For Example, you ought to insert confidentiality for the scope of your respective report if that criteria is related to your small business plus your SOC two report. A report having an observation time period ending 18 months back doesn’t Offer you Substantially assurance about latest controls. Request supplementary documentation https://calvant.com/blog/iso-27001-vs-soc-2-comparison-differences-benefits