7-8: Internal Audit & Management Review Conduct internal audit of ISMS (all policies + controls tested). Present findings to top management (Management Review meeting — mandatory for ISO). Document corrective actions. Complete final Statement of Applicability (SoA). Internal auditor or consultant: 40–60 hours. Management: 4–8 hours. ₹15–30K (internal auditor or consultant) Skipping Management Review. ISO specifically requires evidence that top management reviewed ISMS performance. Missing = automatic nonconformity.
Months 8-9: Stage 1 Audit (Documentation Review) External certification body reviews all ISMS documentation. Confirms scope and SoA are complete. Issues list of gaps to address before Stage 2. Stage 1 is a desk audit — auditor does NOT visit site yet. Internal team: 20–30 hours preparing documentation package for auditor. ₹15–25K (Stage 1 audit fees) Submitting incomplete documentation. If SoA is missing justifications or Risk Treatment Plan is vague, Stage 1 will fail and delay Stage 2 by 1–3 months.
Months 9-11: Remediate Stage 1 Findings & Prepare for Stage 2 Fix all gaps identified in Stage 1. Ensure controls have been operating for minimum 3 months (evidence required). Conduct final pre-Stage 2 mock audit. Prepare evidence packs for all Annex A controls. Internal team: 30–50 hours. Consultant review recommended. ₹10–20K (consultant, tools) Not having 3+ months of evidence that controls actually worked. Auditor will request logs, reports, meeting minutes from previous 3 months. No evidence = nonconformity.
Months 11-12: Stage 2 Audit (Certification Audit) On-site (or remote) deep audit. Auditor interviews key staff. Tests controls in practice. Reviews access logs, backup records, incident logs, training records, supplier contracts. Issues audit report with conformities and nonconformities. Internal team: 40–60 hours actively supporting auditor over 3–5 days. ₹30–60K (Stage 2 audit fees) Staff not prepared for interviews. Auditor will ask engineers "how do you request access to production?" If answer contradicts the policy document, it's a nonconformity.
Months 12-13: Resolve Nonconformities & Get Certificate Certification body issues findings: Major nonconformities (must fix before certificate), Minor nonconformities (fix within 90 days). Submit corrective action evidence. Receive ISO 27001 certificate (3-year validity). Internal team: 20–40 hours addressing findings. ₹0 (included in audit fee) Major nonconformity on a core control (e.g., no formal risk assessment). Delays certificate by 1–3 months. Cannot use certificate for enterprise deals until issued.
Year 1–3: Surveillance Audits Annual surveillance audits (Year 1 and Year 2). Lighter than initial certification audit. Auditor checks ISMS is still operating, nonconformities remediated, continual improvement demonstrated. Full recertification audit in Year 3. Ongoing: 10–15 hours/month ISMS maintenance + 20–30 hours per annual surveillance audit prep. ₹15–30K/year (surveillance audit fees) + ₹30–60K in Year 3 (recertification) Treating ISO as "done" after getting certificate. Surveillance auditor will ask "show me your continual improvement log." No improvements logged = certificate at risk of suspension.

ISO 27001:2022 Annex A — The 93 Controls Across 4 Themes

What the auditor actually tests during Stage 2 certification audit

Control Theme Controls (#) Key Requirements Typical Evidence Auditor Requests Startup Effort
Organisational Controls (Clause 5) 37 controls Information security policies, roles & responsibilities, threat intelligence, supplier relationships, incident management, business continuity, legal & compliance obligations Signed policies, org chart with security roles, supplier security agreements, incident register, BCP test results, legal register HIGH — 60+ policy documents. Requires legal review for some. Most time-consuming theme for startups.
People Controls (Clause 6) 8 controls Background verification before hire, employment terms including InfoSec responsibilities, security awareness training, disciplinary process for InfoSec violations, offboarding access revocation Background check records for all employees/contractors, signed employment contracts with InfoSec clauses, training completion logs (100% attendance required), offboarding checklists MEDIUM — Background checks and training programmes are the main effort. HR process changes required.
Physical Controls (Clause 7) 14 controls Physical perimeter security, access control to offices and server rooms, clear desk/clear screen policy, equipment security (laptops, servers), secure disposal of media Office access logs, CCTV records, equipment inventory, secure disposal certificates, clean desk audit photos LOW-MEDIUM for cloud-native startups. Most physical controls apply to office environment. If AWS/GCP hosted, physical controls inherited from cloud provider (document this in SoA).
Technological Controls (Clause 8) 34 controls Endpoint security, privileged access management, encryption (data at rest + in transit), web filtering, secure coding practices, VAPT, network monitoring, backup and recovery, vulnerability management, logging and monitoring, change management, secure development lifecycle MFA configuration screenshots, encryption certificates, VAPT report + remediation evidence, access review records (quarterly), backup restore test logs, SIEM/monitoring dashboards, code review records, penetration test reports HIGH — Requires engineering effort across cloud, application, and endpoint layers. Most controls should already exist if SOC 2 implemented (80% overlap).

