---
title: "ISAE 3000 vs SOC 2: Key Differences, Equivalencies, and Which Report You Need - Axipro"
description: "Get clarity on ISAE 3000 vs SOC 2 to choose the right report for your vendor due diligence and compliance needs."
canonical: "https://axipro.co/isae-3000-vs-soc-2/"
language: "en-US"
modified: "2026-05-07T12:43:18+00:00"
generator: "WordPress 7.1.2"
---

[Home](https://axipro.co)

/ [All Blog](https://axipro.co/category/blog/), [SOC-2](https://axipro.co/category/soc-2-2/)

/ ISAE 3000 vs SOC 2: Key Differences, Equivalencies, and Which Report You Need

# ISAE 3000 vs SOC 2: Key Differences, Equivalencies, and Which Report You Need

![Picture of Pedro Dias](https://axipro.co/wp-content/uploads/2026/05/pedro-passport-picture-scaled.jpg)

- Pedro Dias
- March 19, 2026

Copy Link

*A practical guide for SaaS companies, cloud vendors, and security teams navigating international assurance reporting.*

If you have ever been deep in a vendor due diligence questionnaire and hit the question *“Do you have a SOC 2 or equivalent report?”* you are not alone. For companies operating across borders, the follow-up question is almost always: ***is ISAE 3000 the same as SOC 2?***

The short answer is no. The two standards share real overlap and can sometimes be combined into a single engagement, yet they serve fundamentally different markets. Getting this wrong can mean buying the wrong report, overpaying for duplicate audits, or confusing procurement teams who needed one thing and received another.

This guide breaks down what each standard covers, where they diverge, and how to decide which report is right for your organisation.

![ISAE 3000 vs SOC 2](https://axipro.co/wp-content/uploads/2026/03/Launch-LinkedIn-Single-Image-Ad.png)

## **What “ISAE 3000” and “SOC 2” Actually Mean**

### **ISAE 3000: The International Assurance Standard for Non-Financial Reporting**

ISAE 3000 is an **international standard** issued by the [International Auditing and Assurance Standards Board (IAASB)](https://www.iaasb.org/), operating under the International Federation of Accountants (IFAC). It governs assurance engagements on *any subject matter that is not a historical financial statement audit or review*: sustainability reports, ESG disclosures, cybersecurity controls, privacy programmes, or, most relevant here, information security controls. Effective for reports dated on or after 15 December 2015, it applies worldwide. Its flexibility is both its strength and its source of confusion: ISAE 3000 does not prescribe *which* criteria to evaluate. It provides the rules for *how* a practitioner should conduct a non-financial assurance engagement, including planning, evidence gathering, risk assessment, and reporting.

### **SOC 2: The AICPA Report Based on the Trust Services Criteria**

SOC 2 is a **reporting framework** developed by the [American Institute of Certified Public Accountants (AICPA)](https://www.aicpa-cima.com/). It examines the design and operating effectiveness of a service organisation’s controls against the AICPA’s five **Trust Services Criteria (TSC)**: Security (the mandatory baseline, also called the Common Criteria), Availability, Processing Integrity, Confidentiality, and Privacy. SOC 2 examinations are performed under **SSAE 18** (specifically AT-C Section 205), the US attestation standard. Reports are restricted-use by default, shared with management, user entities, business partners, and regulators who have sufficient understanding of the system under examination. Since 2017, [SOC 2 Type II](https://axipro.co/soc-2/) has become the de facto compliance benchmark for SaaS and cloud companies serving US enterprise customers.

### **Are ISAE 3000 and SOC 2 Direct Equivalents?**

No. ISAE 3000 is an **assurance methodology**, a set of rules for how to conduct the engagement. SOC 2 is a **report type with pre-defined criteria** (the TSC). One tells the auditor *how* to work; the other tells them *what* to assess. They operate at different layers of the compliance stack, which is why they can sometimes be combined. The confusion is understandable. Both involve independent third-party assurance on information security controls. Both result in a written opinion. And in practice, a European auditor may conduct an engagement under ISAE 3000 *while using the AICPA Trust Services Criteria as the evaluation benchmark*, producing something that looks like a SOC 2 report but technically is not one.

