ISO 9001 ↔ SOC 2
7 canonical controls in Keel's library satisfy clauses of both ISO 9001 and SOC 2. Implement each once, attach the evidence once, and it counts toward each standard. The overlap is the work you don't repeat.
Controls that satisfy both
| Canonical control | ISO 9001 clauses | SOC 2 clauses |
|---|---|---|
| Risk assessment & treatment A documented process to identify, analyze, evaluate, and treat information security risks on a defined cadence. | 6.1 | CC3.1, CC3.2 |
| Change management Changes to systems and software are requested, reviewed, tested, approved, and tracked. | 6.3 | CC8.1 |
| Third-party / vendor risk management Due diligence, contractual safeguards, and ongoing monitoring of vendors that handle your data. | 8.4 | CC9.2 |
| Security awareness training Ongoing security awareness training for all personnel, with completion tracking. | 7.2, 7.3 | CC1.4 |
| Document & records control Documented information is created, approved, versioned, and controlled; records are retained and protected. | 7.5 | CC5.3 |
| Internal audit program A risk-based internal audit program evaluates conformity and effectiveness at planned intervals. | 9.2 | CC4.1 |
| Management review Leadership reviews management-system performance at planned intervals and drives improvement decisions. | 9.3 | CC4.1 |
Clause identifiers (ISO 9001 and SOC 2) are referenced factually for mapping. Keel is not affiliated with or endorsed by the bodies that publish these standards. Control descriptions are Keel's own; a framework's full authored control count is on its framework page.
Why this is one project, not two
On a crosswalk-native model, SOC 2 mostly lights up controls you already built for ISO 9001. You're not re-uploading the same screenshot for a second audit. You apply the framework and see the genuine delta worth working. That's the whole idea behind collect once, comply everywhere.