Help centre
Choosing a Framework or Report: Who Is Asking, and What Answers Them
Start from the request, not the framework. If a customer names a document, that document is the answer: a SOC 2 report comes from a licensed CPA firm, an ISO/IEC 27001 certificate from an accredited certification body, a PCI DSS Report on Compliance from a QSA. If they ask a question rather than name a document, a penetration test, your policies or a readiness programme may be enough. SecureRoot runs the testing and readiness work for each of these; it does not issue the reports or certificates.
About this help article
Written by SecureRoot Risk Advisory LLP.
Start here
Three questions before choosing anything
- 01
Who is asking?
A customer, a tender, a payment partner, a regulator or your own board. Each has its own reasons and accepts different evidence.
- 02
What exactly did they ask for?
Copy the words from the questionnaire, clause or email. 'SOC 2 Type 2', 'ISO 27001 certified', 'annual penetration test' and 'evidence of security controls' are four different requests.
- 03
By when?
A request due before a contract signature points to the fastest evidence that answers it; a renewal next year leaves room for a full programme.
Lookup
Who is asking, and what usually answers them
| Who is asking | What usually answers them | Who issues or signs it |
|---|---|---|
| A US enterprise customer asking for a SOC 2 report | A SOC 2 report, Type 1 or Type 2. US enterprise buyers tend towards SOC 2 | A licensed CPA firm |
| A UK, European or global tender naming ISO 27001 | An ISO/IEC 27001 certificate with a scope covering the service | An accredited certification body |
| A Gulf or Australian buyer | Often either SOC 2 or ISO 27001; the specific customer decides | A licensed CPA firm or an accredited certification body, respectively |
| A customer asking for both, or a pipeline that will | One combined programme, planned once | Each report or certificate by its own issuer, as above |
| A customer or questionnaire asking for a recent penetration test | A test of the systems they will use, with a verified retest and, where asked, an attestation letter | The testing firm |
| An acquiring bank or card brand | PCI DSS validation: a self-assessment questionnaire or a Report on Compliance, depending on the level your acquirer confirms | A self-assessment questionnaire: your own officer. A Report on Compliance: a QSA |
| A US healthcare customer | A signed business associate agreement and evidence of HIPAA safeguards | No one certifies it: there is no HIPAA certification, and the US Department of Health and Human Services does not certify organisations as compliant |
| A customer processing EU personal data | GDPR obligations, evidenced by your records, contracts and controls | No one: there is no universal GDPR certification |
| Indian personal data | The DPDP Act's obligations | No one: there is no DPDP certificate and no accredited DPDP certification body |
| An Indian regulated entity such as an NBFC | What the regulator's own instrument says. The RBI's 2026 Directions ask for testing by trained, independent experts | Trained, independent testers; CERT-In empanelment is not required by those Directions, but a tender clause that names an empanelled auditor needs one |
| A customer asking about privacy management, AI governance or business continuity | ISO/IEC 27701, ISO/IEC 42001 or ISO 22301 respectively | An accredited certification body |
If the request does not name a document, ask the requester what they will accept before committing to a programme.
Scope boundaries
What this does not cover
- SecureRoot is not a CPA firm, an accredited certification body or a QSA, and is not CERT-In empanelled. It signs none of the reports, certificates or attestations of compliance listed above.
- These are common patterns, not rules. The customer, tender or regulator decides what it accepts.
- No framework or report guarantees that a customer will accept it or that you comply with a law.
Primary Sources
Where the Figures on This Page Come From
Figures and requirements above are taken from the sources below, linked to the primary text wherever one exists rather than to a summary of it.
- System and Organization Controls: SOC Suite of Services
AICPA and CIMA · Link checked 2026-11-13
Related
Services and help that go with this
- ISO 27001 vs SOC 2
The full comparison, including cost and timeline.
- SOC 2 Type 1 vs Type 2
Which report type a customer is likely to want.
- Who can sign your security report
CPA firm, certification body, QSA or empanelled auditor.
- Responding to enterprise customer security requirements
How to answer the questionnaire once you know what answers it.
- Planning a combined SOC 2 and ISO 27001 programme
When both are needed.
- PCI DSS scope reduction and SAQ types
Which SAQ applies, and how to shrink scope.
- VAPT for banks, NBFCs and fintechs
Testing for Indian regulated entities.
- Independent assessor involvement
When the CPA firm, certification body or QSA comes in.
Not sure which one they mean?
Send SecureRoot the request as you received it. We will tell you which report, certificate or test answers it, and who has to sign it.