## **Core Differences: ISAE 3000 vs SOC 2**

### ISAE 3000 vs SOC 2: Head-to-Head Comparison

| Dimension | ISAE 3000 | SOC 2 |
| --- | --- | --- |
| Standard Setter | IAASB / IFAC | AICPA |
| Governing Standard | ISAE 3000 | SSAE 18 (AT-C 205) |
| Subject Matter | Any non-financial subject matter | Trust Services Criteria only |
| Criteria Used | Flexible (must be “suitable”) | AICPA TSC (fixed) |
| Assurance Levels | Reasonable or Limited | Reasonable only (Type II) |
| Report Distribution | General-purpose or restricted | Restricted-use |
| Geographic Strength | International (EU, UK, APAC, MEA) | US / Canada |
| Type I / Type II | Point-in-time or period testing | Type I (point) or Type II (period) |
| Audit Firm Requirement | Licensed practitioner (CPA or equivalent) | Licensed CPA firm (US AICPA) |
| Can Use TSC as Criteria? | Yes, if deemed suitable | Yes (mandatory) |

### **Standard Setter and Framework Owner**

ISAE 3000 is maintained by the IAASB, a global body whose standards are adopted in over 130 jurisdictions. SOC 2 is governed by the AICPA, the professional body for US CPAs. A CPA firm in London cannot natively issue a “SOC 2” report (that branding belongs to the AICPA ecosystem), but a UK firm *can* issue an ISAE 3000 assurance report that evaluates controls against the Trust Services Criteria.

### **Subject Matter Flexibility**

ISAE 3000 is deliberately **subject-matter agnostic**. It can be applied to carbon emissions data, anti-bribery controls, ESG metrics, data privacy programmes, or security controls. SOC 2, by contrast, is **locked to the Trust Services Criteria**. Security is always in scope; the four remaining categories are optional add-ons chosen based on the service organisation’s commitments.

### **Criteria: Suitable Criteria Under ISAE 3000 vs AICPA Trust Services Criteria**

Under ISAE 3000, the practitioner must confirm that the chosen criteria are *suitable*, meaning they are relevant, complete, reliable, neutral, and understandable. The AICPA’s TSC *can* serve as suitable criteria under ISAE 3000, but so can [ISO 27001 control objectives](https://axipro.co/iso-27001-vs-soc-2-understanding-the-key-differences/), NIST CSF categories, or a bespoke set of criteria. In a SOC 2 engagement, the criteria are not negotiable. You use the TSC. Period.

### **Report Distribution: General-Purpose vs Restricted-Use**

SOC 2 reports carry a **restricted-use** designation, intended for parties with sufficient knowledge of the system (though in practice, many organisations share them under NDA). ISAE 3000 reports *can* be either restricted-use or general-purpose, depending on the nature of the criteria. If criteria are publicly available and broadly understood (e.g., ISO 27001), the report may be issued for general distribution.

### **Assurance Level: Limited vs Reasonable**

ISAE 3000 explicitly supports both **reasonable assurance** (high-level confidence, positive-form opinion) and **limited assurance** (moderate confidence, negative-form opinion: “nothing has come to our attention…”). SOC 2 Type II provides **reasonable assurance only**. There is no “limited assurance SOC 2.” A company needing a lighter-touch review may find an ISAE 3000 limited assurance engagement faster, cheaper, and sufficient.

### Pro Tip: EU and UK Customers

If your EU or UK customers ask for “an ISAE 3000 report” without specifying the assurance level, clarify upfront. A limited assurance engagement involves materially less testing and a lower fee, but some enterprise buyers will only accept reasonable assurance. Getting alignment early saves weeks of rework.

### **Geographic Recognition and Market Expectation**

SOC 2 dominates in the **United States and Canada**. In the **EU, UK, Middle East, Asia-Pacific, and Africa**, ISAE 3000 (and its cousin ISAE 3402 for financial reporting controls) is the recognised standard. Multinational companies often need both or a carefully scoped hybrid.

## **Scope Comparison: What Each Report Typically Covers**

Every SOC 2 engagement must include the **Security** category (Common Criteria), covering logical and physical access controls, system operations, change management, and risk mitigation. The remaining four categories are added based on the services provided and customer expectations. The report includes a **System Description** prepared by management, detailing the system’s boundaries.

