Certification readiness

From evidence to SOC 2, ISO 27001 and ISO 42001

Enterprise buyers ask B2B companies for attestations and certificates. The evidence they are built on is the same evidence a company gathers to be understood: policies, controls, logs, vendor records, incident history. OpenDossier keeps that evidence in the Trust Workspace, maps it to the framework, tracks the gaps, and introduces an accredited auditor or certification body. We prepare; they certify.

Evidencepolicies, controls, logsin the Trust WorkspaceGap analysisagainst SOC 2,ISO 27001, ISO 42001Remediationowners, deadlines,evidence attachedAuditaccredited CPA firmor certification bodyContinuousmonitoringand re-certificationOpenDossier prepares and organises the evidence. The attestation or certificate is issued by the independent auditor or body.

SOC 2

AICPA Trust Services Criteria: security, availability, processing integrity, confidentiality, privacy. Type I reports on design at a point in time; Type II on operating effectiveness over a period, typically three to twelve months.

Attestation report issued by a licensed CPA firm; not a certificate.

Readiness from US$8,000; CPA firm fees separate

ISO/IEC 27001:2022

Information security management system: scope, risk assessment and treatment, Statement of Applicability against the 93 Annex A controls, internal audit, management review, continual improvement.

Certificate issued by an accredited certification body after stage 1 and stage 2 audits; three-year cycle with surveillance audits.

Readiness from US$12,000; certification body fees separate

ISO/IEC 42001:2023

AI management system: AI policy, roles, impact assessment, data and model lifecycle controls, transparency, human oversight, incident handling; the first certifiable AI management standard.

Certificate issued by an accredited certification body; bodies' accreditation for 42001 is still being extended, check availability in your market.

Readiness from US$15,000; certification body fees separate

ISO/IEC 27701

Privacy information management: extends the ISMS with controls for PII controllers and processors; the 2019 edition builds on ISO 27001, and a revised edition was published in 2025, so confirm the version your certification body audits against.

Certificate issued by an accredited certification body.

Readiness from US$10,000 alongside ISO 27001; body fees separate

Check your readiness

Tick what is in place. An indication, not an assessment.

How a programme runs

  1. Evidence inventory

    What exists in the Trust Workspace, what integrations can collect (identity, cloud, HR, ticketing), what is missing.

  2. Gap analysis

    Against the framework's criteria or clauses; a list with owners and deadlines.

  3. Remediation

    Policies, controls and records put in place; evidence attached as it is produced.

  4. Readiness review

    A mock audit by an OpenDossier assessor; residual gaps closed.

  5. Auditor introduction

    An accredited CPA firm or certification body you choose, or one we introduce; scoping with them; the evidence pack in their format.

  6. Continuous

    Monitoring keeps evidence current for surveillance audits and the next Type II period.

The boundary, plainly

OpenDossier does not issue SOC 2 reports or ISO certificates, is not a CPA firm or a certification body, and does not guarantee that an auditor will issue either. Readiness fees are for preparation; auditor and certification-body fees are paid to them.

Start a readiness programme

Tell us the framework and the buyer who is asking.

Get started