Selling to US customers? Get ISO 27001 and SOC 2 ready in one project.
The UK-to-US Trust Programme: audit-ready for both frameworks in 8–12 weeks, plus the sales documents you need to answer American buyers with confidence.
The US deal is ready. Your security review isn't.
You've built a good product. A US prospect wants to buy. Then comes the security review:
- A 200-question spreadsheet due in a week
- “Do you have a SOC 2 report?”
- “Can you send your incident response plan?”
- “Who are your sub-processors?”
Then: Deals stall. Founders lose evenings to questionnaires. Buyers go quiet. And your UK and EU customers still ask for ISO 27001, so you end up facing two separate projects.
One project. Two frameworks. A US-ready sales pack.
We get you audit-ready for ISO 27001 and SOC 2 Type I together. The two frameworks share many controls, so we build them once and map them to both. We also write the documents US buyers ask for, using your real controls. You review and approve. You don't start from scratch.
What's in the programme
Core scope (included in every programme)
- ISO 27001 (2022) ISMS implementation
- SOC 2 Type I readiness
- Shared controls built once and mapped to both frameworks
- Risk assessment, policies and evidence guidance
- Vendor and sub-processor register, with a customer-ready sub-processor list
- Incident response plan and a 45-minute tabletop exercise, with a short report for buyers and auditors
- Renewal calendar and evidence checklist, so you stay audit-ready all year
- UK-led quality review before your audit
7 bonuses
Included with the programme to help you answer buyers immediately and pass external review.
Answer buyers fast
1. US security questionnaire answer pack
Ready-written answers to the 40+ questions US buyers ask most, based on your actual setup. Reuse them across deals.
2. First live questionnaire completed
Send us one real customer questionnaire (up to 150 questions). We complete it using your answer pack, and you review it before sending.
3. Sales security pack
Customer-facing trust page copy for your website, plus a one-page security summary you can attach to any email or proposal. Both describe only what you actually do.
Get help on live deals
4. Deal-support call
One 45-minute coaching call about one live deal. We look at what the buyer is asking, what to send and how to answer any gaps honestly. You get a written action list afterwards.
Take the worry out of the audit
5. Auditor shortlist and quote comparison
We suggest 2–3 independent auditors and compare their quotes, so you can choose with confidence.
6. £500 VAPT credit
Take £500 off a penetration testing sprint if you book within 90 days. One use per client.
Stay on track
7. 90 days of post-audit support
Email us up to 5 times in the 90 days after handover. Ask about auditor follow-ups, customer questions or changes to your setup. Replies within 2 working days.
How it works
| Step | What happens | Your time |
|---|---|---|
| 1. Kick-off (week 1) | A short call and a simple form about your tools and team. We confirm scope and owners. | About 1 hour |
| 2. Build (weeks 2–5) | We implement policies, risk assessment and controls for both frameworks. | Short check-ins |
| 3. Evidence (weeks 6–8) | We guide you through gathering evidence. Our UK-led team reviews it. We also write your bonus documents. | About 2 hours |
| 4. Audit-ready (weeks 8–10) | Final review and auditor briefing. | Short |
| 5. Handover and support (weeks 10–12+) | Everything is delivered in one shared folder. Then 90 days of email support. | As needed |
A short call and a simple form about your tools and team. We confirm scope and owners.
We implement policies, risk assessment and controls for both frameworks.
We guide you through gathering evidence. Our UK-led team reviews it. We also write your bonus documents.
Final review and auditor briefing.
Everything is delivered in one shared folder. Then 90 days of email support.
Total time from your team: about 4 hours over the programme. We do the writing. You review and approve.
One fixed bundle price
ISO 27001 and SOC 2 Type I readiness, plus all 7 bonuses.
ISO 27001 and SOC 2 Type I readiness, plus all 7 bonuses.
Auditor and certification fees are separate. We give you an estimate on your free call.
- • VAPT sprint: from £4,500 (£3,999 when added to the programme)
- • SOC 2 Type II support and observation: £15,499 (a follow-on after Type I)
Our promise: fix-for-free
If your auditor raises gaps within our scope, we fix them at no extra cost. Fixed price, no surprise charges for in-scope work.
We don't promise a certification, an audit result or a closed deal. Independent bodies make those decisions. We get you audit-ready and make you far better prepared.
It's for you if:
- You're a UK software or SaaS company with about 5 to 100 staff
- You're selling, or about to sell, to US customers
- You also sell to UK or EU buyers who ask for ISO 27001
- You want a credible security story without hiring a security team
- You want a fixed price and a small time commitment
It's not for you if:
- You only need one framework (see our individual ISO 27001 and SOC 2 sprints)
- You need a SOC 2 Type II report immediately. Type II needs an observation period.
- You need HIPAA, FedRAMP or PCI work. These are specialist regimes.
- You want us to run your compliance every month (we can discuss a monthly support plan)
- You have no internal owner who can spare a few hours
What's not included
We keep promises specific, so you know exactly what you're buying.
- Auditor and certification fees. You pay these directly to the auditor.
- The certificate and report themselves. A UKAS-accredited certification body issues the ISO 27001 certificate. An independent CPA firm issues the SOC 2 report. NodeForce is a consultancy and does not certify.
- The SOC 2 Type II observation period. This is a separate follow-on engagement.
- Legal advice and DPAs. Please use your solicitor for data processing agreements.
- Tasks your team must do, such as access reviews and restore tests. We give you the calendar and the evidence list.
- Urgent or out-of-hours incident response.
- Further questionnaires beyond the first one: available as an add-on, ask us for a quote.
Frequently asked questions
ISO 27001 or SOC 2: which do I need?
UK and EU buyers usually ask for ISO 27001. US buyers usually ask for SOC 2. This programme covers both in one project.
How long does it take?
You'll be audit-ready in 8–12 weeks. After that, timing depends on your auditor's availability.
Are audit fees included?
No. You pay them to the auditor and CPA firm directly. We give you an estimate on your free Gap Assessment.
Can I choose my own auditor?
Yes. We can also recommend independent auditors and compare quotes for you.
Will this guarantee I pass the audit or win the deal?
No, and no honest consultancy can promise that. We get you audit-ready. If your auditor raises gaps within our scope, we fix them at no extra cost.
What about SOC 2 Type II?
Type II needs an observation period after Type I. We offer Type II support as a follow-on for £15,499.
Do I need to write anything myself?
No. We write the documents from your audit information. You read, correct and approve.
How much of my team's time does this take?
About about 4 hours across the programme, mainly short forms, one tabletop exercise and one deal-support call.
What if I don't have a live US deal yet?
You can use the deal-support call and the live questionnaire when one comes up, within 90 days.
Do you work with Vanta or Drata?
Yes, we work with both.
What happens after the 90 days?
You keep everything. If you'd like ongoing help, we can discuss a monthly support plan.