An ISAE 3000 engagement’s scope is whatever the practitioner and engaging party agree upon. When used for security assurance, the scope often mirrors SOC 2. But it could equally focus on [GDPR compliance](https://axipro.co/gdpr-compliance/), data processing agreements, or a proprietary control framework. There is no standardised “System Description” format equivalent to what the AICPA prescribes for SOC 2.

On subservice organisations, SOC 2 uses well-defined approaches: the **inclusive method** (subservice controls are tested) or the **carve-out method** (subservice controls are excluded). ISAE 3000 does not prescribe specific handling methods, though practitioners typically adopt the same model in practice.

## **Common Use Cases: When Buyers Search “ISAE 3000 vs SOC 2”**

The most common scenario is a SaaS company chasing enterprise customers in multiple geographies. US buyers want a SOC 2 Type II. European buyers may accept or specifically request an ISAE 3000 report because their procurement policies reference IAASB standards. For vendors caught in the middle, understanding whether a single engagement can serve both audiences is critical.

EU and UK procurement teams often operate under frameworks influenced by the [European Banking Authority (EBA) outsourcing guidelines](https://www.eba.europa.eu/) or sector-specific regulations that reference ISAE-based assurance. Meanwhile, US enterprise buyers look for the “SOC 2 Type II” label specifically. This tension is something many growing companies discover only after receiving conflicting requests in the same quarter.

### Pro Tip: What Procurement Teams Actually Accept

In our experience at Axipro, most sophisticated procurement teams care about three things: (1) that an independent auditor tested your controls, (2) that the criteria used are recognised and rigorous, and (3) that the report covers a recent period (ideally the last 12 months). Whether the cover page says “SOC 2” or “ISAE 3000” matters less than you think, unless the policy explicitly mandates one or the other. Always ask.

## **SOC 2 Type I vs Type II vs ISAE 3000 Engagement Periods**

SOC 2 **Type I** assesses control design at a *specific point in time*. SOC 2 **Type II** tests *operating effectiveness* over a defined period, typically 6 to 12 months. Type II is what most enterprise buyers want: evidence that controls actually worked over a meaningful timeframe, not just that they existed on paper.

ISAE 3000 supports both point-in-time and period-of-time engagements, mirroring the Type I / Type II distinction. However, the “Type I” and “Type II” labels are AICPA-specific and not used in the ISAE standard itself. In practice, auditors conducting ISAE 3000 security engagements almost always adopt the period-based model.

### Pro Tip: What Customers Prefer

Across both SOC 2 and ISAE 3000, vendor risk teams overwhelmingly prefer period-based (Type II equivalent) reports. A point-in-time report can unblock an initial deal, but for annual renewals, period-based testing is the gold standard.

## **How an “ISAE 3000 SOC 2” Works in Practice**

This is the hybrid approach many international companies find most practical. A practitioner (typically a Big Four or mid-tier firm with both AICPA and IAASB credentials) conducts the engagement *under ISAE 3000* but evaluates the organisation’s controls *against the AICPA Trust Services Criteria*. The resulting report references both the assurance standard and the criteria.

This hybrid is **not** a SOC 2 report in the strict AICPA sense. It will not carry SOC 2 branding. But it provides equivalent substance: the same criteria were tested, by an independent practitioner, under a recognised assurance standard. Many international procurement teams accept this.

If you go this route, ensure the report clearly states: (a) the assurance standard used (ISAE 3000), (b) the evaluation criteria applied (AICPA TSC), (c) management’s assertion or description of the system, and (d) the intended users.

**Common Misunderstandings: “Certified SOC 2” and “SOC 2 Accreditation”**

Let’s clear this up: **there is no such thing as “SOC 2 certification” or “SOC 2 accreditation.”** SOC 2 is an attestation engagement resulting in an auditor’s opinion, not a certificate. You do not “pass” or “fail.” The same applies to ISAE 3000. Vendors who claim to be “SOC 2 certified” are misusing the terminology, and savvy buyers will notice.

## **Which One Should You Choose?**

**Choose SOC 2** when your customers’ procurement policies specifically name SOC 2. Do not overthink it. A SOC 2 Type II from a reputable CPA firm is the most widely accepted compliance artefact in North America. Our [SOC 2 compliance checklist](https://axipro.co/soc-2-compliance-checklist/) can help you prepare.

