How Wyra reached SOC 2 Type 1 and ISO 27001 within two months.
Wyra needed a SOC 2 Type 1 report first, with ISO 27001 close behind. We built its security programme across five areas, and within two months of kickoff Wyra had both: the auditor’s SOC 2 Type 1 report and ISO 27001 certification. Wyra has since come back to us for its Type 2.
GTM intelligence for cloud partners.
Wyra builds the go-to-market intelligence layer for cloud partners, SaaS companies and system integrators, from ecosystem signals to outreach with human judgment on every conversation.
Its SOC 2 Type 1 report and its ISO 27001 certificate both cover the Wyra AI Platform.
What Wyra needed.
On the day of the kickoff call, Wyra’s founder asked us to go ahead with both, to put SOC 2 first and to finish as early as we could.
- 1
A SOC 2 Type 1 report on the Wyra AI Platform, as the first priority.
- 2
Four Trust Services Criteria categories in that report: Security, Availability, Confidentiality and Privacy.
- 3
ISO/IEC 27001:2022 certification, close behind the report.
What we did, step by step.
We built its security programme across five areas and kept our team on call around the clock, so a question from Wyra’s engineers or from the auditor never waited for the next working day.
SOC 2 Type 1
- 01Scoping
We sent Wyra a scoping form the same day as the kickoff call, covering the system boundary, the criteria, infrastructure, people and contractor access, providers and existing policies. Several answers were already filled in from the call, so Wyra’s team could check and correct them instead of starting from scratch.
- 02Evidence list
We turned the scope into one evidence request checklist of 49 items across ten areas, from governance, risk and access control to secure development, vendors and business continuity, with a shared folder structure to match.
- 03Providers
We took the cloud and service providers’ assurance reports onto our own list, so Wyra’s team didn’t have to chase them.
- 04Criteria
We mapped every item on the evidence list to the Trust Services Criteria it supports, and helped Wyra prepare the description of its system.
- 05Sign-off
Wyra’s leadership reviewed the documents and signed them off before they went to the auditor.
- 06Auditor
We coordinated with the auditor, a CPA firm, until its SOC 2 Type 1 report reached Wyra.
ISO 27001
- 07Policies
We wrote Wyra’s information security policy set, 32 policies in all, from access control and supplier security to secure development, incident management, backup and business continuity.
- 08ISMS records
We built the risk register, the Statement of Applicability, the information security objectives, a RACI matrix of who owns what, and the ISMS KPI metrics.
- 09Scope statement
We wrote a short guide to the scope statement with two worked examples. Wyra chose the one written to serve SOC 2 and ISO 27001 together.
- 10Certification
We coordinated with the certification body and took Wyra through its review of the draft certificate, up to the final ISO/IEC 27001:2022 certificate.
What Wyra has now.
- A SOC 2 Type 1 report on the Wyra AI Platform from the auditor, covering Security, Availability, Confidentiality and Privacy.
- ISO/IEC 27001:2022 certification for Wyra AI Inc., covering the design, development and delivery of the Wyra AI Platform, including GTM intelligence and multi-channel outreach (email, LinkedIn and calling), with the people, processes and technology behind it. Internal HR and finance systems and non-production environments sit outside the scope.
- 32 information security policies, with the risk register, the Statement of Applicability, the information security objectives, the RACI matrix and the ISMS KPI metrics.
- The scoping form, the 49-item evidence request checklist and its folder structure.
- A scope statement guide with two worked examples, including the one Wyra chose to serve SOC 2 and ISO 27001 together.
What you’ve delivered for Wyra has been truly exceptional — SOC 2 and ISO 27001 in such a short timeframe is no small feat. Couldn’t have asked for a better partner on this journey.
From March to May, and on to Type 2.
- March 2026
Kickoff. Wyra asked for SOC 2 first, and our scoping form went out the same day.
- April 2026
The auditor’s SOC 2 Type 1 report reached Wyra.
- May 2026
Wyra chose its scope statement and reviewed the draft certificate with us. Wyra AI Inc. was certified to ISO/IEC 27001:2022, within two months of kickoff.
- June – July 2026
Wyra came back for its SOC 2 Type 2, across the same four categories. The engagement letter went out in June and Wyra signed it in July.
- August 2026
The Type 2 kicked off, and the work is under way.
Let’s plan your SOC 2 and ISO 27001 together.
Tell us when your customers need to see a report and where your controls stand today. We will plan the two with you, drawing on 1,000+ audits and 300+ SOC 2 engagements.
Related Reading
SOC 2 vs ISO 27001
The decision guide for US-bound vs global-bound trust evidence.
Read moreISO 27001 Overview
The ISMS standard — the baseline certificate global buyers ask for.
Read moreSOC 2 Overview
The AICPA attestation US and global enterprise buyers ask for.
Read moreType 1 vs Type 2
Which report to get first, and when to go straight to Type 2.
Read moreCase Studies
Client stories from AI, healthtech and air cargo teams, and representative engagements by sector.
Read moreProof & Track Record
Every number we publish — explained, sourced and verifiable.
Read more