₦airaland Forum

The use of Software as a Service (SaaS) has changed how businesses manage daily operations. Companies now rely on cloud-based applications for customer management, accounting, communication, data storage and business automation.

However, as organisations move more of their operations online, questions about information security become increasingly important.
Customers want to know how a software provider protects their information, manages access and responds to security incidents. For SaaS companies targeting enterprise customers, these questions can influence purchasing decisions and long-term business relationships.

One framework that helps service organisations assess their security controls is SOC 2. Understanding SOC 2 readiness can help SaaS businesses organise their security practices and prepare for an independent examination.

What Is SOC 2?

SOC 2 is an attestation framework developed by the American Institute of Certified Public Accountants (AICPA). It evaluates controls relevant to service organisations using five Trust Services Criteria.

These criteria include:

Security: Protecting systems and information against unauthorised access.

Availability: Maintaining systems and services according to relevant operational commitments.

Processing Integrity: Ensuring that system processing is complete, valid, accurate, timely and authorised.

Confidentiality: Protecting information designated as confidential.

Privacy: Managing personal information throughout its lifecycle.

Security is the common criterion. The other categories are included when they are relevant to the organisation's services and commitments.

SOC 2 is not a certification. An independent CPA firm conducts the examination and issues the report.

Why Should SaaS Companies Consider SOC 2 Readiness?

A SaaS company may have a reliable product, but enterprise customers often want additional information about its security practices before adopting the service.

SOC 2 readiness helps organisations review their controls and identify areas that require improvement.

Here are some important reasons to begin preparation.

1. Enterprise Customers Expect Security Transparency

Large organisations often assess software suppliers before signing contracts. Their security teams may ask about access management, data protection, incident response and vendor oversight.

Having documented security procedures and organised evidence makes it easier for a SaaS company to respond to these questions.

2. Better Management of Internal Security Controls

As a business grows, employees use more applications, systems and integrations. Without clear responsibilities, access permissions and security reviews can become difficult to manage.

A structured control environment helps teams understand their responsibilities and follow consistent procedures.

3. Improved Audit Preparation

Preparing for an independent examination requires supporting documentation. Organisations need to identify relevant controls, assign owners and maintain evidence.

Starting early gives teams time to address gaps instead of collecting everything at the last minute.

4. Stronger Vendor Oversight

SaaS businesses depend on external providers for hosting, payment processing, analytics and other services.

Reviewing these suppliers helps organisations understand how third parties may affect information security and service availability.

SOC 2 Type 1 and Type 2: What Should You Know?

There are two main types of SOC 2 examination.

SOC 2 Type 1 evaluates whether the organisation's controls are suitably designed at a specific point in time.

SOC 2 Type 2 evaluates both control design and operating effectiveness over a defined period.

A Type 1 report provides an assessment of control design on the examination date. A Type 2 report provides information about how controls operated during the examination period.

The appropriate examination depends on business requirements, customer expectations and organisational readiness.

Important Steps for SOC 2 Preparation

Preparing for SOC 2 involves more than writing policies. Organisations need to understand their systems, implement relevant controls and maintain supporting records.

Define the Examination Scope

Identify the services, systems, infrastructure and business processes that will be included in the examination.

A clear scope helps teams understand which controls are relevant and who needs to participate in preparation.

Review User Access

Access to sensitive information and production systems should be limited according to job responsibilities.

Companies should maintain access approval records, review privileged accounts and remove unnecessary permissions when employees leave or change roles.

Document Security Procedures

Organisations should maintain policies covering relevant areas such as access management, incident response, change management and vendor oversight.

These policies should reflect actual business practices and be reviewed when processes change.

Establish Incident Response Procedures

Security incidents require timely reporting, investigation and follow-up.

Employees should know how to report incidents, while responsible teams should understand their roles in investigation, escalation and documentation.

Maintain Vendor Assessment Records

External providers should be reviewed according to the services they provide and the risks they introduce.

