1
Gap assessment
Two to three weeks. We review your current state against ISO 27001 Annex A or the SOC 2 Trust Services Criteria, and hand you a prioritised gap-closure plan.
ISO 27001 · SOC 2 Type II audit readiness
Get ISO 27001 / SOC 2 audit-ready
Pre-audit readiness for ISO 27001 and SOC 2 Type II. We run the gap assessment, draft the ISMS and Statement of Applicability, build the control-evidence framework, and support you through the audit. The certification body issues the certificate; we get you ready and keep the programme current.
From $2,500 Quoted up front after a free scoping call
Gap analysis
ISMS scoped
Evidence ready
For the auditor
Audit-supported
SOC 2 / ISO 27001
Legal team
GTC's privacy team
Data-protection counsel
10,747+ clients11 attorneys5 offices
10,747+ clients11 attorneys5 offices10+ years
IIPLA Top IP Consultancy 2026Upwork · Top Rated Plus
Trusted by founders and brands worldwide
How it works
How audit readiness works with GTC
2
Documentation + controls
Four to twelve weeks, depending on starting maturity. We draft the Information Security Policy and Statement of Applicability, build the control framework and risk register, and set the evidence cadence with your team.
3
Audit support
The independent auditor runs Stage 1 (documentation) then Stage 2 (operational) after a three-to-six-month evidence period. We brief the auditor and support you through both stages.
What it costs
Quoted by scope and security maturity
ISO 27001 / SOC 2 Audit Support starts from $2,500. Every ISO 27001 / SOC 2 engagement is quoted up front after a free scoping call, once the framework and your current security maturity are known. Our fee is scoped by company size and starting maturity, and whether you need ISO 27001, SOC 2, or both. Independent auditor and certification-body fees are passed through at cost.
What's included
- Gap assessment against ISO 27001 Annex A or the SOC 2 Trust Services Criteria
- Information Security Policy and Statement of Applicability drafted to your systems
- Risk-register methodology and an initial register built with your team
- Control-evidence framework: who owns each control and on what cadence
- Independent auditor selection and briefing for Stage 1 and Stage 2
- Stage 2 operational-audit support across the three-to-six-month evidence period
- Optional retainer for annual surveillance audits post-certification
- Pre-audit readiness (ISO 27001 or SOC 2 Type II)
- Quoted by scope
- Pre-audit readiness (ISO 27001 and SOC 2)
- Quoted by scope
- Independent auditor + certification body
- At cost
- Annual surveillance support
- Quoted by scope
No GTC fee is committed until the framework is confirmed and you have approved the quote. The certificate is issued by the certification body or CPA firm, not by GTC.
Get started
Get your ISO / SOC 2 readiness scoped
Tell us about your systems and which framework your customers are asking for. A GTC attorney will scope the readiness work and email a quote after a free scoping call.
No payment required Reply within 1 business dayA GTC attorney reviews it & sends a flat-fee quote.
-
01Brand details
-
02Documents
-
03Your details
Not sure whether you need ISO 27001, SOC 2, or both? Tell us where your enterprise buyers are — EU and APAC tend to ask for ISO 27001, US buyers for SOC 2. We confirm the right framework before any fee is committed.
Brand details
1
The legal entity seeking certification.
2
ISO 27001 is the international information-security standard; SOC 2 is the US attestation report on security controls. Pick all that apply.
3
For example just starting, building your controls, or ready for the audit — this shapes the engagement.
4
Which systems, products, or business units need covering? A rough headcount and customer base helps us size it.
5
If you have an audit firm or platform (Drata, Vanta, a CPA firm), name it. Leave blank if not yet chosen — we can recommend one.
Why GTC
Why route audit readiness through GTC
Legal team
GTC's privacy team
Data-protection counsel
Attorney-led
ISO 27001 or SOC 2, scoped first
ISO 27001 is the international, certificate-based ISMS framework EU and Asia-Pacific buyers ask for. SOC 2 is the US, report-based Trust Services Criteria. We confirm which to prioritise — or both — before any fee is committed.
