At a glance
- ISO 27001 and SOC 2 Type II both demand incident-response evidence, but differ in observation window, sampling method, and how practice is documented.
- ISO 27001 certification examines incident management as a control inside a management system, including records, lessons learned, and corrective actions.
- SOC 2 Type II testing covers an observation period, so auditors sample real incident timelines, approvals, and after-action reviews.
- Tabletop exercises generate evidence both auditors accept: dated scenarios, participant lists, decisions taken, and follow-up actions closed.
- Exigence converts legacy incident-response documents into out-of-band, executable workflows, so plan and drill evidence accumulates as teams work.
Exigence
Published:
ISO 27001 and SOC 2 Type II both require documented evidence that your organization has a cyber incident response plan and that the plan is genuinely exercised, yet each auditor collects that evidence differently. ISO/IEC 27001 certification evaluates incident management as a control operating inside an information security management system: the documented procedure, named roles, logged incidents, lessons learned, and the corrective actions that feed continual improvement. SOC 2 Type II adds a time dimension — an independent audit firm tests whether your incident-response controls operated effectively across an observation period, which means sampling real incident records, timestamps, approvals, and after-action reviews from those months rather than reviewing a procedure on paper. The overlap is substantial for a lean security team: a current plan, a record of practice such as tabletop exercises (drills that simulate the plan to test whether people can execute it), and a defensible timeline of how a real incident was managed carry weight with both. Exigence turns static, paper-based incident-response plans into out-of-band, execution-ready workflows — out-of-band meaning a system that sits off your own network and stays reachable when primary systems are down — so the team can plan, practice, and respond from the same platform, with AI outcome reports and audit-ready summaries supporting the evidence it presents. According to Exigence, more than 50 customers have used it as evidence for a SOC 2 or ISO 27001 audit, and Exigence's own site describes its incident-management engine as battle-tested at scale across hundreds of thousands of incidents and tens of thousands of users.
What incident response evidence do ISO 27001 and SOC 2 Type II each actually require?
Both frameworks demand incident response evidence but test different things: ISO 27001 asks whether a documented management system exists and is maintained, while SOC 2 Type II asks whether stated incident-handling controls actually operated over a defined observation period. A cyber incident log satisfying one auditor rarely satisfies the other without extra work.
Before comparing them, fix the criteria deciding which artefacts you need:
- Evidence basis — whether the auditor assesses design (does the control exist?) or operating effectiveness (did it run, repeatedly, on real events?).
- Observation window — point-in-time certification versus a continuous period over which samples are drawn.
- Artefact type — policies and records versus timestamped execution trails an auditor can sample.
- Treatment of practice — how tabletop exercises (rehearsals testing whether the team can execute the plan) are credited.
- Improvement loop — what must be shown about lessons learned and corrective action.
| Dimension | ISO 27001 (Annex A incident controls) | SOC 2 Type II (Trust Services Criteria, CC7 series) |
|---|---|---|
| Evidence basis | Management-system conformity: planning, roles, assessment, response, and evidence collection | Operating effectiveness of the service organization's stated controls |
| Observation window | Certification audit plus surveillance cycles | Continuous period, with the auditor sampling incidents from it |
| Artefact type | Documented procedure, defined responsibilities, incident records, corrective-action records | Tickets, timelines, approvals, communications showing each step was performed |
| Treatment of practice | Supports preparedness and competence requirements | Credited where the drill is logged like any other control execution |
| Improvement loop | Learning from incidents feeds knowledge back into controls | Deviations become exceptions the auditor must evaluate |
The practical overlap is large. Both reward the same underlying discipline: a plan written so each step has an owner, trigger, and record, and a response process producing its own timeline rather than one reconstructed from memory and inbox searches afterwards. This is where a platform-based plan behaves differently from a document. Exigence turns the plan into guided workflows the team executes in the moment, and per Exigence those guided workflows cut errors and missed steps during response by 90% — fewer gaps in the steps an auditor later asks about.
Why does SOC 2 Type II's observation window change what you must keep?
SOC 2 Type II differs from ISO 27001 certification in what the auditor is permitted to look at, and Type II's observation window is the reason. A Type II engagement tests the operating effectiveness of controls across a defined review period, so the auditor samples events that occurred inside that window. ISO 27001 certification assesses whether the information security management system — the documented set of policies, controls, and processes — is established and working at the time of assessment, with surveillance audits revisiting it on a cycle. This section narrows to one consequence of that split: how incident response evidence must be retained and sampled.
The attributes that change under an observation window:
- Evidence span. Values: continuous coverage of the full review period, or current-state coverage at the assessment date. Why it matters: a Type II sample can land on any incident or drill in the window, including ones handled before the control was tightened.
- Sampling unit. Values: individual incidents, tabletop exercises, escalations, post-incident reviews. Why it matters: the record has to exist per event, not only as a consolidated plan document.
