What you have to do before the auditor shows up, in plain words, and which of it Engarde does for you. Tick items as you go: your progress stays in this browser.
Of these 37 items, Engarde does 6 for you and helps with 19. The other 12 are yours, and no tool will do them for you.
For ISO 27001, the ISMS scope: which entities, sites, teams and systems. For SOC 2, the system description, which Trust Services Criteria apply (Security is mandatory), and Type I or Type II.
ISO 27001 · 4.3
Someone accountable for security, roles written down, and leadership visibly committed. Auditors ask who decides and who signed.
ISO 27001 · 5.1, 5.3, A.5.2 SOC 2 · CC1.2, CC1.3
Devices, SaaS apps, data stores, and who owns each.
Engarde builds the SaaS, OAuth app, browser extension and device part of the inventory from what it observes. Servers, cloud accounts and data stores stay on your list. See how →
ISO 27001 · A.5.9 SOC 2 · CC6.1
List the risks, score them, decide what you treat and how, and keep the result up to date.
Engarde measures the human side of the risk: who clicks, who shares files publicly, which accounts lack MFA. The method and the register are yours.
ISO 27001 · 6.1.2, 6.1.3, 8.2 SOC 2 · CC3.1, CC3.2
For each of the 93 Annex A controls: applicable or not, why, and how it is implemented.
ISO 27001 · 6.1.3
A top-level information security policy plus the topic policies auditors expect: access, passwords, devices, data, remote work.
Engarde starts you from a curated set of policy areas that you edit, translate and version, instead of a blank page. See how →
ISO 27001 · A.5.1 SOC 2 · CC5.3
Each person has read and accepted the policies that apply to them, with a date you can show.
Employees sign off in Engarde, reminders go out to those who have not, and the record is kept per person and per version. See how →
ISO 27001 · A.5.1, A.6.2 SOC 2 · CC1.1, CC2.2
What people may and may not do with company devices, accounts, AI tools and data.
Acceptable use is one of the policy areas Engarde ships, and it goes through the same sign-off.
ISO 27001 · A.5.10 SOC 2 · CC2.2
At least yearly and after significant changes, with a record of what changed.
Every edit is versioned with its history, so the review trail exists. Scheduling the review is yours.
ISO 27001 · A.5.1, A.5.37 SOC 2 · CC5.3
Background checks proportionate to the role and allowed by local law.
ISO 27001 · A.6.1 SOC 2 · CC1.4
Security responsibilities and confidentiality in employment contracts and NDAs.
ISO 27001 · A.6.2, A.6.6 SOC 2 · CC1.1
Security awareness for all staff, at onboarding and on an ongoing basis, plus role-specific training.
Short training in Slack and on the web, spaced quizzes, and modules per role (executives, admins, developers), run as campaigns. See how →
ISO 27001 · A.6.3 SOC 2 · CC1.4, CC2.2
Neither framework names phishing simulations, but auditors read them as proof that awareness is effective, not just delivered.
Email phishing simulations with landing pages, scheduling and reporting, plus SMS and voice scenarios. See how →
ISO 27001 · A.6.3, A.8.7 SOC 2 · CC2.2, CC3.2
Who completed what, when, and how they did. This is the first thing asked for.
Every training, quiz and phishing event is logged per employee and exports to CSV for the auditor. See how →
ISO 27001 · A.6.3, 7.2 SOC 2 · CC1.4
Employees know how to report a suspicious email or an incident, and actually do it.
Employees report incidents to the Engarde assistant in Slack, and those reports land in your alerts inbox. A suspicious email can also be forwarded for an instant verdict.
ISO 27001 · A.6.8 SOC 2 · CC2.2, CC7.3
Accounts closed, devices and access returned, on the day someone leaves.
Engarde flags Google Workspace accounts unused for 90 days, which is where forgotten leavers show up. The offboarding itself is yours. See how →
ISO 27001 · A.5.11, A.6.5 SOC 2 · CC6.2
Multi-factor authentication on every account that touches company data, admins first.
Engarde lists Google Workspace accounts without MFA, admins without MFA, and whether MFA is enforced, and nudges each person to fix it. See how →
ISO 27001 · A.8.5 SOC 2 · CC6.1
An access control policy, and admin rights limited to the people who need them.
Engarde flags more than three super-admins in Google Workspace and groups open to outsiders. See how →
ISO 27001 · A.5.15, A.8.2 SOC 2 · CC6.1, CC6.3
At least quarterly for critical systems: who has access, and should they still.
