Preparing for ISO 27001 or SOC 2? Your security can already count.
Auditors ask two questions: do the controls exist, and can you prove they work over time? Our managed services put the technical controls in place and produce the evidence. Our readiness work covers the rest.
Why this matters
ISO/IEC 27001 certification and SOC 2 reports are increasingly requested by larger customers, especially in outsourcing, finance and software. Many businesses discover that the hardest part is not writing policies but proving, month after month, that the technical controls actually run.
Every KullaTech security service is mapped to specific Annex A controls and SOC 2 criteria, and produces a record your auditor can use.
What we do
- Protect: the managed stack implements the technical controls: malware protection, monitoring, patching, MFA, web filtering and backup.
- Prove: a monthly evidence pack: alerts handled, patch status, MFA coverage, backup and restore results.
- Prepare: gap assessment, risk assessment, Statement of Applicability, policies and procedures.
- Audit support: help preparing for and during the certification or attestation audit.
How it works
- Gap assessment. Where you are against the standard today.
- Plan. Scope, priorities and timeline agreed.
- Implement. Technical controls deployed and documentation written.
- Operate. Evidence collected over the observation period.
- Audit. Support through the external audit.
What you receive
- Gap assessment report
- Risk assessment and Statement of Applicability
- Policy set tailored to your business
- Monthly evidence pack from the managed services
Which controls each service supports
| Service | ISO/IEC 27001 Annex A | SOC 2 | Evidence produced |
|---|---|---|---|
| Asset Protection | 8.1 · 8.7 · 8.16 · 5.24 to 5.26 | CC6.8 · CC7.2 to CC7.4 | EDR alerts and incident tickets |
| Email Protection | 5.14 · 8.7 | CC6.8 · CC7.2 | Phishing detection and remediation log |
| Domain Protection | 5.14 · 8.21 | CC6.6 | DMARC reports and policy history |
| Identity Protection | 5.15 · 5.17 · 5.18 · 8.2 · 8.5 | CC6.1 to CC6.3 | MFA coverage and access reviews |
| Vulnerability Protection | 8.8 · 8.9 · 8.19 | CC7.1 · CC8.1 | Scan results and patch reports |
| Web Protection | 8.23 | CC6.8 | Blocked-threat reports |
| Data Protection | 5.30 · 8.13 · 8.14 | CC7.5 · A1.2 to A1.3 | Backup jobs and restore tests |
| Security Operations | 5.24 to 5.27 · 8.15 · 8.16 | CC7.3 to CC7.5 | Monthly security report |
Together the services support 22 Annex A controls and the core SOC 2 security criteria. KullaTech does not issue certificates. ISO/IEC 27001 certification is granted by an accredited certification body, and SOC 2 reports are issued by independent CPA firms.
Common questions
Do you certify us?
No. Certification is issued by an accredited certification body, and SOC 2 reports by an independent auditor. We prepare you and provide the evidence.
How long does ISO 27001 take?
Commonly six to twelve months for a small or mid-sized business, depending on scope and how much is already in place.
What is not covered by tools?
The management system: scope, risk assessment, policies, people, suppliers and internal audit. That is our readiness service.
Related
Preparing for ISO 27001 or SOC 2? Your security can already count.
Email contact@kullatech.com with a few lines about your business. We reply with a clear scope, not a sales call.
Email contact@kullatech.com