Supplier records may include security assessments, contractual responsibilities, service information and periodic review results.

Why Evidence Collection Is Often Challenging

One of the common difficulties during SOC 2 readiness is collecting evidence from different departments.

For example, IT may maintain access records, HR may manage employee training documents, and security teams may hold incident reports and monitoring information.

When these records are spread across different tools, preparing for an examination can become time-consuming.

Useful evidence may include:

1. User access review records.
2. Approved security policies.
3. Incident response documentation.
4. Employee training records.
5. Change management approvals.
6. Vendor assessment records.
7. System monitoring information.
8. Backup and recovery test results.

Evidence should be accurate, relevant and traceable to the control it supports. Maintaining it as part of everyday operations makes the preparation process more manageable.

Can Compliance Software Make SOC 2 Preparation Easier?

Managing compliance through spreadsheets, emails and separate folders may work for a small organisation, but it can become difficult as the business grows.

Compliance software can help teams organise control records, assign responsibilities, manage evidence and track preparation activities.

For example, AnnexOps provides compliance software that supports SOC 2 Trust Services Criteria tracking, control mapping, evidence management and audit preparation.

SaaS businesses planning their preparation can refer to this detailed guide on SOC 2 readiness for SaaS companies. It explains audit scope, control ownership, Trust Services Criteria and evidence collection in greater detail.

It is important to remember that compliance software supports preparation activities; it does not issue SOC 2 reports. The independent CPA firm remains responsible for conducting the examination and issuing the report.

Final Thoughts

Security is an ongoing responsibility for every SaaS business that handles customer information.

SOC 2 readiness gives organisations a structured way to review relevant controls, identify gaps and prepare for independent assurance.

Companies that define responsibilities, maintain evidence and review their security practices regularly can make the process more manageable.

For growing SaaS businesses, building these practices early can support customer confidence and create a stronger foundation for long-term operations.

Artificial intelligence is becoming an important part of business operations. Companies now use external AI models, APIs, cloud-based AI services and AI-powered software to improve productivity and develop new products.

However, using third-party AI services also creates risks. These may involve data privacy, cybersecurity, inaccurate AI outputs, technical documentation and regulatory responsibilities.

For businesses using AI in Europe, the EU AI Act makes it important to understand these risks and establish proper governance processes.

Why Is AI Vendor Risk Management Important?

Many companies depend on external suppliers for their AI capabilities. For example, a software company may integrate an external language model into its application, while another business may use an AI-powered recruitment or customer service tool.

If an AI vendor changes its model, experiences a security incident or provides incomplete documentation, the organisation using that service may also be affected.

A structured third-party AI risk management process helps businesses identify these dependencies and maintain better oversight.

1. Identify All Third-Party AI Systems

The first step is to create an inventory of AI systems used across the organisation.

Include external AI APIs, third-party models, cloud services and AI-powered applications used by different departments.

Record the vendor name, intended purpose, internal owner, data processed and relevant technical documentation.

This helps businesses understand where their AI dependencies exist.

2. Understand Provider and Deployer Responsibilities

The EU AI Act distinguishes between providers and deployers.

A provider develops an AI system, has it developed, and places it on the market or puts it into service under its own name or trademark.
A deployer uses an AI system under its authority for professional activities.

For example, a company using an external AI chatbot internally may act as a deployer. A software company integrating an external model into its own commercial product may have provider responsibilities for the resulting system, depending on the circumstances.

Businesses should assess their role for each AI system instead of assuming that the vendor is responsible for everything.

3. Review Vendor Documentation

Companies should request relevant technical documentation, model limitations, instructions for use and information about system updates.

Article 53 of the EU AI Act also establishes documentation requirements for providers of general-purpose AI models, including information made available to downstream providers integrating those models into their own AI systems.

Having access to relevant documentation helps organisations understand the technology they depend on.

4. Assess Security and Data Privacy

Third-party AI services may process personal data, customer information and confidential business records.

