Compliance & Risk Advisory
Gap assessments, policies and playbooks aligned with RBI, SEBI CSCRF, CERT-In, IRDAI, PCI DSS and DPDP.
Learn more about Compliance & Risk Advisory → Compliance · ISO 27001
ISO 27001, SOC 2 and NIST CSF readiness
ISO/IEC 27001 is the international standard for an information security management system (ISMS). The 2022 edition groups its 93 Annex A controls into four themes: organisational, people, physical and technological.
Overview
In plain English
SOC 2 is an attestation report based on the AICPA Trust Services Criteria, often requested by US customers. NIST CSF 2.0, published in February 2024, adds a Govern function to the framework and is a useful maturity model for any organisation.
Instruments covered
- ISO/IEC 27001:2022
- SOC 2 (AICPA Trust Services Criteria)
- NIST Cybersecurity Framework (CSF) 2.0
Key requirements
What ISO 27001 expects
ISMS scope and context
Define the scope of the management system and the issues and interested parties that affect it.
Leadership and policy
Top management commitment and an information security policy.
Risk assessment and treatment
Identify, assess and treat information security risks, recorded in a Statement of Applicability.
Annex A controls
Select and implement relevant controls across organisational, people, physical and technological themes.
Internal audit and management review
Audit the ISMS and review its performance at planned intervals.
Continual improvement
Correct nonconformities and improve the ISMS over time.
How TrustNet helps
From gap to evidence
- ISO 27001 readiness and gap assessment
- ISMS policy suite and risk register
- Internal audit
- SOC 2 readiness
- NIST CSF 2.0 maturity assessment
Official sources
Aligned with, not endorsed by any regulator. This page is a plain-English summary for awareness — confirm obligations against the latest official circulars or with your compliance officer.
Services mapped to ISO 27001
Security Audit
Independent review of your systems, controls and architecture against the rules you must follow.
Learn more about Security Audit →vCISO, Governance & Third-Party Risk
Senior security leadership, policies and vendor risk management without a full-time CISO.
Learn more about vCISO, Governance & Third-Party Risk →FAQ
ISO 27001 FAQ
Can you certify us to ISO 27001?
Certification is issued by an accredited certification body. We help you get ready and run your internal audit.
What changed in ISO 27001:2022?
Annex A was restructured into 93 controls in four themes, with some new controls such as threat intelligence and cloud services security.
Do we need SOC 2 or ISO 27001?
It depends on your customers. US customers often ask for SOC 2; ISO 27001 is widely recognised globally. We help you choose.
Book a consultation
Get ISO 27001-ready
We assess where you stand, close the gaps and prepare the evidence your auditors and regulator will ask for.
support@trustnetsecure.com · +91 93229 37312 · +91 88300 61438
Under attack right now? Go to emergency help →