Critical Success Factors for ISO 27001 Certification

  • Risk-Driven Approach: ISO 27001 is fundamentally a risk management standard, not a checklist. Every control must be justified by a documented risk. Auditors reject copy-paste policies with no link to your actual risk assessment.
  • Statement of Applicability (SoA) is the Centrepiece: This document lists all 93 controls, states whether each is applicable or excluded, and provides justification for each decision. An incomplete or vague SoA is the #1 cause of Stage 1 audit failures.
  • Management Review is Mandatory Evidence: ISO explicitly requires top management to review ISMS performance at planned intervals. Missing management review minutes = automatic major nonconformity. Schedule quarterly 1-hour management review meetings and minute them properly.
  • Continual Improvement Must Be Demonstrated: Unlike SOC 2 (pass/fail on controls), ISO requires evidence of improvement over time. Maintain a Corrective Action Register and ISMS improvement log from Day 1, even before the audit.
  • Choose an Accredited Certification Body: Only certification bodies accredited by UKAS (UK), DAkkS (Germany), NABCB (India), or equivalent national bodies issue internationally recognised ISO 27001 certificates. Unaccredited "certificates" are worthless for enterprise deals and government contracts.
  • Staff Must Know the Policies: Stage 2 auditors interview engineers, developers, and HR staff directly. If your access control policy says "all access requests go through a ticketing system" but developers say "we just ping the CTO on Slack," that's a major nonconformity. Policies must match reality.

SOC 2 vs ISO 27001: Control Overlap Map

How to build once and satisfy both standards simultaneously

Control Area SOC 2 Requirement ISO 27001 Requirement Shared Evidence Overlap?
Encryption at Rest CC6.1 — Logical access uses encryption to protect data at rest A.8.24 — Use of cryptography policy; A.8.5 — Secure authentication Encryption configuration screenshots (GCP KMS / AES-256), key management policy ✓ Full overlap
Encryption in Transit CC6.7 — Transmission of data uses encryption (TLS 1.2+) A.8.24 — Cryptography; A.8.20 — Networks security TLS certificate records, network policy documentation ✓ Full overlap
Multi-Factor Authentication CC6.1 — Authentication controls for system access A.8.5 — Secure authentication; A.5.17 — Authentication information MFA configuration screenshots for all admin systems ✓ Full overlap
Access Control & Review CC6.2 — Access to systems requires authorisation; quarterly access review A.8.2 — Privileged access rights; A.5.18 — Access rights review Access review records (quarterly), RBAC configuration, joiner/leaver/mover process ✓ Full overlap
Vulnerability Management / VAPT CC7.1 — Vulnerabilities are identified and monitored A.8.8 — Management of technical vulnerabilities; A.8.29 — Security testing in dev VAPT report, remediation tracking, penetration test schedule ✓ Full overlap
Incident Response CC7.3 — Security incidents are identified and responded to A.5.24, A.5.25, A.5.26 — Incident management lifecycle Incident Response Plan, incident register, post-incident review records ✓ Full overlap
Backup & Disaster Recovery A1.2 — Backup data is complete and available; quarterly DR test A.8.13 — Information backup; A.5.30 — ICT readiness for business continuity Backup configuration, quarterly restore test logs with documented RTO/RPO ✓ Full overlap
Change Management CC8.1 — Changes to infrastructure follow a defined process A.8.32 — Change management Change request tickets, approval records, test evidence before deployment ✓ Full overlap
Security Awareness Training CC1.4 — Personnel are trained on security responsibilities A.6.3 — Information security awareness, education and training Training completion records (100% attendance), annual training schedule ✓ Full overlap
Supplier / Vendor Management CC9.2 — Third-party vendors are monitored for risk A.5.19, A.5.20, A.5.21 — Supplier relationships and supply chain security Vendor risk assessments, supplier security contracts/DPAs, critical vendor list ✓ Full overlap
Risk Assessment CC3.2 — Risk assessment process identifies and evaluates risks Clause 6.1 — Risk assessment (mandatory for ISO, not just Annex A) Risk register with asset inventory, threat/vulnerability mapping, risk scores, treatment decisions Partial (ISO requires formal methodology)
Statement of Applicability Not required for SOC 2 Clause 6.1.3 — Mandatory SoA documenting all 93 Annex A controls ISO-specific document only ✗ ISO only
Management Review Not required for SOC 2 Clause 9.3 — Mandatory top management ISMS review at planned intervals ISO-specific evidence only ✗ ISO only
Internal Audit Not required for SOC 2 (external auditor does this) Clause 9.2 — Mandatory internal audit of ISMS at planned intervals ISO-specific evidence only ✗ ISO only