**Choose ISAE 3000** when your customer base is primarily European, Middle Eastern, or Asia-Pacific and your buyers reference IAASB standards. This is also the right choice when your assurance needs extend beyond security controls into areas like ESG, data privacy, or operational resilience.

**Choose a SOC 2-aligned ISAE 3000** when you sell to both US and international enterprises. The hybrid approach can serve as a pragmatic bridge. Some firms also run parallel engagements: a formal SOC 2 for US customers and an ISAE 3000 report for everyone else, reusing the same evidence across both.

Reach SOC 2 Compliance in 6 Weeks or Less

Schedule Your Free SOC 2 Assessment Today

[Schedule](https://axipro.co/free-assessment/)

## **Can You Combine ISAE 3000 and SOC 2?**

Yes, and it is increasingly common. The key requirement is that your audit firm has practitioners qualified under both AICPA and IAASB standards. The underlying evidence collection (walkthroughs, control testing, documentation review) can be performed once, with the results reported under two frameworks.

The efficiency gain comes from your internal control library. If you have already mapped controls to the TSC for SOC 2, overlaying ISAE 3000 is largely a matter of confirming that the same controls satisfy the suitable criteria requirements. Compliance automation platforms (which Axipro integrates with) can map a single control to multiple frameworks simultaneously.

### Pro Tip: Avoiding Scope Creep

When running a combined engagement, agree scope boundaries in writing before fieldwork begins. It’s tempting to expand (“while we’re here, let’s also cover GDPR Article 28…”), but scope creep inflates costs and delays issuance. Keep it focused on what your customers actually need.

## **Common Pitfalls When Deciding Between ISAE 3000 and SOC 2**

**Buying the wrong report for your target market.**A SOC 2 report won’t satisfy a UK financial regulator expecting ISAE-based assurance. Conversely, handing a US enterprise buyer an ISAE 3000 report when they asked for SOC 2 creates friction, even if the substance is equivalent.

**Overpromising scope.**Including Privacy, Availability, and every subservice organisation in your first report sounds comprehensive but massively increases the audit burden. Start with Security (Common Criteria), get a clean opinion, and expand in subsequent years. For more on this, see our guide to [avoiding common pitfalls in SOC 2 and ISO 27001](https://axipro.co/avoiding-common-pitfalls-in-soc-2-iso-27001/).

**Confusing assurance with certification.**Neither SOC 2 nor ISAE 3000 is a “certification.” Do not put “SOC 2 Certified” on your website. The AICPA provides a [specific SOC logo programme](https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2) for organisations that have completed an examination. Use that instead.

## **Final Thoughts**

**Ultimately, the ISAE 3000 vs SOC 2 decision comes down to who you’re selling to and where they sit.** US enterprise buyers expect SOC 2 by name. International buyers expect ISAE-based assurance. And if you’re serving both, a hybrid or parallel approach can save you from running two entirely separate audits. The important thing is to make this decision early, scope it correctly, and work with an audit partner who understands both frameworks. Get it right, and your compliance report becomes a deal accelerator rather than a bottleneck.

Is ISAE 3000 the international equivalent of SOC 2?

Not exactly. ISAE 3000 is a broader assurance standard. When used to assess security controls against the TSC, it produces a functionally similar report, but it is not the same product.

Can a non-US auditor issue a SOC 2 report?

The SOC 2 label belongs to the AICPA framework. A non-US firm can issue an ISAE 3000 report using the TSC as criteria, which many international buyers accept. Some global audit firms with US-licensed CPAs can issue SOC 2 reports from non-US offices.

Does ISAE 3000 cover the SOC 2 Trust Services Criteria?

ISAE 3000 does not specify criteria. The TSC can be used as evaluation criteria within an ISAE 3000 engagement, provided they are deemed suitable.

Will US enterprise customers accept an ISAE 3000 report instead of SOC 2?

Some will, many won’t. US procurement policies frequently name SOC 2 specifically. If your primary market is the US, get a SOC 2.

How long does each engagement typically take?

A first-time SOC 2 Type II typically takes 4–6 months end-to-end (including readiness and remediation), though with the right partner it can be done in weeks, not months. An ISAE 3000 engagement of comparable scope follows a similar timeline. Combined engagements may add 2–4 weeks for dual reporting.

Is ISAE 3000 “Type I” and “Type II” like SOC 2?