Businesses should review:

1. Data storage and processing locations.
2. Security and access controls.
3. Use of customer data for model training.
4. Subprocessors and external service providers.
5. Incident reporting procedures.
6. Relevant GDPR responsibilities.

These checks help organisations understand the risks associated with sharing data with external AI suppliers.

5. Establish Clear Vendor Agreements

Supplier agreements should define responsibilities for technical documentation, security incidents, cooperation and relevant service changes.

Article 25(4) of the EU AI Act addresses certain relationships involving providers of high-risk AI systems and third parties supplying components, tools, services or processes used in those systems.

Where applicable, written agreements must specify the information, technical access, capabilities and assistance needed by the provider to fulfil its obligations.

6. Monitor AI Vendors Continuously

Vendor risk assessment should not end after onboarding.

AI models and services can change over time. Businesses should review important updates, reassess risks and maintain records of supplier-related decisions.

They should also establish a clear process for handling incidents involving external AI providers.

Can AI Compliance Software Help?

Managing AI inventories, supplier information, risk assessments and regulatory documentation through separate spreadsheets can become difficult.

AI compliance software can help organisations centralise these activities.

For example, AnnexOps supports AI governance operations through AI system inventory, regulatory risk classification, obligation mapping, documentation management and evidence tracking.

Businesses interested in these capabilities can explore AnnexOps AI compliance software.

Conclusion

Third-party AI services can help businesses innovate, but they also introduce responsibilities that organisations should not overlook.
Effective AI vendor risk management requires supplier due diligence, clear responsibilities, technical documentation, security reviews and continuous monitoring.

Businesses that understand their AI supply chains and maintain proper governance records will be better prepared to manage third-party risks under the EU AI Act.

What is the biggest challenge your organisation faces when managing external AI vendors: documentation, data security, risk assessment or ongoing monitoring?

Why Businesses Need Both Information Security and AI Governance

As businesses adopt artificial intelligence, managing information security alone may not address every risk associated with AI systems. Companies must protect sensitive data while also considering how AI tools are developed, deployed, and monitored.

This is where ISO 27001 vs ISO 42001 becomes an important comparison. ISO/IEC 27001 focuses on information security management, while ISO/IEC 42001 provides a framework for managing AI-related risks and responsibilities.

Organizations that handle confidential information and use AI in their operations may need to consider both standards. Understanding their differences helps management teams plan appropriate controls, assign responsibilities, and maintain supporting documentation.

What Is ISO 27001?

ISO/IEC 27001 specifies requirements for an Information Security Management System (ISMS). It helps organizations establish processes for identifying information security risks and managing the confidentiality, integrity, and availability of information.

For example, a software company may store customer records, employee information, source code, and business documents across cloud applications. Without defined access controls and risk management procedures, unauthorized access or accidental data loss could disrupt operations.

An ISO 27001-based management system helps the organization evaluate these risks, select appropriate controls, document responsibilities, and review the effectiveness of its security processes.

Typical activities include access management, security risk assessments, incident response, supplier reviews, internal audits, and continual improvement.

The standard is relevant to organizations across industries. Certification is an option for businesses that want independent confirmation of their management system against the standard's requirements.

What Is ISO 42001?

ISO/IEC 42001:2023 specifies requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System (AIMS).

Unlike ISO 27001, which focuses on information security, ISO 42001 addresses organizational governance of AI systems. Its scope includes how organizations manage AI-related risks and opportunities during the development, provision, and use of AI.

Consider a company using an AI assistant to respond to customer queries. Protecting customer data is important, but the company must also consider inaccurate responses, inappropriate outputs, human oversight, and whether the tool is being used for its intended purpose.

ISO 42001 gives organizations a structured way to establish AI policies, assign responsibilities, assess impacts, document decisions, and monitor AI systems over time.

It can be relevant to AI developers, software providers, and businesses that use AI in their internal operations.

ISO 27001 vs ISO 42001: Main Differences

Main purpose: ISO 27001 focuses on information security management, while ISO 42001 focuses on AI management and governance.