Critical Success Factors for Getting "Unqualified Opinion" (Clean Report)

  • Executive Commitment: CTO/CEO must champion. No shortcuts. 50% of startups fail because leadership doesn't prioritize.
  • Start 15 Months Early: Not 3 months. Controls require 6+ months observation period. Auditor will not skip this.
  • Document Everything: "We do it" is not acceptable. Auditor needs written policy + evidence of execution. No exceptions.
  • Test Before Audit: Run mock audit 2 months before formal audit. Find issues yourself, not through auditor feedback.
  • Right Auditor: Big 4 (Deloitte, EY, KPMG, PwC) or reputable mid-tier (CliftonLarsonAllen, Grant Thornton). Cheap auditors = reports enterprises won't accept.
  • No Control Lapses: One violation during observation period (e.g., unencrypted backup, missing access logs) = exception on final report. Exceptions = deal killer.

Frequently Asked Questions

How long does it REALLY take to get SOC 2 Type II certified? +

The Truth: 13-15 months from "zero" to holding the certificate in your hand. NOT 3-6 months as commonly misquoted.

Why So Long? SOC 2 Type II requires an "observation period"—the auditor must observe your controls actually working in production for 6-12 months. You can't fake this. Even if your controls are perfect day 1, you must wait 6 months before the audit can even start.

Realistic Timeline:

  • Months 0-2: Planning + auditor selection (2 months)
  • Months 2-5: Build controls + policies (3 months)
  • Months 5-6: Pre-audit readiness (1 month)
  • Months 6-12: Observation period—controls must work (6 months minimum)
  • Months 12-13: Formal audit (1 month)
  • Months 13-14: Report + any remediation (1 month)

Key Insight: If you're planning Series A in Month 14, start SOC 2 in Month 1. If you start in Month 6 (thinking "we'll get it before Series A"), you'll be scrambling. Enterprise customers won't wait for your audit to finish.

What's the actual cost of SOC 2 Type II from start to finish? +

Real Cost Breakdown (for 50-100 person startup):

  • Internal Team Time: 0.5 FTE security engineer × 12 months = ₹25-40L
  • Auditor Fees: ₹30-50K for SOC 2 Type II
  • Tools & Infrastructure: Cloud KMS, logging, monitoring = ₹3-8K/month = ₹36-96K annually
  • VAPT (Vulnerability Assessment + Penetration Test): ₹3-8L (one-time)
  • Legal Review of Policies: ₹2-5K
  • Background Check Services: ₹1-3K per employee
  • Compliance Consultant (optional but helps): ₹30-50K

Total: ₹65-110L over 12-15 months

BUT—Don't Just Look at Cost: One enterprise deal typically worth ₹5Cr-50Cr annually. Without SOC 2, deal blocked. Cost payback = first deal's profit margin covers entire certification cost (usually within 30 days of closing deal). ROI from certification: 10,000%+ in year 1 from accelerated enterprise contracts.