ISAE 3000 supports both point-in-time and period-based testing, which is conceptually the same. However, the “Type I / Type II” terminology is AICPA-specific.

Axipro Author

![Picture of Pedro Dias](https://axipro.co/wp-content/uploads/2026/05/pedro-passport-picture-scaled.jpg)

### Pedro Dias

Pedro has been writing online for over 10 years. With experience in all things programming, cyber security, and compliance, he is our editor-in-chief at Axipro.

- March 19, 2026
- [All Blog](https://axipro.co/category/blog/), [SOC-2](https://axipro.co/category/soc-2-2/)

Copy Link

## Blog Highlights

## Explore More Articles

[Read More Blogs](https://axipro.co/blog/)

- [Vanta](https://axipro.co/category/vanta/)

- October 3, 2026

#### [Best Vanta Deployment Service (2026): 7 Partners Ranked](https://axipro.co/best-vanta-deployment-service/)

Vanta can tell you a control is failing within the hour. It cannot rewrite your access review process, decide which systems belong in audit scope, or explain to a CPA why a test that shows red is actually fine. That work falls to people, and choosing the right ones is the difference between a 6-week path to audit readiness and a 6-month slog that ends with your Vanta subscription renewing before you have a report. This guide ranks the 7 best Vanta deployment services for 2026, explains what each one is good at, and covers what most comparison pages skip: how long this really takes, what it costs, and how to spot a partner who’ll hand you a half-configured platform and disappear. What Is a Vanta Deployment Service? A Vanta deployment service is a hands-on engagement where a specialist firm sets up, configures, and operationalizes Vanta so your company reaches audit readiness for one or more compliance frameworks. Vanta itself is a compliance automation and trust management platform: it connects to your cloud, identity provider, code repositories, HR system, and endpoints, then runs automated tests and maps the evidence to frameworks such as SOC 2, ISO 27001, HIPAA, and GDPR. The platform automates evidence collection and continuous monitoring. It doesn’t put controls in place for you. A deployment partner handles the judgment work around the tool: scoping, gap analysis, control mapping, policy writing, risk assessment, remediation of failing tests, and coordination with the audit firm. The best partners also stay on after the audit, because a Vanta instance nobody owns degrades fast. Worth Knowing: Vanta is a software vendor, not an auditor. Vanta is a software vendor, not an auditor. Your SOC 2 report still comes from a licensed CPA firm under AICPA attestation standards, and your ISO 27001 certificate comes from an accredited certification body. A deployment partner sits between the platform and the auditor. 1. Axipro Best for: SaaS and technology companies that want Vanta deployed, controls implemented, and the audit delivered by one accountable team, fast. Axipro is an authorized Vanta partner and a Drata Elite Partner, so its team works inside both leading compliance automation platforms every day. Founded in 2023, it has served 200+ clients from offices in the US, UK, and Bahrain, with a 100% audit success rate across 200+ certified clients. What puts Axipro first is scope. Most Vanta partners configure the platform and leave control implementation to you. Axipro’s Achievement Plan covers the whole path: kick-off and Vanta setup, gap analysis, a full policy and procedure suite, risk assessment and treatment, control implementation, vulnerability scanning, an internal audit, and