Why ISO 27001 and SOC 2 Are No Longer Enough for Fast-Growing Tech Companies
- Rachel Gentry
- Feb 9
- 4 min read
Updated: Mar 16
There’s a quiet but dangerous assumption creeping into growing technology and regulated organisations:
If we’ve got ISO 27001 and SOC 2, we should be covered.
On paper, that sounds reasonable. In practice, it’s increasingly false — and in some cases, commercially dangerous.
Compliance Theatre: A Growing Supply-Chain Risk
Security frameworks were never designed to be proof of safety. They were designed to show how you manage risk. When organisations confuse the two, they often don’t realise there’s a problem until a deal is already on the line.
A Real Example: Certified, but Still Under Forensic Scrutiny
Recently, I’ve seen a client with both SOC 2 and ISO 27001 certification asked to undergo a pre-contract third-party risk management forensic audit.
Not a high-level questionnaire. Not a tick-box supplier assurance form. A detailed examination of how controls actually operate day to day.
The customer’s position was clear:
“The certifications tell us you have a framework. We need to understand how you run it.”
That request wasn’t driven by mistrust. It was driven by increased concern about third-party and supply-chain risk — and by the reality that certifications alone no longer provide enough confidence.
This is the gap many organisations don’t realise they’re exposed to.
Compliance Theatre: A Supply-Chain Liability
Frameworks like ISO 27001, SOC 2, Cyber Essentials, CAF, and NIST RMF are increasingly being used as entry tickets, not reassurance.
Once you’re inside a commercial conversation, buyers are asking harder questions:
How are risk decisions made when controls fail?
What evidence exists that controls are operating, not just designed?
How do you manage exceptions, pressure, and growth?
Who actually owns third-party and supply-chain risk?
A checkbox approach can get you through procurement. It often fails under forensic scrutiny.
And when customers are accountable for their supply chain, they can’t afford to accept surface-level assurance from yours.
Auditors and Customers: Converging Expectations
This shift mirrors what’s already happened in audit standards like ISA 315 and regulatory regimes such as SOX.
The emphasis has moved from:
“Do controls exist?”
to:
“Are risks understood, decisions documented, and controls demonstrably effective in practice?”
Customers are now applying that same logic to suppliers — particularly in regulated, critical, or data-sensitive environments.
If your security posture only works when nobody asks follow-up questions, that’s a problem.
Frameworks: Protecting You Only When They Reflect Reality
Used properly, frameworks such as:
ISO 27001
SOC 2
NIST RMF
CAF
ETSI EN 303 223
do something extremely valuable: they make risk ownership, trade-offs, and priorities explicit.
Used badly, they create a false sense of safety — one that collapses the moment a customer asks to see how controls actually work under pressure.
That collapse is what turns a “nice-to-have” certification into a fatal commercial flaw.
AI and Third-Party Risk: Accelerating the Problem
AI governance is exposing weak security governance faster than anything else.
Many organisations claim alignment to NIST AI RMF, while:
Using third-party AI tools without clear risk ownership
Lacking supplier assurance for AI-enabled services
Being unable to explain how AI risk decisions are made or reviewed
When customers start joining the dots between AI use, third-party exposure, and supply-chain risk, superficial assurance won’t survive scrutiny.
The Uncomfortable Truth About Security
Good security and AI governance is not:
Perfect control
Zero risk
Endless documentation
It is:
Defensible judgement
Evidence of operation, not intention
Proportionate controls that scale with growth
Leadership that can explain decisions when challenged
Certifications help. But when customers start looking through them instead of at them, only real governance holds up.
If This Feels Uncomfortably Familiar
If you’re:
Certified, but still facing deep client scrutiny
Being asked to evidence control operation, not just design
Exposed to third-party or supply-chain risk you can’t clearly articulate
Unsure whether your posture would survive a forensic review
That’s not failure — it’s a signal that the market has moved.
A checkbox approach might once have been enough. In today’s environment, it can quietly undermine trust, slow deals, or kill them entirely.
Taking Action: What You Can Do
So, what can you do?
Assess Your Current Frameworks: Are they truly reflective of your operations?
Engage in Continuous Improvement: Regularly review and update your security measures.
Foster Open Communication: Encourage dialogue with clients about their concerns and your strategies.
Invest in Training: Ensure your team understands the importance of real governance over mere compliance.
If you want to sense-check whether your current approach would stand up to serious third-party scrutiny before a customer asks, that conversation is far easier to have early.
Conclusion: The Path Forward
In conclusion, navigating the complexities of security frameworks in a fast-paced, regulated environment is no small feat. But with the right approach, you can turn compliance from a potential liability into a robust asset.
Remember, it’s not just about having the certifications. It’s about demonstrating that you can manage risk effectively and transparently.
By focusing on genuine governance, you can build trust and confidence with your clients, ensuring your organisation not only survives but thrives in this demanding landscape.
---
For more insights on how to enhance your security framework, visit RTG Commercial Services Ltd.
Comments