For SaaS teams with SOC 2 done

Your ISO 27001 gap report, built from the SOC 2 you already have

Import your SOC 2 controls from Vanta, Drata or a spreadsheet. Onceproof shows which ISO 27001 controls you already cover, which need tweaks and which are new work.

Pre-launch. Free gap report for waitlist members.

ISO 27001 gap report · Annex A

Annex A controls

Already covered

6166%

Need tweaks

Truly new work

Delta from your SOC 2 controls

A
A.5.15 Access control
Covered by CC6.1 and CC6.2. Existing test reused.
Covered
A
A.5.24 Incident management planning
CC7.3 covers it. Add ISO roles and reporting steps.
Tweak
A
A.8.9 Configuration management
CC8.1 partial. Document secure baselines.
Tweak
A
A.5.7 Threat intelligence
No SOC 2 control maps here. New control needed.
New

SOC 2 was the hard part. Why does ISO 27001 feel like starting over?

Every new framework arrives as its own project, even though most of the controls already exist and already work.

“I really don't want to build the same controls twice.”

You spent a year getting SOC 2 right. Now ISO 27001 is next, and every guide starts from a blank ISMS.

“One US prospect wants SOC 2, two others keep asking about ISO 27001. I'm one person.”

Deals are waiting on certifications. You can't afford months of rework to tell sales what's actually missing.

“Security, compliance and internal audit all test the same control.”

The same access review gets sampled three times a year by three teams, each with its own evidence folder.

“Our crosswalk has 400 rows and nobody trusts which column is current.”

Evidence links go stale, test dates live in comments, and one bad paste breaks the whole mapping.

From SOC 2 to an ISO 27001 plan in an afternoon

Onceproof starts from what you've already built, not from a blank template.

1
Import your SOC 2 controls
Pull controls, policies and evidence from Vanta or Drata, or upload your control spreadsheet. Nothing needs rewriting first.
2
Pick ISO 27001 and read the delta
Each Annex A control is marked covered, needs a tweak, or new, with the SOC 2 control that maps to it and why.
3
Close only the genuinely new gaps
Work through the short list of tweaks and new controls. Your existing controls stay as they are.
4
Test once, share the result everywhere
Log a test once with its evidence. The result counts toward SOC 2 and ISO 27001, and every team sees the same record.

One control library. Every audit draws from it.

Write, test and evidence each control once. Onceproof keeps the mapping, so the spreadsheet doesn't have to.

See exactly what ISO 27001 adds on top of SOC 2

Onceproof maps your imported SOC 2 controls against Annex A and clauses 4–10, then sorts every requirement into covered, tweak or new.

ISO 27001 delta · Annex A

ISO control	SOC 2 source	Status
A.5.15 Access control	CC6.1, CC6.2	Covered
A.8.13 Information backup	A1.2	Covered
A.5.24 Incident planning	CC7.3	Tweak: add roles
A.5.7 Threat intelligence	None	New

One test counts toward every audit

Each control holds one test record and one set of evidence. When the access review is done, it's done for SOC 2 and ISO 27001 alike.

Keep Vanta or Drata. Onceproof works alongside.

Import controls and evidence from the tool you already pay for. Onceproof adds the cross-framework layer without replacing your automation.

Item	Count	Status
SOC 2 controls	84	Imported
Evidence files	312	Linked
Policies	17	Imported

One record of who tested what, and when

Security, compliance and internal audit log tests against the same control, so nobody re-samples work that's already been done this period.

Control	Tested by	Date	Used in
CC6.1 Access review	Priya, Security	Mar 14	SOC 2, ISO
CC7.2 Monitoring	Internal audit	Feb 28	SOC 2, ISO
A.5.7 Threat intel	Priya, Security	Apr 2	ISO

Built for the one person holding the compliance program together

Onceproof is for you if

You already passed SOC 2
You have a working control set and evidence, and ISO 27001 is the next ask from European prospects or customers.
You're a team of one, or close to it
You're the security or compliance lead at a 50–300 person B2B SaaS company, and every new framework lands on your desk.
Several teams test the same controls
Security, compliance and internal audit each run their own testing, and you want one shared record instead.

It's probably not for you if

You haven't started SOC 2 yet. Get that done first, then come back.
You need NIS2 or other frameworks mapped today. Only SOC 2 and ISO 27001 are supported at launch.
You run a large internal audit department that needs full enterprise GRC workflows.

How Onceproof compares to the usual way of getting ISO 27001

Most teams either stretch a crosswalk spreadsheet or hire a consultant. Here's where each one lands.

Criteria	Onceproof	Crosswalk spreadsheet	ISO 27001 consultant
Reuses your existing SOC 2 controls	Yes	Partly	Often rebuilds from scratch
Shows covered, tweak and new per control	Yes	Manual, if kept current	Partly
One test result shared across audits	Yes	No	No
Records who tested what and when	Yes	No	No
Knowledge stays in your company	Yes	Partly	Leaves with them
Predictable cost	$500/month flat	Free, plus your time	$15k–$40k per project

One flat price. Every framework included.

Adding a framework never adds to your bill. Start with a free gap report and see your ISO 27001 delta first.

Gap Report

See what ISO 27001 adds to your SOC 2 before committing.

Free

Import SOC 2 controls from Vanta, Drata or CSV
Full ISO 27001 gap report
Covered, tweak and new for every control
Export the report as PDF or CSV

Recommended

Onceproof

The full control library, flat price, unlimited frameworks.

$500/ month

Everything in Gap Report
Unlimited frameworks (NIS2 coming soon)
One test record shared across audits
Evidence library linked to every control
Test log for security, compliance and audit
Ongoing import sync from Vanta or Drata

Pre-launch pricing. Join the waitlist and we'll confirm before you're charged anything.

Questions compliance leads ask us

We already pay for Vanta or Drata. Why add another tool?

Onceproof doesn't replace them. Keep using Vanta or Drata for SOC 2 automation and evidence collection. Onceproof imports those controls and evidence, maps them to ISO 27001 and keeps one test record per control across audits. That way you don't rebuild the ISO 27001 work separately.

Which frameworks are supported?

SOC 2 and ISO 27001 at launch. NIS2 is coming soon. We'd rather tell you that plainly than show a long list of half-finished mappings. The flat price covers every framework we add.

Why $500 a month?

It's one flat price for unlimited frameworks, so a new audit never means a new fee. For comparison, an ISO 27001 consultant typically costs $15k–$40k for a single project. The free gap report lets you check the value before paying anything.

How is this different from the free Secure Controls Framework?

SCF is a great raw mapping, but it's a giant spreadsheet. Onceproof applies the mapping to your actual controls. It gives you a gap view, a testing workflow and evidence attached to each control.

How long does setup take?

If your SOC 2 controls are in Vanta, Drata or a clean spreadsheet, the import and first ISO 27001 gap report are meant to take an afternoon, not a quarter. Messier spreadsheets need some cleanup during import.

Where is our data stored, and are you certified?

We're pre-launch and don't hold our own certifications yet. Before you import anything, we'll share our hosting region, subprocessor list and security overview. You can delete your workspace and its data at any time.

Will my ISO 27001 auditor accept this?

Onceproof organizes your controls, mappings and evidence. The audit itself is still done by your certification body. The gap report shows its reasoning for each mapping, so you can review and adjust it before the auditor sees anything.

Stop building the same controls twice

Import your SOC 2 controls and see exactly what ISO 27001 adds. Waitlist members get the gap report free.