In short
ISO 27001, ISO 27701 and SOC 2 ask for much of the same evidence: a risk register, a supplier register, incidents, policies, access reviews and change records. Keeping each record once and mapping it to every framework that asks for it removes duplicate work and the drift between copies. Each auditor still assesses against its own clauses and criteria.
Where do the frameworks overlap?
Most of the work is the same work, described in different words. In SOC 2 terms, these registers carry most of the Common Criteria:
- Risk register: ISO 27001 risk assessment and treatment; SOC 2 CC3.1 to CC3.4 and CC9.1.
- Supplier register: ISO 27001 supplier relationships; SOC 2 CC9.2; and in ISO 27701, the register of PII processors.
- Incident register: ISO 27001 incident management; SOC 2 CC7.3 to CC7.5.
- Policies and documents: ISO 27001 documented information; SOC 2 CC1.1, CC2.2, CC5.2 and CC5.3.
- Access reviews: ISO 27001 access control; SOC 2 CC6.1 to CC6.3.
- Change register: ISO 27001 change management; SOC 2 CC8.1.
What goes wrong with separate copies?
When each framework keeps its own spreadsheet, the copies drift. A supplier is reassessed for SOC 2 but not for ISO 27001. A risk is closed in one register and still open in another. The auditor finds the mismatch, and the finding is about your records, not your controls.
Separate copies also multiply the review work. Every quarterly review, sign-off and reminder happens three times, by people who could be fixing the gaps instead.
What still needs its own record?
Sharing registers does not merge the frameworks. Each still needs the artefacts its auditor asks for: the ISO 27001 Statement of Applicability, the PIMS Statement of Applicability for ISO 27701, and for SOC 2 the system description, control matrix, Type II testing and exceptions. Essential Eight maturity is assessed against its own criteria, strategy by strategy, so it sits alongside the registers instead of inside them.
How to move to one set of registers
- Pick the framework with the strictest record for each register, usually ISO 27001 for risks and suppliers, and make that the master.
- Merge duplicates by hand once. Decide which copy is correct, record why, and retire the other.
- Tag each record with the clauses and criteria it evidences, so every auditor can filter to their own view.
- Give each register one owner and one review cycle.
Where Whitesec One fits
Whitesec One is built on this idea. Each framework has its own workspace laid out like the standard, and risks, suppliers, incidents, policies, access reviews, changes and evidence live on one set of registers that ISO 27001, ISO 27701 and SOC 2 each map to their own clauses and criteria. The Essential Eight workspace keeps maturity assessments, a patch register and evidence alongside. Whitesec ID in Jakarta and Whitesec AU in Perth use it with the clients they support.
Sources
- ISO/IEC 27001:2022 Information security management systems: Requirements, ISO
- 2017 Trust Services Criteria (with revised points of focus, 2022), AICPA & CIMA
- Essential Eight maturity model, Australian Signals Directorate
Regulation moves. Check the official text before relying on a date or an obligation.