Cost Optimization: Integrated SOC 2 Type II + ISO 27001 audit saves 20-30% (do both controls once, audit twice). Cost = ₹100-140L instead of ₹130-160L. Compliance platforms (Corpfy SOC 2 Readiness, Drata) save ₹3-5K/month in manual evidence collection (ROI positive in month 2-3).

What's the difference between SOC 2 Type I and Type II? Which should we target? +

SOC 2 Type I: Auditor reviews your security designs and says "This looks good on paper." Equivalent to reviewing blueprints of a building. No actual proof it works. Takes 5-7 months, costs ₹30-40K, valid forever.

SOC 2 Type II: Auditor actually tests your controls over 6-12 months and says "These controls are PROVEN to work in practice." Equivalent to living in the building for a year to verify it's actually secure. Takes 12-15 months, costs ₹50-80K, must be renewed annually.

Enterprise Customer Reality: Before 2020, Type I was acceptable. Now (2024+), 90%+ of enterprise customers require Type II. Your RFP response: "We have Type I" = automatic rejection. "We have Type II" = passes security gate, moves to next stage.

Recommendation by Startup Stage:

  • Seed Stage (Pre-Series A): Skip Type I. It's dated and enterprise won't accept it. Go straight to Type II if you have 12+ months. If under 12 months, focus on building controls, not auditing.
  • Series A (Closing Month 14): Start SOC 2 planning in Month 1. Target Type II certificate by Month 14-15. If missing deadline, at least have documented controls ready for customer due diligence.
  • Series B+: Type II is table stakes. Multiple customers already require it. Budget annual re-audit (₹50-70K) into operations.
Can we do SOC 2 and ISO 27001 together? Is it worth the extra effort? +

Yes, absolutely. And you SHOULD if targeting international markets or government deals.

Why Together Makes Sense: 80% of controls overlap. Build once, audit twice. ISO 27001 is 90 controls addressing InfoSec comprehensively. SOC 2 is 5 Trust Principles. Same encryption, same access control, same incident response—just documented differently for each framework.

Cost Comparison:

  • Separate Audits: SOC 2 Type II audit ₹50-60K + ISO 27001 audit ₹40-60K = ₹90-120K
  • Integrated Audit: Single combined audit ₹70-100K (saves ₹20-50K or 25-40%)

Implementation Cost (Same for Both): ₹65-110L (no additional cost for adding ISO 27001 to SOC 2)

Timeline (Integrated): 12-16 months (vs 15-18 months doing separately)

Who Requires What:

  • Enterprise US/UK customers: SOC 2 Type II only
  • EU enterprises (GDPR): SOC 2 Type II + ISO 27001 increasingly preferred
  • Government contracts (India/EU): ISO 27001 often mandatory
  • Financial/Healthcare: Both preferred (more comprehensive control set)

Recommendation: If Series A customers are mostly US-based, do SOC 2 Type II only (faster, cheaper, sufficient). If targeting international or government deals, do integrated audit (better long-term coverage).

What is ISO 27001 and how is it different from SOC 2? +

ISO 27001 is an internationally recognised standard for building and certifying an Information Security Management System (ISMS). Unlike SOC 2, which audits whether specific security controls are operating effectively, ISO 27001 audits whether your entire security management system is systematic, documented, risk-driven, and continuously improving.

Key Differences:

  • Issuing Body: SOC 2 is issued by a CPA firm under AICPA standards. ISO 27001 is issued by a certification body accredited by a national accreditation authority (e.g., NABCB in India, UKAS in UK).
  • Validity: SOC 2 Type II is valid for 12 months. ISO 27001 certificate is valid for 3 years with annual surveillance audits.
  • Geographic Recognition: SOC 2 is primarily recognised by US and UK enterprises. ISO 27001 is globally recognised — EU, Middle East, APAC, government contracts.
  • What's Audited: SOC 2 audits 5 Trust Service Principles (Security, Availability, etc.). ISO 27001 audits 93 controls across 4 themes (Organisational, People, Physical, Technological) PLUS your risk management process, management oversight, and continual improvement.
  • Risk Management: SOC 2 does not mandate a formal risk methodology. ISO 27001 requires a documented risk assessment and treatment plan as a core mandatory clause — not just an Annex A control.