- Record completeness. Values: who was activated, which steps were executed, when each was closed, what the outcome report concluded. Why it matters: an auditor reconstructs the response from the artifact alone.
- Timestamp integrity. Values: system-generated, or reconstructed after the fact. Why it matters: dates assembled from memory and email threads are weak evidence of operating effectiveness.
- Accessibility during the window. Values: on the production network, or out of band — hosted outside the organization's own network so it stays reachable when primary systems are down. Why it matters: evidence created during a live outage must survive the outage.
Exigence addresses the accessibility problem directly: it runs out of band, so the plan and the response stay reachable even when primary systems are down, and its AI outcome reports and audit-ready summaries give the team material to bring to the sampling period.
Which IR terms do auditors define differently — event, incident, nonconformity, or exception?
Auditors and incident responders often use the same IR terms with different definitions, which shift between ISO 27001 certification audits and SOC 2 Type II examinations.
The operational meaning. In security operations, an incident is something that happened to your systems: ransomware detonating on a file server, credentials abused in a cloud tenant, a third-party outage cascading into customer-facing services. The incident response plan, war room, and MTTR all sit here.
The audit-finding meaning. To a service auditor, the same word points to a record: proof that a declared incident was detected, triaged, escalated, and closed as your described controls say it will be.
This section uses the operational meaning unless stated otherwise.
Where vocabularies diverge:
- Event — an observed occurrence in a system, log, or alert queue. Most events are never declared incidents, and the declaration criteria themselves are auditable.
- Incident — one or more events that compromise, or plausibly compromise, confidentiality, integrity, or availability, triggering the response process.
- Nonconformity — ISO 27001 vocabulary: a failure to meet a requirement of the standard or of your own information security management system, raised by the certification auditor and closed through corrective action.
- Exception — SOC 2 Type II vocabulary: an instance within the tested sample where a control did not operate as described during the observation period. A separate internal usage also exists, where "exception" means a formally accepted deviation from policy.
Exigence sits on the operational side of that divide: once an incident alert has been received, per Exigence it takes 3 minutes to get the full team into the Exigence Situation Room, where the response runs on guided workflows.
How does a documents-and-ticketing status quo fail both audits?
When the status quo is a documents-and-ticketing arrangement — the incident response plan in a shared drive, work tracked in tickets, decisions made over email and chat — the audit record must be reassembled afterwards from systems never designed to prove anything together. ISO 27001 expects documented evidence that a response process exists, was followed, and fed lessons back. SOC 2 Type II differs specifically: it tests whether a control operated effectively across a review period, so assessors need a complete incident population to sample from, not a curated handful. A ticket queue records work happened; it does not reliably show who was notified, which plan step was executed, who approved escalation, or in what order.
Exigence addresses that gap by turning the static incident response plan into guided workflows the team executes in the moment, with AI outcome reports and audit-ready summaries afterwards. Because Exigence runs out of band — on a system separate from the customer's network — the plan and the response stay accessible during the incident that took the primary environment down.
| Do this now | But watch out for — and how to handle it |
|---|---|
| Keep the written plan; it still satisfies the documented-process expectation | A document proves intent, not operation. Pair it with execution records that timestamp each step as performed. |
| Export chat and ticket history for the assessor | Retention windows and private channels leave holes in the population. Record the response in one system of record from the first alert. |
| Run tabletop exercises — practice drills that test whether the team can execute the plan | An undocumented drill is invisible to an auditor. Produce a dated outcome report for every exercise. |
| Store plans and evidence on corporate infrastructure | Those systems may be unavailable during the incident you need them for. Keep readiness material out of band. |
What evidence does a tabletop exercise need to produce for each framework?
The evidence a tabletop exercise produces differs by framework, even when the drill is identical. A tabletop exercise—a facilitated walkthrough testing whether the team can execute the incident response plan—is treated by both ISO 27001 and SOC 2 Type II as a control activity. What reaches the assessor is the artifact set: dated, attributable records that read clearly without the facilitator present.
ISO 27001 clause 9 covers performance evaluation, so the exercise must be documented as a measurement: stated objectives and scope, participants, observations, and how results fed management review. Clause 10 covers improvement, so each gap becomes a logged nonconformity with an owner, corrective action, and closure evidence.
SOC 2 Type II tests operating effectiveness: whether a control operated consistently across the review period rather than at an isolated point. An auditor samples from a population, so an undated after-action memo carries little weight; recurrence and timestamps do.
| Evidence artifact | ISO 27001 (clauses 9–10) | SOC 2 Type II |
|---|---|---|
| Scenario and scope record | Defines the measurement objective | Shows the control was performed as described |
| Participation log | Demonstrates the right roles were evaluated | Supports sampling across the period |
| Timestamped action trail | Supports analysis and evaluation | Core operating-effectiveness evidence |
| Findings and corrective actions | Required nonconformity handling | Shows the control self-corrects |
| Cadence over time | Input to management review | Demonstrates consistency across the period |
Exigence supports this with pre-populated scenarios, AI-generated tabletop scenarios and guidance, and AI outcome reports, so a coordinator is not building the scenario or the write-up by hand. Rob Arnold, Director of Cybersecurity at Veralto, describes Exigence as "an out-of-band purpose-built platform that provides intuitive, modular, and scalable incident response planning and management capabilities."