Dormant accounts and the OAuth apps each person has granted access to, with a revoke button. Reviewing your own systems stays with you. See how →
ISO 27001 · A.5.18 SOC 2 · CC6.2, CC6.3
A request and approval for every new access, and a process that removes it.
ISO 27001 · A.5.16, A.5.17 SOC 2 · CC6.2
A simple scheme (public, internal, confidential) and labels people actually use.
Engarde trains people on the classification scheme. Defining it and labelling data are yours. See how →
ISO 27001 · A.5.12, A.5.13 SOC 2 · C1.1
No public links to internal files, no calendars or mailboxes quietly forwarded outside.
Engarde detects public and external Drive shares, calendars shared outside, and mail auto-forwarding in Google Workspace, and asks the owner to fix it. See how →
ISO 27001 · A.5.14, A.8.12 SOC 2 · CC6.7
The cloud services your people use, including the ones nobody approved.
OAuth apps connected to Google Workspace, AI notetakers in meetings, and AI tool usage once you connect your gateway logs or AI vendor admin keys. See how →
ISO 27001 · A.5.19, A.5.23 SOC 2 · CC9.2
Due diligence on critical suppliers, security clauses in contracts, and a yearly review.
ISO 27001 · A.5.20, A.5.21, A.5.22 SOC 2 · CC9.2
A record of processing, a legal basis for each use, and a way to answer data subject requests (GDPR).
ISO 27001 · A.5.34 SOC 2 · P1.0
Disk encryption, screen lock, firewall and supported OS on every device that touches company data.
The Engarde agent checks encryption, screen lock, firewall, OS version and more on macOS, Windows and Linux. It is a posture check, not a full MDM. See how →
ISO 27001 · A.8.1, A.8.24 SOC 2 · CC6.8
Updates applied on a schedule, on laptops, servers and applications.
Engarde shows laptops with automatic updates off and outdated OS or browsers. Servers and applications are outside it. See how →
ISO 27001 · A.8.8 SOC 2 · CC7.1
Anti-malware on endpoints, and people who recognise a malicious attachment.
The agent checks that antivirus is on, and training and phishing simulations cover the human half. See how →
ISO 27001 · A.8.7 SOC 2 · CC6.8
Extensions can read every page and every password field. Know which ones are installed and what they can do.
The Engarde browser extension reports installed extensions and their permissions across the team, ranked by risk. See how →
ISO 27001 · A.8.19 SOC 2 · CC6.8
Security-relevant logs collected, kept, and actually looked at.
Engarde monitors the sources it connects to (Google Workspace audit, devices, extensions) and raises alerts. Your servers and applications need their own logging.
ISO 27001 · A.8.15, A.8.16 SOC 2 · CC7.2
Backups of what matters, kept apart, and a restore you have actually tried.
ISO 27001 · A.8.13 SOC 2 · A1.2
Code review, separate environments, and approved changes to production.
Engarde trains developers on secure coding (OWASP). Your change process stays yours. See how →
ISO 27001 · A.8.25, A.8.32 SOC 2 · CC8.1
A written plan, who to call, and how incidents are triaged, handled and learned from.
Engarde collects alerts and employee reports in one inbox with a status on each. The plan and the response are yours.
ISO 27001 · A.5.24, A.5.25, A.5.26 SOC 2 · CC7.3, CC7.4
How the business keeps running when a key system or supplier goes down, tested at least once.
ISO 27001 · A.5.29, A.5.30 SOC 2 · A1.3
SOC 2 Type II looks at 3 to 12 months of operation, and ISO surveillance audits come back every year. Evidence has to accumulate, not be assembled the week before.
Training, phishing and policy evidence accumulates on its own and exports when asked. Evidence for the other controls is yours to gather.
ISO 27001 · 9.1 SOC 2 · CC4.1
Check the system against the standard before the auditor does, and have leadership review the results.
ISO 27001 · 9.2, 9.3 SOC 2 · CC4.1
An accredited certification body for ISO 27001, a CPA firm for SOC 2. Book early: lead times run to months.
ISO 27001 · 9.2 SOC 2 · CC4.1
Training, phishing, policy sign-off and the evidence behind them, running from the first week, with the export your auditor asks for.
Request early accessA working list, not the standard: it does not replace ISO/IEC 27001:2022, its 93 Annex A controls, or the AICPA Trust Services Criteria, and it is not legal advice. References are to ISO/IEC 27001:2022 and the 2017 Trust Services Criteria. Engarde’s SaaS checks cover Google Workspace today.