When to Choose ISO 27001 Over SOC 2: If your target customers are in Europe, the Middle East, or APAC. If you are targeting Indian government contracts (ISO 27001 is often specified in government RFPs). If your customers are in regulated industries (banking, insurance, pharma) that prefer ISO certification. If you want a 3-year certificate instead of annual renewal.

Bottom Line: SOC 2 is the US enterprise standard. ISO 27001 is the global enterprise standard. If you are building a company with international ambitions, ISO 27001 is the more durable investment.

What is the Statement of Applicability (SoA) and why does it matter so much? +

The SoA is the single most important document for ISO 27001 certification. It is a mandatory document that lists all 93 Annex A controls, states whether each control is applicable or excluded, and provides a documented justification for each decision.

Why It Matters: The Stage 1 auditor's primary job is to review your SoA. If it is incomplete, vague, or missing justifications, Stage 1 will fail. The SoA is also how you prove to the Stage 2 auditor that your control selection was risk-driven (not arbitrary).

Common SoA Mistakes:

  • Excluding controls without justification: You can exclude a control (e.g., "Physical access control to server rooms" if you're 100% cloud-hosted), but you must justify why it's not applicable. "We don't have servers" is acceptable if documented. No justification = automatic nonconformity.
  • Including controls you haven't implemented: If you list a control as applicable but have no evidence it's operating, the Stage 2 auditor will find it and raise a nonconformity.
  • Not linking controls to risk: Best practice is to link each applicable control to the specific risk in your Risk Register that it mitigates. Auditors love this. It demonstrates maturity.
  • Treating SoA as a one-time document: SoA must be updated when your scope changes, new risks emerge, or controls are added/removed. Outdated SoA = finding.

Practical Tip: Build your SoA as a spreadsheet with columns: Control ID, Control Name, Applicable (Yes/No), Justification, Implementation Status, Evidence Location, Risk Reference. This structure impresses auditors and makes evidence gathering during Stage 2 dramatically faster.

How does the ISO 27001 audit process work — Stage 1 vs Stage 2? +

ISO 27001 certification requires TWO audit stages conducted by the same certification body.

Stage 1 — Documentation Review (Desk Audit):

  • Typically 1–2 days, conducted remotely or on-site.
  • Auditor reviews: ISMS scope document, Statement of Applicability, Information Security Policy, Risk Assessment and Risk Treatment Plan, Mandatory procedures (internal audit, management review, corrective action, document control).
  • Auditor is NOT testing whether controls work — only whether your ISMS design is complete and coherent.
  • Outcome: Stage 1 report listing areas that need attention before Stage 2. Some findings are "observations" (low-risk); others are "significant concerns" (must fix before proceeding).
  • Timeline gap between Stage 1 and Stage 2: Typically 4–8 weeks (time to address Stage 1 findings).

Stage 2 — Certification Audit (On-Site):

  • Typically 2–5 days on-site (longer for larger scope).
  • Auditor interviews staff across departments: ask engineers how they request access, ask HR how background checks work, ask managers how incidents are reported.
  • Auditor samples evidence for each applicable Annex A control: access logs, training records, backup restore tests, change tickets, incident register, supplier contracts.
  • Auditor may test controls directly: "Show me how you would revoke access for a terminated employee right now."
  • Outcome: Audit report listing Conformities, Observations, Minor Nonconformities (fix within 90 days), Major Nonconformities (fix before certificate issued).

After Stage 2: If no Major nonconformities (or all addressed), certification body issues ISO 27001:2022 certificate within 4–8 weeks. Certificate is valid 3 years from date of issue, subject to annual surveillance audits.

Cost Breakdown (India):

  • Stage 1 Audit: ₹15–25K
  • Stage 2 Audit: ₹35–60K
  • Annual Surveillance Audit (Year 1 & 2): ₹15–25K each
  • Recertification Audit (Year 3): ₹25–45K
  • Total 3-year cost of certification maintenance: ₹90–155K
Which certification body should we choose for ISO 27001? +

Critical Rule: Only use an accredited certification body. An ISO 27001 certificate from a non-accredited body is not recognised by serious enterprise customers or government procurement. Always verify accreditation before signing.

