If The ecosystem is now reasonably mature, this is minor. In case you are starting from scratch, remediation can rival the ISO 27001 certification cost By itself. Handle the certificate as proof that good stability exists, not as a substitute for developing it. A Direct Implementer + Direct Auditor bundle https://calvant.com/blog/iso-27001-vs-soc-2-comparison-differences-benefits