ISO 27001 / SOC 2
Introduction
A high-level guide to ISO/IEC 27001 and SOC 2
ISO 27001 / SOC 2
ISO/IEC 27001 and SOC 2 are widely used assurance frameworks for demonstrating that an organization manages information security deliberately, consistently, and with evidence. They overlap substantially, but they are not interchangeable.
HyperMemory’s current programme targets internal compliance alignment, not ISO certification or a CPA-issued SOC 2 report. This page explains the frameworks and programme at a high level; it is not a certificate, attestation report, or legal opinion.
What each framework does
| Framework | Primary purpose | Independent assurance outcome |
|---|---|---|
| ISO/IEC 27001:2022 | Establishes requirements for an information security management system (ISMS) that identifies, treats, monitors, and continually improves information-security risk. | Certification may be issued by an accredited certification body after successful Stage 1 and Stage 2 audits. |
| SOC 2 | Evaluates controls relevant to the AICPA Trust Services Criteria for security, availability, processing integrity, confidentiality, and privacy. | An independent CPA firm may issue a SOC 2 examination report covering the defined system, criteria, and review period. |
ISO/IEC 27001 at a glance
ISO/IEC 27001 is an organization-wide management-system standard, not only a technical checklist. Its mandatory clauses require HyperMemory to define and operate an ISMS across seven connected areas:
- Context — define the organization, interested parties, obligations, and ISMS scope.
- Leadership — establish policy, accountability, ownership, and management commitment.
- Planning — assess risk, select treatments, maintain a Statement of Applicability, and set measurable objectives.
- Support — provide resources, competence, awareness, communication, and controlled documentation.
- Operation — operate risk assessment, treatment, and related security processes.
- Performance evaluation — monitor the ISMS, conduct internal audits, and complete management reviews.
- Improvement — correct nonconformities and continually improve the management system.
The 2022 edition also provides 93 Annex A controls organized into four themes: organizational, people, physical, and technological controls. Applicability is determined through risk treatment and documented in the Statement of Applicability.
SOC 2 at a glance
SOC 2 uses the AICPA Trust Services Criteria to assess whether controls are suitably designed and, when included in the engagement, operating effectively. Its five categories are:
- Security — protection against unauthorized access, use, or disclosure.
- Availability — system availability for operation and use as committed or agreed.
- Processing integrity — complete, valid, accurate, timely, and authorized processing.
- Confidentiality — protection of information designated as confidential.
- Privacy — collection, use, retention, disclosure, and disposal of personal information.
How they work together
One risk-led security programme can support both frameworks. Governance, risk management, access control, change management, incident response, supplier oversight, business continuity, monitoring, and evidence collection are relevant to both. HyperMemory will maintain one control and evidence system, then map it separately to ISO/IEC 27001 and all five SOC 2 Trust Services Categories.
The assurance outcomes remain distinct: ISO/IEC 27001 can result in certification of an ISMS, while SOC 2 results in an examination report for a defined system and criteria.
HyperMemory’s current position
HyperMemory’s security baseline includes tenant isolation, service identity, encrypted secrets, deletion workflows, observability, operational runbooks, endpoint controls, physical safeguards, vulnerability management, supplier governance, and recovery procedures.
The approved governance baseline includes the ISMS policies, risk register and treatment plan, Statement of Applicability, integrated control matrix, operational registers, information-classification scheme, continuity and incident procedures, supplier controls, and an internal operating-effectiveness model. External ISO certification and SOC 2 attestation are planned as separate future assurance activities.
See Compliance Status for the current public register and status scale.