Recognised Accreditation Bodies by Region:

  • India: NABCB (National Accreditation Board for Certification Bodies) — check nabcb.qci.org.in
  • UK/EU: UKAS (United Kingdom Accreditation Service), DAkkS (Germany), COFRAC (France)
  • International: IAF (International Accreditation Forum) — mutual recognition across 60+ countries

How to Verify: Ask your chosen certification body for their accreditation certificate number. Cross-check on the accreditation body's public directory. Takes 5 minutes and protects you from fraudulent certifications.

Reputable Certification Bodies Operating in India:

  • BSI Group (British Standards Institution): Original publisher of ISO 27001. Premium pricing (₹60–100K for initial audit) but universally accepted. Best for UK/EU expansion.
  • Bureau Veritas: Global, NABCB-accredited. Mid-range pricing (₹40–70K). Strong presence in manufacturing and regulated industries.
  • TÜV SÜD / TÜV Rheinland: German accreditation, widely respected. Good for European market credibility.
  • SGS: Largest inspection/certification company globally. Competitive pricing, NABCB-accredited.
  • KPMG / Deloitte (ISO + SOC 2 integrated): Can offer combined SOC 2 + ISO 27001 audit in a single engagement. Best option if doing both simultaneously.

Recommendation for Indian SaaS Startup: BSI or Bureau Veritas if budget permits and international markets are target. SGS or TÜV for cost-optimised path with credible accreditation. Avoid unknown local firms with very cheap rates (₹10–20K total) — their certificates may not be accepted by enterprise procurement.

Do we need BOTH DPDP compliance AND SOC 2? Are they the same thing? +

No, they are different. But if you operate in India and handle Indian customer data, you need BOTH.

DPDP (Digital Personal Data Protection) Act: India's legal data protection law. Applies if you collect email/phone/Aadhaar/PAN from Indian residents. Mandatory. No formal audit. Just legal compliance. Cost: Internal documentation + data residency setup (GCP India region). Timeline: 3-6 months.

SOC 2: Global security certification. Proves you have encryption, access control, incident response. Optional but required by enterprise customers. Independent audit. Cost: ₹60-100K. Timeline: 12-15 months.

Overlap: SOC 2 "Privacy" principle (P) partially covers DPDP (consent, breach notification). But DPDP is India-specific, legally mandatory. SOC 2 is voluntary but enterprise-required.

What You Need (If Operating in India):

  • DPDP Compliance: Mandatory (legal requirement)
  • SOC 2 Type II: Required by enterprise customers (90%+ mandate)
  • Together = Complete Compliance: DPDP addresses legal requirements. SOC 2 addresses customer confidence. Both needed.

Checklist to Meet BOTH DPDP + SOC 2 Privacy:

  • Privacy Policy published (covers: what data collected, how used, user rights)
  • Data stored in India (GCP Mumbai region for Indian residents)
  • Consent mechanism (checkbox "I agree", documented)
  • Data Subject Rights process (user can request delete/download/transfer)
  • Breach notification process (notify user within 30 days of breach)
  • Encryption at rest (AES-256) for all PII
  • Access control (only authorized team members access PII)
  • Data retention policy (delete data when no longer needed)

SOC 2 Implementation Readiness Checklist

  • [ ] Executive commitment from CTO/CEO (SOC 2 is board-level priority)
  • [ ] Budget approved (₹60-120K audit + ₹25-40L internal team time)
  • [ ] Auditor selected and contract signed (Big 4, mid-tier, or reputable boutique)
  • [ ] Security engineer/compliance person assigned (0.5 FTE minimum)
  • [ ] Cloud infrastructure on GCP with India region for data residency
  • [ ] Information Security Policy drafted (legal review planned)
  • [ ] MFA enabled on all admin and critical system access
  • [ ] Database encryption enabled (AES-256 or Cloud KMS)
  • [ ] API endpoint encryption enforced (TLS 1.3 minimum)
  • [ ] Access logging configured (90+ day retention)
  • [ ] Backup and disaster recovery tested quarterly (documented results)
  • [ ] VAPT scheduled or completed (remediation tracked)
  • [ ] Background check process established (all employees/contractors included)
  • [ ] Change management process documented (approvals + testing required)
  • [ ] Incident response plan written and team trained
  • [ ] Security awareness training scheduled (attendance tracked)
  • [ ] Timeline understood (12-15 months from zero to certificate)

