Does ISO 27001 cover me for SOC 2?

No. The subject matter overlaps heavily, so most of the controls an auditor looks for will already be running, but SOC 2 is an independent auditor attestation covering a period of time. Holding ISO 27001 turns a SOC 2 into evidence mapping rather than new control work; it does not remove the audit.

Do I need to comply with a law in a country where I have no office?

Often yes. EU GDPR, UK GDPR and India’s DPDP Act all reach organisations with no local establishment if they offer goods or services to people in that country. Physical presence is not the test.

What is the difference between required and expected?

Required means a law binds you if you sell into that market. Expected means no law compels it but procurement will ask, and in practice you may not win business without it. SOC 2 in the United States is the clearest example of the second.

Toolkit

Cross-Border Compliance Gap Check

Selling into another country rarely means starting again. Most of what you already run counts, and the real question is which parts do not transfer. Tell us what you hold and where you are going.

What do you already hold?

Include anything in progress if you expect it to complete.

Where do you want to sell?

Pick every market you are entering or already trading in.

Select at least one market to see the gap.

Markets covered

United KingdomEurope

Cyber Essentials is mandatory for many public sector contracts and is cheap enough that buyers treat its absence as a signal.

European UnionEurope

EU GDPR applies to you even without an EU establishment if you offer goods or services to people in the EU. UK adequacy is a separate question from being UK-compliant.

GermanyEurope

TISAX is effectively the entry ticket for automotive supply chains and is not satisfied by ISO 27001 alone, though the two overlap heavily.

United StatesAmericas

There is no federal equivalent of GDPR, but enterprise procurement will ask for SOC 2 and often will not proceed without it. State privacy laws apply separately.

IndiaAsia Pacific

DPDP reaches organisations outside India that offer goods or services to people in India. Being designated a Significant Data Fiduciary adds an India-based DPO, independent audit and impact assessments.

AustraliaAsia Pacific

Essential Eight is mandatory for federal government and widely used as the yardstick elsewhere. It is measured in maturity levels, so "we do Essential Eight" is not a yes or no answer.

SingaporeAsia Pacific

PDPA requires a named Data Protection Officer whose contact details are made public. Financial services carry additional MAS technology risk expectations.

United Arab EmiratesMiddle East

Government and critical sector work is governed by the Information Assurance Standards, with emirate and sector variants. The federal data protection law adds privacy duties on top.

Saudi ArabiaMiddle East

NCA Essential Cybersecurity Controls bind government and critical national infrastructure, and are increasingly pushed down to their suppliers. Financial services follow the SAMA framework instead.

Why we built this

Compliance is sold country by country, which suits the people selling it. An organisation entering three markets is usually quoted three projects, when most of the underlying work is the same evidence presented three ways.

What genuinely differs is narrower than it looks, and it is almost always the privacy side rather than the security side: lawful basis, individual rights, breach notification, where data may sit and who may hold it. Security controls travel well. Privacy law does not.