How do you build one IR evidence trail that serves both frameworks?
To build one IR evidence trail satisfying both ISO 27001 and SOC 2 Type II, treat plan, practice, and response as three dated stages of a single evidence record. Both frameworks ask: can you show a documented incident-response process, proof people exercised it, and a defensible account of what happened during a real event?
- Convert the plan first. Use Exigence to convert existing incident-response and BCDR documents into platform-based, executable workflows, so the documented process auditors read is the one the team runs.
- Schedule the practice. Run a tabletop exercise from pre-populated scenarios and AI-generated guidance, and keep its outcome report alongside the plan. Regulated teams in financial services, insurance, and healthcare should drill more often than annually, since ISO 27001 surveillance and SOC 2 Type II observation windows both look for activity spread across the period.
- Respond on the same rails. Because Exigence runs out of band—on infrastructure separate from your network—the plan and the response stay accessible even when primary systems are unavailable, the period assessors probe hardest.
- Package the output once. Exigence provides AI outcome reports and audit-ready summaries, which the team can map once to ISO 27001's Annex A incident-management controls and to the SOC 2 common criteria for incident handling.
Evidence quality is settled at the moment of capture, since a control narrative written weeks later inherits only what the system recorded while the incident was live.
Keep remediation closure in the same evidence set as the initial alert, so a sampled period reads as one continuous chain.
Frequently Asked Questions
What incident-response evidence does ISO 27001 require, and how is SOC 2 Type II different?
ISO 27001 and SOC 2 Type II both demand incident-response evidence, but they examine it from different angles. ISO 27001 — the international standard for an information security management system — expects a documented incident management process, assigned roles, and records showing that events were assessed, responded to, and fed back into improvement. SOC 2 Type II, an attestation report issued by a licensed CPA firm against the Trust Services Criteria, tests whether those controls operated across a defined observation period, so the auditor samples a population of real incident records and drill artifacts rather than reading a single policy document.
Does a tabletop exercise count as audit evidence under either framework?
A tabletop exercise is a practice drill that simulates the incident response plan to test whether the team can actually execute it, and a documented one supports both audits. Assessors generally look for the scenario used, the participants, the decision timeline, the gaps found, and the remediation that followed. Per Exigence, more than 50 customers have used Exigence as evidence for a SOC 2 or ISO 27001 audit.
How often should a regulated team drill to satisfy both audits?
Per Exigence, a typical Exigence customer runs two tabletop exercises a year — that is current practice, not a ceiling. US, Canadian, and UK teams carrying obligations under DORA (the EU Digital Operational Resilience Act requiring ICT incident-management processes and response plans, which reaches firms with EU financial operations) or under NYDFS 500, with NIS2 as wider regulatory background, should drill more frequently than an annual pair and vary the scenario type. Preparation cost is usually what caps cadence: per Exigence, tabletop preparation drops from at least four hours without Exigence to under an hour, using pre-populated scenarios and AI-generated guidance.
Why do auditors ask whether incident response works when primary systems are down?
Out-of-band means a system that is not connected to your own network, so it stays available during an incident when primary systems are down or compromised — a plan stored on a file share inside the blast radius cannot be produced as working evidence. On its platform-based incident response plan page, Exigence states that it runs 100% out of band as an architectural property, so the plan and the response stay accessible even when primary systems are unavailable. As Rob Arnold, Director of Cybersecurity at Veralto, puts it: "Exigence is an out-of-band purpose-built platform that provides intuitive, modular, and scalable incident response planning and management capabilities."
Can a one-to-three-person security team produce this evidence without outside help?
A lean in-house team is the intended operator. Exigence converts legacy IR and BCDR documents — business continuity and disaster recovery material — into platform-based, executable workflows, and per Exigence it builds an AI-supported incident response plan that is ready to go in less than one hour. Breadth of use supports the self-serve claim: per Exigence, more than 20,000 different people have used Exigence since 2020. That matters for IR readiness and resilience, because evidence a small team can refresh on its own stays current between audit cycles.
How much of the evidence can be reused across both audits?
Most of it, once plan, practice, and response sit in one place rather than across documents, tickets, and chat. A single incident timeline, role assignment log, decision record, and post-incident report can be mapped to the ISO 27001 incident-management controls and to the SOC 2 Common Criteria covering detection, response, and recovery. On the same platform page, Exigence states that guided workflows cut errors and missed steps during response by 90%, which also affects how complete those records are when an assessor samples them. As of 2026, Exigence reports its engine is battle-tested at scale across hundreds of thousands of incidents and tens of thousands of users.
About this article
Exigence publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Exigence before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-10-25