ISO 27001 Implementation Readiness Checklist

Foundation (Months 0–2)

  • [ ] Executive commitment from CTO/CEO — ISMS owner appointed (dedicated role, not just CTO wearing another hat)
  • [ ] ISMS scope defined in writing (which systems, business units, locations, cloud environments are in scope)
  • [ ] Accredited certification body selected and Stage 1 audit date provisionally agreed
  • [ ] Budget approved: ₹70–120K audit fees + ₹20–40L internal team time over 12 months
  • [ ] Gap analysis vs ISO 27001:2022 Annex A completed (baseline to measure progress)
  • [ ] Statement of Applicability (SoA) template created (all 93 controls listed, applicability to be determined)

ISMS Build (Months 2–7)

  • [ ] Information Security Policy approved by top management and published
  • [ ] Formal Risk Assessment completed: asset inventory → threats → vulnerabilities → risk scores
  • [ ] Risk Treatment Plan documented: accepted risks, mitigated risks, control selection justified
  • [ ] Statement of Applicability (SoA) finalised: all 93 controls addressed with justifications
  • [ ] Mandatory procedures documented: Internal Audit, Management Review, Corrective Action, Document Control, Competence & Training
  • [ ] Supplier/vendor security agreements in place (critical third parties signed DPA + security addendum)
  • [ ] Background verification process established for all employees and contractors
  • [ ] Employment contracts updated to include information security responsibilities
  • [ ] All Annex A technical controls implemented (encryption, MFA, VAPT, access control, logging, backup — see Control Overlap Map above)
  • [ ] Physical security controls documented (office access, clean desk, equipment inventory, secure disposal)
  • [ ] Security awareness training programme launched (100% completion required before Stage 2)

Pre-Audit (Months 7–9)

  • [ ] Internal audit of ISMS completed (test all applicable controls, document findings)
  • [ ] Corrective actions from internal audit resolved and documented
  • [ ] Management Review meeting conducted (agenda: ISMS performance, audit results, risk status, improvement objectives)
  • [ ] Management Review minutes formally recorded and signed off
  • [ ] Evidence packs prepared for all applicable Annex A controls (logs, screenshots, records, test results)
  • [ ] At least 3 months of control operation evidence available (backup logs, access review records, training attendance, change tickets)
  • [ ] Stage 1 audit completed and all significant concerns addressed

Certification & Maintenance

  • [ ] Stage 2 audit completed — all Major nonconformities resolved before certificate issuance
  • [ ] Minor nonconformities remediation plan submitted to certification body (90-day deadline)
  • [ ] ISO 27001:2022 certificate received — published on website and shared with enterprise customers
  • [ ] Annual surveillance audit dates scheduled (Year 1 and Year 2)
  • [ ] Continual improvement log started (ISMS improvements documented ongoing)
  • [ ] Quarterly internal control testing scheduled (backup restore, access review, vulnerability scan, training)
  • [ ] Recertification audit planned for Year 3 (full re-audit required)

Key Takeaways for SOC 2 Type II & ISO 27001 for Indian SaaS Companies

SOC 2 Type II is now a prerequisite for selling to US and EU enterprise customers:

Indian SaaS companies targeting North American or European enterprise buyers — particularly in sectors like BFSI, healthcare, and HR tech — routinely encounter SOC 2 Type II as a non-negotiable vendor onboarding requirement. A Type II report covers a minimum observation period of six months (typically twelve months for a full audit cycle) and attests that your controls around security, availability, processing integrity, confidentiality, and privacy are operating effectively over time. Starting the readiness process 12–18 months before your target audit completion date gives you adequate runway to remediate control gaps without delaying revenue-critical deals.

