Compliance automation platforms and consultancy: what each contributes

Organisations preparing for ISO/IEC 27001 certification or a SOC 2 examination now have a choice of software platforms that automate parts of the work. They are often presented as an alternative to advisory support, and advisory firms sometimes present themselves as an alternative to software. In practice the two do different things, and many programmes use both. The useful question is which parts of the work each is suited to.

What the platforms typically do

Capabilities vary between products, but most compliance automation platforms offer a similar core set of features.

• Integrations with cloud infrastructure, identity providers, code repositories, device management and HR systems, used to test whether configured controls are operating and to flag drift
• Collection of evidence from those integrations, so that records such as access reviews or configuration settings can be produced without manual assembly
• Policy templates, control libraries mapped to common frameworks, and task tracking for implementation work
• Workflows for recurring activities such as security awareness training, employee onboarding checks and vendor reviews

For organisations whose systems are largely cloud-based and well supported by the available integrations, these features can reduce the administrative effort of gathering and maintaining evidence, both before the first audit and during the surveillance cycle that follows.

What still depends on judgement

ISO/IEC 27001:2022 requires an organisation to determine the scope of its Information Security Management System (ISMS), assess information security risks in its own context, decide how to treat them, and produce a Statement of Applicability justifying the inclusion or exclusion of each Annex A control [1]. It also requires leadership commitment, internal audit and management review [1]. A platform can provide templates and a register to record these decisions, but the decisions themselves depend on knowledge of the business, its customers, its contractual obligations and its risk appetite.

Several other areas typically fall outside automated tooling: environments that integrations cannot reach, such as on-premises systems or specialised operational technology; policies that need to reflect how the organisation actually operates rather than a generic template; controls that are procedural rather than technical; and sector-specific regulatory requirements that go beyond the framework itself.

Automation also does not change who makes the assurance decision. ISO does not certify organisations; certificates are issued by independent certification bodies [2]. In the UK, certification bodies offering accredited ISO/IEC 27001 certification are accredited by the United Kingdom Accreditation Service (UKAS) and must meet ISO/IEC 27006-1, which sets requirements for bodies auditing and certifying an ISMS [3]. A SOC 2 report is issued by a licensed CPA firm following an examination of controls relevant to security, availability, processing integrity, confidentiality or privacy [4]. Neither a platform nor an adviser issues a certificate or a SOC 2 report.

Where advisory support fits

Advisory support is most often used for scoping, risk assessment methodology, the Statement of Applicability, tailoring policies, designing processes for areas outside the platform's reach, internal audit, and preparing for the certification body's audit. Organisations with an experienced internal security or compliance lead may need little of this. Those without such a person often find that platform alerts and tasks are generated but not acted upon, because nobody has the time or the context to interpret them.

The balance also differs between frameworks. A SOC 2 examination reports on a service organisation's controls against the criteria for the categories it has chosen to include [4], while ISO/IEC 27001 places more emphasis on the management system clauses, such as context, leadership, risk treatment and continual improvement [1]. The effort needed outside the platform may therefore differ depending on which framework is being pursued.

Questions to help decide

1. How much of the environment is covered by the platform's integrations, and what would need to be evidenced manually
2. Which framework or frameworks are required by customers, and in which jurisdictions
3. Whether there is an internal owner with the knowledge and time to make risk and scope decisions and act on platform output
4. Whether the organisation needs help designing the management system itself, or mainly with maintaining evidence once it exists
5. How the platform's policy and control libraries would be adapted to reflect how the organisation actually works

The answers usually point to one of three arrangements: a platform supported by a capable internal team, advisory support without a platform, or a combination. Each can work. The choice depends on the environment, the frameworks involved and the people available, and it is worth revisiting once the first audit cycle is complete.

Independent advisory support is available to organisations using compliance platforms, and to those that are not, for scoping, risk assessment and preparing for ISO/IEC 27001 certification audits.