ISO 27001 and SOC 2 Readiness
Technical controls and evidence, ready for the auditor.
We help software companies prepare for ISO 27001 and SOC 2: gap assessment, technical control implementation, policy and procedure drafts, evidence collection and audit support. We do not certify; independent auditors do.
- Gap assessment
- Technical controls
- Evidence
Free 30-minute call with a senior specialist. Reply within one business day. Based in Jaipur, working with businesses across India.
- Discovery callFree 30 minutes with a senior specialist
- Scoped first phaseWritten scope, timeline and fixed price
- Build with weekly demosWorking software you can see every week
- Launch and supportGo-live with your team ready, then ongoing support
What is ISO 27001 and SOC 2 readiness?
ISO 27001 readiness and SOC 2 readiness prepare a company for an independent audit of its security management by closing gaps in controls, policies and evidence. Stack18 implements the technical controls and supports evidence collection. Certification or attestation is issued only by accredited auditors.
Last reviewed 30 October 2026 by the Stack18 delivery team in Jaipur. Security and AI governance · Pricing · About Stack18
| What it covers | Gap assessment; Technical controls; Policies and procedures; Evidence automation; Audit support. |
|---|---|
| Typical first step | Discovery Sprint: 2 weeks, fixed price. |
| Build route | Fixed-scope first release: agreed in discovery; fixed price after discovery. |
| Long-term option | Transformation Pod: 12–36 months, annual contract. |
| Measured by | Control gaps closed; Evidence automation coverage; Audit findings; Time to readiness. Each against an agreed baseline. |
| Governance | Human approval at 5 governance gates before anything reaches production. NDA available on request. |
| Delivery team | Based in Jaipur, India. A senior specialist replies within one business day. |
You need this when…
Tap the ones that apply to you.
ISO 27001 and SOC 2 Readiness, end to end.
Each capability is delivered by the same team on the Agentic SDLC, with your approval at every critical step.
Gap assessment
Know where you stand.
- Scope definition
- Control gap review
- Risk assessment
Technical controls
Security that works in practice.
- Access control and MFA
- Logging and monitoring
- Encryption and backups
Policies and procedures
Written and usable.
- Policy drafts
- Incident and change processes
- Vendor management
Evidence automation
Less audit scramble.
- Evidence collection from systems
- Access review records
- Change and deployment logs
Audit support
Be ready on the day.
- Auditor liaison
- Walkthrough preparation
- Remediation tracking
A typical engagement, step by step.
Senior people lead every phase. Specialised AI agents on the Agentic SDLC handle the repetitive work, and nothing ships without your approval.
Discovery
Map how security certification works today, the systems and data involved, and agree the first measurable outcome.
Design
Design the workflows, roles, integrations and approval points for security certification.
Build in weekly demos
Your team sees working security certification software every week, with changes agreed in the open.
Launch and support
Data migration, training, go-live support and a measured 30-day review against the baseline.
Start small. Scale when it works.
Every engagement begins with a short, fixed-price step so you can judge the fit before committing further. See pricing.
Discovery Sprint
Teams deciding scope and priorities before they commit.
- Duration
- 2 weeks
- Pricing
- Fixed price
- Scoped plan and timeline
- Team and fixed price
- Process map or prototype
Fixed-scope first release
Teams that know what they need built.
- Duration
- Agreed in discovery
- Pricing
- Fixed price after discovery
- Written scope and acceptance criteria
- Weekly demos
- Handover with documentation
Transformation Pod
Multi-system programmes that run for years.
- Duration
- 12–36 months
- Pricing
- Annual contract
- Dedicated cross-functional team
- Quarterly business reviews
- One accountable partner
What we have shipped, and what a typical engagement looks like.
Delivered projects link to the full case study. Illustrative scenarios describe typical engagements and are not named client results.
SaaS company selling to enterprises
- Challenge
- Security questionnaires blocking deals; no documented controls.
- What we do
- Gap assessment and control implementation with evidence automation.
Assessment in 2 weeks
Free security certification review
Tell us where security certification hurts most. We map what to fix first, whether ready-made or custom fits, and a realistic first step.
- Where to start and why
- Ready-made vs custom view
- Indicative timeline
We agree targets before we start.
Every engagement has a baseline and a target on the measures that matter to you, reported at every read-out.
ISO 27001 and SOC 2 Readiness questions.
Do you certify us?
No. Certification or attestation comes from accredited auditors. We prepare you for it.
ISO 27001 or SOC 2?
It depends on your customers. We help you choose based on who is asking and in which markets.
How long does readiness take?
It varies with your starting point. A two-week assessment gives a fixed-price plan and timeline.
Do you recommend auditors?
We can discuss options, but you choose and contract your auditor.
Does it cover AI systems?
Yes. We can include AI governance controls.
Guides, comparisons and proof.
Software Development Cost in India: What Drives It
What drives custom software cost in India, how fixed price, time and materials and dedicated teams differ, and…
Read →CompareReady-Made vs Custom Software: How to Choose
Ready-made systems go live in weeks at a fixed price.
Read →TrustSecurity, Data Protection & AI Governance
How Stack18 keeps your data and AI work secure: human approval gates, your environment, audit trails, no model…
Read →Let's scope your ISO 27001 and SOC 2 Readiness project.
Tell us where you are and where you want to be. A senior specialist will reply within one business day with next steps.
- Free 30-minute consultation
- Indicative estimate after the call
- NDA available on request