ISMS + Statement of Applicability drafted
We draft the Information Security Policy, the Statement of Applicability, and the control framework to ISO 27001 and SOC 2 expectations, and build the risk register with your team.
Evidence framework, not just paper
We build the control-evidence structure — who owns each control and on what cadence — and train your engineering and security teams to collect it, so the operational audit has what it needs.
Kept current, not just certified
Certification is a standing obligation. An optional retainer keeps you ready for annual surveillance audits, so there is no fire drill each year.
Your Customer Success Team
A dedicated team that owns your matter from start to finish.
Every GTC client gets a dedicated Account Manager and a Senior Account Manager who learn your business and stay with you from first email to final filing. They are named people who pick up the phone and already know your matter, so every step moves forward without delay.
Your Account Manager
Your day-to-day point of contact, who coordinates every matter, keeps things moving, and already knows your file. They have your full history, so you start every conversation where the last one left off.
Your Senior Account Manager
Senior oversight on strategy and escalations, stepping in as your needs grow, so every important detail stays on track.
A named person, on email or a call, at every step.
How we compare
GTC vs. a generic template or a big consultancy
| What you get | GTC | Online filing services | Doing it yourself |
|---|---|---|---|
| Framework scoped before you commit (ISO 27001 / SOC 2 / both) | |||
| ISMS, policies, and Statement of Applicability drafted to your systems | |||
| Control-evidence framework with named owners and cadence | |||
| Engineering and security teams trained to collect evidence | |||
| Independent auditor selected and briefed through Stage 1 and Stage 2 | |||
| Programme kept current for annual surveillance audits |
Framework scoped before you commit (ISO 27001 / SOC 2 / both)
GTC
Online filing services
Doing it yourself
ISMS, policies, and Statement of Applicability drafted to your systems
GTC
Online filing services
Doing it yourself
Control-evidence framework with named owners and cadence
GTC
Online filing services
Doing it yourself
Engineering and security teams trained to collect evidence
GTC
Online filing services
Doing it yourself
Independent auditor selected and briefed through Stage 1 and Stage 2
GTC
Online filing services
Doing it yourself
Programme kept current for annual surveillance audits
GTC
Online filing services
Doing it yourself
Timeline
From gap assessment to certificate
ISO 27001 typically lands in six to nine months; SOC 2 Type II in nine to twelve months, given the AICPA-required observation period.
-
Weeks 1–3
Gap assessment
We review your current state against ISO 27001 Annex A or the SOC 2 Trust Services Criteria, ending in a prioritised gap-closure plan.
-
Weeks 4–12
Documentation + controls
We build the Information Security Policy, Statement of Applicability, control framework, evidence cadence, and risk register with your team, and train your engineers to collect evidence.
-
Months 3–9
Audit support
The independent auditor runs Stage 1 (documentation), then Stage 2 (operational) after a three-to-six-month evidence period. The certificate is issued by the certification body, typically four to eight weeks later.
-
Annually
Surveillance support
An optional retainer keeps you ready for annual surveillance audits, so the programme stays current without a fire drill each year.
In their words
All your legal, in one place.
One accountable team across every practice, operating since 2016.
10,747+
Clients served
11
In-house attorneys
5
Global offices
10+
Years since 2016
ISO 27001 / SOC 2 FAQs
Frequently asked questions
ISO 27001 is international, certificate-based, and a broad ISMS framework — common from EU and Asia-Pacific enterprise customers. SOC 2 is US-centric, report-based, and a narrower set of Trust Services Criteria — common from US enterprise customers. Many companies need both. We discuss which to prioritise based on your customer base.
Ready to get audit-ready
Ready when you are.
Tell us about your systems and which framework your customers are asking for. We will confirm whether you need ISO 27001, SOC 2, or both, scope the readiness work, and quote up front after a free scoping call — then support you through to the audit.
