Skip to main content
GullySystem

ISO 27001, SOC 2 and Privacy Law Readiness

This service covers the technical half of preparing for ISO 27001, SOC 2 and privacy law compliance. It includes access reviews, logging, encryption, backups and filed evidence. Certification itself is decided by an auditor.

Share your requirements

Technical controls auditors ask about

Who has access, and why

A current list of accounts and roles per system, reviewed on a set date, with removals carried out and recorded.

Logs that go back far enough

Login, privilege and data-export events are kept for the period your standard expects, on systems where entries cannot be quietly edited.

Encryption and key handling

Data is encrypted in transit and at rest. Keys sit in a proper store, not a configuration file or a chat thread.

Backups that were restored

The restore is run, timed and written down. An untested backup is only an assumption.

Change and release records

Who approved a change, what went to production and when, taken from your existing pipeline instead of typed up later.

What sits outside our work

  • We do not issue certificates and are not your auditor or certification body
  • Policy wording, contracts and legal position belong with your consultant or lawyer
  • A standard is not a product. Most of the effort is your team changing habits
  • No pass can be promised for any audit

Where privacy law sits apart

ISO 27001 and SOC 2 are standards you choose to pursue. Privacy laws such as the GDPR concern personal data, and whether and how they apply is a question for your legal adviser. Your adviser reviews the configuration before launch, and again when a local rule changes. Much of the technical work overlaps. Three items are particular to privacy law: recording why data was collected, acting on a deletion request, and knowing which vendor holds a copy.

FAQ

Frequently asked questions

Can GullySystem certify us to ISO 27001?

No. A certificate comes from an accredited body after its own audit, and the auditor must be independent of whoever did the work. We do the engineering that audit will examine, plus the evidence pack.

Does privacy law apply to our business?

That is a question for your legal adviser. What we can show is which personal data your systems hold, where it flows and who else keeps a copy. That is the fact base your adviser needs.

Our customer sent a security questionnaire. Do we need full certification to answer it?

Usually not. Many questionnaires can be answered with evidence: a recent test report, an access review, a restore record and a written policy. Certification becomes useful when several large buyers send the same questionnaire each year.

Talk to us

Tell us what you need.

Share your requirements and one of our engineers will come back to you within one business day.

  • No obligation
  • A reply within one business day
  • Your details stay private

Start with your requirements

Seven short steps that tell us what you need. An engineer reads them before getting in touch.

Share your requirements