external audit facilitation with an independent auditor. Clients get a dedicated infosec team over Slack, and the Achievement Plan comes with guaranteed certification. The other reason is speed. Axipro typically reaches SOC 2 readiness in around four weeks and ISO 27001 certification readiness in as little as six. It supports 20+ frameworks, including SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR, CMMC, ISO 42001, and the EU AI Act, plus Gulf frameworks such as NCA ECC and SAMA CSF that most US-only partners cannot cover. Teams that want to test the relationship first can start with the free 30-day Compliance Accelerator Plan, which includes Vanta setup, gap analysis, and policy documentation, and continue into ongoing vCISO and continuous monitoring through the Trust Assurance Plan after certification. Watch for: Axipro is built for companies that want the work done for them. Teams that want a light-touch coaching engagement and plan to run the program in-house will use only part of what it offers. 2. Control and Function Best for: US SaaS companies of roughly 10 to 60 people that want SOC 2 and ISO 27001 run as one fixed-price project. Control and Function is a Denver-based consultancy built around fixed-scope, fixed-price readiness for small SaaS teams that have no compliance department. Its sweet spot is the dual-framework engagement: building SOC 2 and ISO 27001 from one shared control set rather than running two projects back to back. It also covers HIPAA for healthtech and maps ed-tech requirements such as FERPA and HECVAT. The firm is platform-neutral, so it works inside Vanta rather than reselling it, and it is explicit about handing off cleanly to an independent auditor. It’s also one of the few firms here that publishes prices, with readiness coaching starting around $8,000 and full readiness around $15,000. Watch for: The framework range is narrower than larger partners. Companies that need PCI DSS, CMMC, or international frameworks will need a second provider. 3. Neutral Partners Best for: Growing companies that need managed GRC across SOC 2, ISO 27001, CMMC, and FedRAMP without hiring an internal compliance team. Neutral Partners, based in Miami, runs a managed GRC model. It builds and documents the compliance program, tests it through internal audits, and then hands off to the relevant independent assessor: a CPA firm for SOC 2, a certification body for ISO 27001, or a C3PAO for CMMC. It never issues the certificate itself, which keeps the independence question simple. Its framework coverage leans toward regulated and government-adjacent work, including CMMC, FedRAMP, PCI DSS, HIPAA, and HITRUST. That makes it worth a look for defense suppliers and companies selling to the public sector. Watch for: Vanta isn’t its main focus. Ask for recent Vanta deployment examples in your framework before signing. 4. Kobalt.io Best for: Small and mid-sized businesses that want Vanta plus managed security operations. Canada-based Kobalt.io markets itself as one of Vanta’s leading global service partners. Its Vanta practice covers policy and control development inside the platform, custom control mapping where standard controls do not fit, and an applicability review of Vanta’s tests. The broader appeal is its managed security services, which suit companies that want compliance and security operations from the same provider. 5. AuditPeak Best for: Startups that want a readiness and audit-preparation partner focused narrowly on SOC 2. AuditPeak focuses on SOC 2 audit readiness for early-stage companies working in

