ISO 27001 Information Security Management Software

RELATED FRAMEWORKS. DIFFERENT ASSURANCE. 

ISO/IEC 27001 defines requirements for establishing, implementing, maintaining and continually improving an information security management system. SOC 2 is an independent examination of controls at a service organisation relevant to selected Trust Services Criteria. Zebsoft allows the operational controls to be governed together while each route retains its own scope, criteria, evidence and external assurance. 

Control ISMS scope, context, leadership, risk treatment, objectives, documented information, operation, evaluation and improvement. Maintain the Statement of Applicability and evidence supporting selected controls. 

Define the service-system boundary, relevant Trust Services Criteria, controls, description evidence and the records needed for an independent CPA examination. SOC 2 is an attestation report, not an ISO certification. 

Use a canonical control record to connect both frameworks to the same accountable activity where the relationship is valid, then retain framework-specific decisions and assurance outputs. 

Zebsoft supports readiness, operation and evidence. Certification and attestation conclusions are made independently by the appropriately qualified external organisations. 

BEYOND COMPLIANCE AUTOMATION 

Automated evidence collection, integrations and framework mapping are valuable. They do not by themselves establish why a control was selected, who accepted the risk, whether the control reached the people doing the work, how an exception was approved or whether remediation was effective. Zebsoft joins monitoring to the operational workflow that answers those questions. 

Define the objective, risk relationship, control activity, accountable owner, frequency, evidence expectation, escalation route and approval authority. 

Issue tasks, route approvals, manage access, complete reviews, communicate requirements and capture work at the point it occurs. 

Combine system tests, human evidence, audit sampling, exceptions, findings and effectiveness review in a traceable assurance record. 

Turn failure, incident, change and review results into assigned corrective action with verified closure and controlled updates. 

THE ZAP CONTROL MODEL 

A control is not effective because it exists in a library. It becomes governable when responsible people understand the requirement, perform the activity and return evidence for evaluation. 

Establish scope, risks, criteria, policies, controls, owners, evidence requirements, tests, exceptions and decision authorities. 

Deliver approved requirements to the roles, teams, suppliers and service owners who need to understand and apply them. 

Execute access reviews, risk treatments, vulnerability activity, supplier checks, incident response, changes and other control workflows. 

Monitor tests, examine evidence, audit the system, manage findings, review performance and confirm whether actions were effective. 

CONTROL ONCE. ASSURE TWICE. 

Shared controls reduce duplication only when the relationship is valid. Zebsoft makes the relationship visible without treating a cross-reference as proof of conformity. 

01 

Record the objective, activity, owner, systems, population, frequency, evidence and approval route. 

02 

Relate the control to applicable ISO/IEC 27001 requirements, Annex A references and relevant SOC 2 criteria. 

03 

Run the approved workflow against the real people, assets, services, suppliers and information in scope. 

04 

Apply the scope, test, sampling, period, applicability and judgement required for each assurance route. 

05 

Present current evidence and exceptions to management, ISO auditors and SOC 2 practitioners without overstating the result. 

One control record can support two frameworks. It does not make the frameworks interchangeable, and it does not remove the need for competent evaluation. 

CONNECTED SECURITY GOVERNANCE 

Zebsoft links governance, risk, control operation and assurance so an auditor or manager can follow a result back to the responsible process rather than search across spreadsheets, tickets and folders. 

Maintain scope, interested parties, policies, objectives, roles, committees, decisions and management-system review records. 

Connect information assets, threats, vulnerabilities, impacts, risk owners, treatment decisions and residual risk. 

Control Annex A applicability, justification, implementation state, ownership, risk links, evidence and approval. Explore the SoA workflow. 

Route policies, procedures, standards and records through review, approval, version control, communication and scheduled reassessment. 

Control requests, approvals, provisioning evidence, privileged access, recertification, segregation concerns and removal. 

Link supplier due diligence, contractual controls, risk, evidence, review dates, incidents and continued approval. 

Route security events and changes through assessment, containment, investigation, approval, remediation and effectiveness review. 

Schedule control tests and audits, retain samples and evidence, manage findings and give stakeholders traceable current views. 

EVIDENCE WITH CONTEXT 

Evidence is useful when its source, scope, period, control relationship and review are clear. Zebsoft can combine machine-generated results with the human and operational records that technology integrations cannot establish on their own. 

API results, configuration exports, logs, device status, account populations and other outputs from controlled source systems. 

Requests, approvals, reviews, meetings, training, supplier evaluations, investigations and actions completed through workflow. 

Test plans, samples, reviewer notes, exceptions, audit findings, corrective actions and verified effectiveness. 

Risk acceptance, control selection, exclusions, changes, approvals and management conclusions made by authorised people. 

A passing technical test can support a control. It cannot prove every organisational, human or process element of that control operated effectively. 

PREPARE THE WORK NOT A FICTIONAL SCORE

A percentage can help prioritise activity, but it is not an assurance opinion. Zebsoft allows managers, internal auditors, certification auditors and SOC practitioners to drill from a reported position to the applicable control, owner, evidence, exception, action and decision. 

Plan a risk-informed programme, assign independent auditors, sample the ISMS, record findings and verify corrective action. 

Present controlled records supporting scope, requirements, risk treatment, the SoA, operation, evaluation and improvement. 

Provide the service-system description, control population, period evidence, exceptions and management records required by the appointed CPA firm. 

Answer due-diligence questions from approved, current information and share only the evidence authorised for the recipient. 

External auditors decide the evidence they require and reach their own conclusions. Zebsoft organises and exposes the controlled record; it does not replace their independence. 

ONE SECURITY CONTROL ENVIRONMENT 

ISO 27001 and SOC 2 can share operational controls. Specialist subjects still need their own accountable records and page intent. GDPR remains a separate privacy-governance domain; it can link to relevant security controls without being merged into this page or treated as interchangeable with either framework. 

Connect assets, risk scenarios, treatment, control design, residual risk, approval and review. Explore risk management.

Keep policies and procedures current, approved, communicated and linked to evidence. Explore document control.

Connect tests and audits to findings, action ownership, evidence and effectiveness. Explore audit management.

Keep RoPA, DPIA, rights requests and breach governance in the dedicated privacy domain while linking necessary security controls. Explore GDPR software.

ACCURATE FRAMEWORK LANGUAGE 

Use the licensed requirements, criteria and professional guidance applicable to your assurance engagement. Zebsoft content is informative and is not legal, certification or attestation advice. 

The international standard specifies requirements for an information security management system and its continual improvement. View the official ISO page. 

AICPA describes SOC 2 as an examination of controls at a service organisation relevant to security, availability, processing integrity, confidentiality or privacy. View the official AICPA resource. 

Yes. Common controls can be operated once and mapped to both frameworks where appropriate. Each framework still retains its own scope, criteria, evidence decisions, reviews and external assurance output. 

No. A useful relationship or mapping does not automatically establish that evidence is sufficient, relevant or within scope for both routes. The responsible reviewers and external auditors make those evaluations. 

No. SOC 2 is an examination and report performed by an independent CPA firm. ISO/IEC 27001 certification is a different conformity-assessment route. 

No. It controls workflows, records, evidence and access. Independent auditors determine their approach, sample evidence, raise findings and reach conclusions. 

Zebsoft’s AI approach is deliberately constrained. AI can interrogate and analyse approved information. It does not fabricate controls, policies, evidence, approvals or conclusions; authorised people remain responsible. 

No. Privacy governance remains a separate Zebsoft domain. Security controls can be linked where relevant without combining the frameworks or weakening the specialist privacy workflow.