Agent WranglersControls and evidence Recommended
Pick the framework your customers ask for
Choose SOC 2 or ISO/IEC 27001 from what your customers ask for in contracts and questionnaires, and record the auditor and the next audit date.
How to do it
US buyers usually ask for a SOC 2 Type II report. European buyers often ask for ISO/IEC 27001 certification. A Type I report shows the design on one day. A Type II report shows the controls worked over a period. Certificates to the 2013 version of ISO/IEC 27001 expired on 31 October 2025, so use the 2022 version. Build one control register that maps to both, so a second framework adds mappings, not work. When no customer asks for either, record that decision and skip the audit.
How to check
The obligations register names the framework, the auditor and the next audit date, and the date appears in the compliance calendar.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/controls-and-evidence/framework-choice.