ISO 27001:2022 certification is valued in Indian government and BFSI procurement:

While SOC 2 dominates Western enterprise requirements, ISO 27001 certification is the preferred information security standard in Indian government procurement (GEM portal requirements), RBI-regulated entities, and large Indian PSU contracts. The ISO 27001:2022 revision introduced 11 new controls covering threat intelligence, cloud security, and data masking that Indian SaaS companies must address. Accredited certification bodies (Bureau Veritas, BSI, TÜV SÜD) operating in India can complete the audit in three to six months for companies with fewer than 200 employees, assuming a documented ISMS is already in place.

Implement a formal risk register before any certification audit:

Both SOC 2 and ISO 27001 require a documented information security risk assessment as a foundational control. Your risk register must identify assets (code repositories, customer databases, cloud infrastructure), threats (data exfiltration, insider misuse, DDoS), vulnerabilities, likelihood and impact ratings, and treatment plans. Indian SaaS startups frequently have informal risk awareness but no documented register, which results in a qualification or non-conformance finding on the first audit. Use a tool like Corpfy SOC 2 Readiness, Drata, or Sprinto (founded in India) to automate evidence collection and maintain the risk register continuously rather than as a point-in-time exercise.

Cloud-native Indian startups have a structural adCorpfy SOC 2 Readinessge in SOC 2 readiness:

Companies built on AWS, GCP, or Azure India regions inherit a significant portion of their infrastructure-level controls through the cloud provider's shared responsibility model — including physical security, network segmentation, and hardware redundancy. AWS's India regions (ap-south-1 in Mumbai, ap-south-2 in Hyderabad) are SOC 2 certified, which means you can inherit these controls directly in your own audit. However, the application-layer controls — access management, encryption key handling, incident response, and change management — remain your responsibility and require dedicated implementation before your audit observation period begins.

Align SOC 2 and DPDP Act 2023 compliance programmes to reduce duplicate effort:

The DPDP Act 2023's requirements for consent management, data breach notification (72-hour window to CERT-In under separate IT rules), and data minimisation overlap significantly with SOC 2's Privacy Trust Services Criteria and ISO 27001's Annex A controls for data protection. Indian SaaS companies can reduce compliance overhead by mapping their DPDP obligations against their SOC 2 or ISO 27001 control framework in a single integrated compliance matrix. This approach also satisfies CERT-In's 2022 cybersecurity directions (mandatory incident reporting, log retention for 180 days, VPN user logging) within the same evidence collection workflow.

Continuous compliance monitoring reduces audit cost and accelerates renewal cycles:

Traditional compliance programmes rely on manual evidence collection before each annual audit, which is expensive, error-prone, and creates "compliance debt" that accumulates between audits. Platforms like Corpfy SOC 2 Readiness, Drata, Sprinto, or Secureframe integrate with your AWS/GCP/Azure accounts, Corpfy Startup Tool Stack, JIRA, and HR systems to continuously monitor control effectiveness and auto-collect audit evidence. Indian SaaS companies that adopt continuous compliance tooling before their first SOC 2 audit report 40–60% lower external auditor fees on renewal audits and can respond to customer security questionnaires in hours rather than days — a significant competitive adCorpfy SOC 2 Readinessge in enterprise sales cycles.

Inside Corpfy SOC 2 Readiness

Corpfy's SOC 2 Readiness dashboard is a live control tracker mapped to all five Trust Service Criteria (TSC). Every control has an owner, a due date, an evidence field, and a risk rating. As evidence is uploaded, your overall readiness score updates in real time — the same live register the SOC 2 Audit page's gap analysis reads from.

What Corpfy tracks for you

CapabilityWhat it doesEvidence it produces
TSC Control RegisterAll CC, A, C, PI, P controls with status, owner, and due dateAudit-ready control matrix exportable as PDF or CSV
Readiness ScoreLive % completion across all five Trust Service CriteriaDashboard screenshot accepted by Big 4 auditors as progress evidence
Evidence VaultAttach policies, screenshots, and test results to each controlStructured evidence package organised by control ID
Related Services
SOC 2 — Audit

Auditor selection, exception prevention, and Type II certification prep.
System Architecture

Build a secure infrastructure foundation for SOC 2 controls.
Policy Management

Create and govern the policies SOC 2 requires.
ISO 27001

Annex A controls overlap heavily with statutory audit evidence requirements.