Free tool
Which assurance report do you need?
SOC 2, SOC 1, ISO 27001, ISAE 3000 or ISAE 3402. Four questions about who is asking and why, and the report that usually answers them.
What usually fits
Answer the four questions and the recommendation appears here.
Buyers decide what they accept. Before you commission a report, ask the customers who are asking which one they need and which auditor standard they expect.
Can one report satisfy both US and European customers?
Often, but not always. Many European buyers accept a SOC 2, and many US buyers accept ISO 27001. When tenders name a standard, the named one is the one that counts, which is why companies selling into both markets frequently end up with SOC 2 and ISO 27001 together.
Why does the tool suggest a Type 1 first?
A Type 2 tests controls over an observation period, so controls that are new have nothing to show yet. A Type 1 covers design at a date and can be issued sooner, then the Type 2 follows once the controls have run.
What is the difference between ISAE 3000 and ISAE 3402?
ISAE 3402 covers controls relevant to customers' financial reporting, like SOC 1. ISAE 3000 is the general standard for assurance on other subject matter, such as security controls, so it sits closer to SOC 2.
Trust, settled.
A self-check is a snapshot. Noru keeps the answer current, control by control.