[Read more](https://axipro.co/best-vanta-deployment-service/)

- [ISO-27001](https://axipro.co/category/iso-27001-2/)

- September 29, 2026

#### [ISO 27001 Consultant vs. Software: Which Is Faster?](https://axipro.co/iso-27001-consultant-vs-software/)

Compliance software collects the evidence. A consultant builds the system that evidence is meant to prove. That’s the real difference in the ISO 27001 consultant vs software decision, and most teams only figure it out after they’ve bought one and realized they still need the other. Below, we compare what each route covers, where it breaks down, and what it costs you in time, money, and your team’s hours. Short version: software on its own works for a small group of companies. For most SaaS and tech scale-ups trying to get an enterprise deal over the line, consultant-led implementation on a compliance platform is the faster and safer path to a certificate. Quick Answer: Consultant, Software, or Both? Software-only works if you already have an in-house security lead who’s taken a company through ISO/IEC 27001 before and has the time to own the project. Consultant-only still makes sense if you run mostly on-premise or legacy systems that platforms barely integrate with. For everyone else, which means most cloud-native companies under a few hundred people, a hybrid works best: a platform to handle evidence and monitoring, and a consultant to build the management system and stand behind it in front of an auditor. Here’s why. What an ISO 27001 Consultant Handles ISO/IEC 27001:2022 is a management system standard. Clauses 4 to 10 cover how you run information security, and Annex A lists 93 controls you pick from based on risk. Almost none of it is box-ticking. Most of it comes down to judgment calls about your business, and that’s what you’re paying a consultant for. Scoping, Gap Analysis and Risk Assessment Scope is the first decision you make, and the most expensive one to get wrong. Go too wide and you’ll spend months on controls for systems no customer asks about. Go too narrow and the certificate won’t get through the procurement review it was supposed to pass. A consultant scopes around the deals you’re trying to close, runs a gap analysis, and builds a risk assessment based on your real assets and threats. That’s the document auditors dig into hardest. ISMS Documentation and Policy Writing The standard asks for a specific set of documents: the ISMS scope, information security policy, risk assessment and treatment methodology, Statement of Applicability, risk treatment plan, and evidence of competence, monitoring, internal audit, and management review. A consultant writes these around how your company works day to day, instead of how a template imagines it works. Auditors check whether you follow your own procedures, so a mismatch shows up fast. Internal Audit and Certification Audit Support You need an internal audit before certification, and Clause 9.2 says the auditor has to be objective and impartial. In a small company, the people who built the ISMS can’t credibly audit it, so most teams outsource it through ISO 27001 internal audit services. A good consultant also gets your team ready for the Stage 1 and Stage 2 audits, joins the conversations that matter, and handles corrective actions if the auditor raises nonconformities. What ISO 27001 Compliance Software Handles Compliance automation platforms, often called GRC platforms, have changed how cloud-native companies get certified. They’re very good at the repetitive, evidence-heavy side of the work. Automated Evidence Collection and Continuous Control Monitoring The platform plugs into your cloud provider, identity provider, code repos, HR system, and device management tools, then pulls evidence on its own. It’ll flag an unencrypted storage bucket, an ex-employee who still has access, or a laptop without disk encryption. For technical controls, that saves weeks of screenshots and spreadsheet tracking. Policy Templates and Annex A Control Mapping Most platforms come with a policy library and map each control to the ISO 27001 clauses and Annex A. You get a starting point and a clear view of which controls have evidence and which don’t. Auditor Access and Ongoing Compliance Tracking Auditors can log in and review evidence themselves, which cuts down fieldwork. After you’re certified, dashboards show when controls slip between surveillance audits, so you aren’t rebuilding evidence from scratch every year. Where Each Approach Falls Short Neither route covers everything by itself. The good news is that the ways each one fails are predictable, so you can plan around them. Limits of Compliance Automation Platforms A platform can tell you a control is failing. It can’t decide your scope, run your risk assessment, write a policy that matches your operations, convince your CTO to change the offboarding process, or explain to an auditor why you excluded a control from your Statement of Applicability. Templates can also make you feel further along than you are. A dashboard at 90% can hide an ISMS that won’t survive Stage 1, because the missing 10% is the management system itself. Insider Note: The Stage 1 problem we see most on software-only projects is a risk assessment copied straight from the platform’s default risk library. The risks are generic, the scores are almost identical, and nothing ties back to the company’s own assets. Auditors notice within minutes, and it weakens the Statement of Applicability that’s built on it. The other problem is ownership. Software assumes someone inside the company will drive the project. At most startups that’s a CTO or ops lead who already has a full-time job, and the subscription renews whether the work gets done or not. Limits of a Consultant-Only Approach A consultant working without automation spends billable days on things a platform does for free, like chasing screenshots, updating evidence trackers, and collecting the same proof again before every surveillance audit. You pay more and wait longer. You also end up with a program that’s only accurate on the day it’s handed over. Once the engagement ends, the evidence goes stale and year-two surveillance turns into a scramble. ISO 27001 Consultant vs Software: Side-by-Side Comparison Factor Consultant only Software only Hybrid (consultant + platform) Time to audit readiness 3 to 6+ months Highly variable; depends on internal expertise As little as 6 weeks for well-scoped

[Read more](https://axipro.co/iso-27001-consultant-vs-software/)

- [AI Security](https://axipro.co/category/ai-security/)

