ISO 27001, SOC 2 and audits

“Are you compliant?” is a question with no single answer, because compliance is about processes and scope, not a badge that transfers. Knowing the shape of it lets you answer customers plainly instead of over-promising.

What the common frameworks are

• ISO 27001 — an international standard for an information-security management system: that you have defined, follow and review security processes.
• SOC 2 — an audit report (common in the US) on how you handle security, availability and confidentiality.
• Sector rules — PCI DSS for card data, and others for health or finance.

Shared responsibility, again

A certified facility or provider covers their layer — physical security, network, the controls they operate. It does not make your application compliant; your configuration, access control and data handling are yours. This is the same line drawn in who secures what, and auditors will ask about both sides.

What you can inherit, what you cannot

You can point to your provider’s controls for the physical and network layer, which saves you proving things you do not operate. You cannot inherit application-level controls — access management, encryption of your data, logging — those you must do and evidence yourself. See keeping your account secure.

Be honest about scope

If a customer asks whether you are ISO 27001 certified, the truthful answer is about your management system, not just where you host. Borrowing a provider’s certification to imply your own is how audits go wrong later. Claim what you actually operate.

How we help

For your own audits we can provide the information about our layer that you need — and a confidentiality agreement where appropriate. Ask, and tell us which framework you are being assessed against, so we give you the relevant detail. See also supplier checks and due diligence.

---

Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base