Management system: ISO 27001 uses an Information Security Management System (ISMS). ISO 42001 uses an Artificial Intelligence Management System (AIMS).

Primary risk focus: ISO 27001 addresses risks such as unauthorized access, data loss, and security incidents. ISO 42001 addresses AI-related risks, impacts, and governance responsibilities.

Typical activities: ISO 27001 covers security controls, incident management, and information risk assessments. ISO 42001 covers AI risk assessments, impact considerations, and AI lifecycle oversight.

Scope: ISO 27001 applies to information security within the defined management-system scope. ISO 42001 applies to AI management within its defined scope.

Certification: Certification is available for both standards.

Can Organizations Implement Both Standards Together?

Yes. Organizations can coordinate the two management systems where their processes overlap. Both standards follow a harmonized management-system structure, which creates opportunities to align governance activities without treating the standards as identical.

For example, a business may use a shared document-control process, coordinate internal audit planning, and assign clear ownership for risk assessments. It can also maintain separate assessments where information security risks differ from AI-specific risks.

Consider a SaaS company that uses a third-party AI model to summarize customer support conversations. Its security team evaluates data access, retention, and vendor security. Its AI governance team reviews the model's intended use, output quality, potential impacts, and monitoring requirements.

The teams can coordinate supplier reviews and evidence collection, but they should document the distinct risks and decisions relevant to each management system.

The same principle applies to regulatory obligations. The EU AI Act establishes legal requirements for AI systems and relevant operators within its scope. The official EU AI Act text on EUR-Lex should be consulted when determining applicable obligations.

Implementing or obtaining certification against ISO 42001 does not, by itself, establish compliance with every applicable EU AI Act requirement.

How to Start Implementing ISO 27001 and ISO 42001

Businesses can begin by reviewing their current governance processes instead of creating separate documentation systems immediately.

1. Define the scope. Identify the information assets, business processes, AI systems, and organizational units covered by each management system.

2. Assess risks separately. Evaluate information security threats and AI-related risks using suitable methods for each standard. Record the assessment results and assign ownership for treatment actions.

3. Review existing controls. Determine which policies, vendor reviews, incident processes, and documentation workflows can support both systems. Identify areas that require additional AI governance measures.

4. Establish accountability. Assign responsibility for approvals, risk reviews, monitoring, training, and corrective actions. Involve technical teams and management so that governance decisions reflect how systems are actually used.

5. Maintain evidence. Keep relevant records of assessments, decisions, approvals, reviews, and corrective actions. Schedule periodic reviews to account for changes in business operations and technology.

This approach helps organizations coordinate related activities while retaining the separate requirements of each standard.

How AnnexOps Supports AI Governance and Compliance Workflows

Managing AI governance alongside information security can become difficult when system inventories, risk assessments, regulatory obligations, and supporting evidence are scattered across different tools.

AnnexOps is AI compliance software designed to help organizations manage EU AI Act and GDPR-related workflows. It supports activities such as AI system discovery, risk classification, obligation mapping, documentation generation, evidence management, and ongoing monitoring.

For teams exploring how information security and AI governance can work together, the AnnexOps guide to ISO 27001 and ISO 42001 explains the relationship between the two standards and considerations for coordinating their implementation.

AnnexOps can help teams organize relevant governance activities and documentation alongside their wider compliance processes. Organizations should still evaluate their own requirements, implement appropriate controls, and obtain qualified advice where necessary. Software supports compliance work but does not replace organizational accountability or independent certification.

A Practical Next Step

The right starting point depends on the risks a business faces today. Organizations with an established ISMS can review how their existing processes support AI governance. Businesses already using AI can begin by creating an inventory of AI systems and identifying who owns the associated risks.

From there, teams can map relevant requirements, identify gaps, and build a manageable implementation plan.

Explore the AnnexOps ISO 27001 and ISO 42001 guide to understand how both standards can fit into a coordinated approach to information security and AI governance.