- September 27, 2026

#### [Uzbekistan AI Regulation 2026: Law ZRU-1115 Explained](https://axipro.co/uzbekistan-ai-regulation/)

Uzbekistan regulates artificial intelligence through two documents. The first is Law ZRU-1115, signed on 21 January 2026. It amends existing legislation to define AI, stops anyone from basing decisions about people’s rights on AI output alone, and fines companies that process personal data unlawfully with AI. The second is the set of Ethical Rules approved by Order No. 3787, in force since 17 June 2026, which spell out what developers, implementers, and users actually have to do. Uzbekistan hasn’t passed a standalone AI act, and its rules don’t sort systems into risk tiers or require conformity assessments. The framework is short and blunt, and it’s already enforceable. Below we walk through what each document requires, who it applies to, how it stacks up against the EU AI Act, and what a company using AI in Uzbekistan should do next. Uzbekistan AI Regulation at a Glance (TL;DR) Instrument Date What it does Who it binds Law ZRU-1115 Signed 21 January 2026 Defines AI in law, sets general rules for AI-built information resources and systems, bans legally significant decisions based only on AI, adds fines for unlawful AI processing of personal data State bodies, organizations, website owners, anyone processing personal data with AI Order No. 3787 (Ethical Rules) Registered 14 March 2026, in force 17 June 2026 Sets eight mandatory ethical principles and lists rights and obligations for developers, implementers, and users Individuals and companies developing, implementing, or using AI in Uzbekistan Law No. 1125 (Personal Data amendments) Adopted 26 March 2026 Limits data localization to biometric, genetic, and local telecom user data, and allows cross-border transfers under conditions Personal data operators, including AI providers AI Strategy until 2030 (RP-358) 14 October 2024 Sets national targets for AI adoption, infrastructure, and skills Government bodies What Is Law ZRU-1115? The law’s official title is a mouthful: “On making additions and changes to certain legislative acts of the Republic of Uzbekistan in connection with the regulation of relations arising from the use of artificial intelligence.” Put simply, it’s an amending law. Instead of creating a new AI code, it writes AI into laws that were already on the books. When It Was Signed and When It Took Effect The Legislative Chamber of the Oliy Majlis adopted the bill on 12 August 2025, and the Senate approved it on 1 November 2025. President Shavkat Mirziyoyev signed it on 21 January 2026. You can read the official text in Lex.uz, Uzbekistan’s national legislation database. The law set out the principles and the penalties. The day-to-day detail arrived later with the Ethical Rules, which came into force on 17 June 2026. For compliance planning, treat mid-June 2026 as the point when the whole framework started applying. Why Uzbekistan Amended Existing Laws Instead of Passing a Standalone AI Act Uzbekistan wants more AI, not less. Its national strategy sets numeric targets for adoption, investment, and local computing capacity, and a heavy EU-style act would have worked against them. So lawmakers kept it light. They defined AI, drew two hard lines (human control over decisions that affect people’s rights, and protection of personal data), and left the Ministry of Digital Technologies to fill in the rest through secondary rules. Businesses get less legal certainty, and the government gets to move faster. Which Laws ZRU-1115 Changes For businesses, two amendments matter most. The Law “On Informatization” (ZRU-560-II, 2003) now contains a legal definition of AI, a new article on using AI in information resources and systems, duties for website owners, and updated powers for the ministry in charge. The Code on Administrative Liability now includes an offense for processing and spreading personal data unlawfully using AI. The Legal Definition of Artificial Intelligence in Uzbekistan Under the amended Law “On Informatization,” AI is a set of technological solutions that imitate human cognitive functions, including learning on their own and solving problems, and that produce results on specific tasks comparable to what a person could do. That’s deliberately broad. It covers generative AI, machine learning classifiers, recommendation engines, and most agentic systems. The Ethical Rules add a narrower term, the AI system: software built on AI that can find, collect, store, analyze, process, evaluate, and use data, and make decisions on its own based on that data. If your product makes a decision from data, or shapes one, assume it counts. Key Rules Introduced by Law ZRU-1115 General Principles for Using AI in Information Systems and Resources The new article in the Law “On Informatization” starts from harm. Information resources created with AI, and information systems running on AI, must not harm people’s life, health, freedom, honor, or dignity, or violate their other inalienable rights. The standard is short and open-ended. It gives regulators something to enforce against without saying in advance what counts as harm. Principle-based rules like this deserve to be taken seriously precisely because the edges are undefined. Human Oversight: No Decisions on Rights and Freedoms Based Solely on AI Most coverage leads with this provision, and it’s easy to see why. When someone makes a legally significant decision that affects human rights and freedoms, they can’t rely only on conclusions produced by AI systems or AI-built information resources. AI can feed into the decision, but a person has to make it. That applies to loan denials, benefit eligibility, hiring rejections, licensing outcomes, and disciplinary action. In each case, someone needs to look at the AI output and own the final call. Insider Note: In AI governance engagements, teams rarely struggle to show that a review step exists. What they struggle to show is that the reviewer could disagree, and sometimes did. If a human clicks “approve” on every AI recommendation and nobody ever records an override, auditors will see automation with a signature on top. Build the override path and log when people use it, starting on day one. Powers of the Authorized State Body (Ministry of Digital Technologies) ZRU-1115 makes the Ministry of Digital Technologies the authorized state body for AI. Among its new jobs, it’s

[Read more](https://axipro.co/uzbekistan-ai-regulation/)

WhatsApp us