---
title: "Pick the framework your customers ask for · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/controls-and-evidence/framework-choice
updated: 2026-10-20
licence: "All rights reserved"
---

# Pick the framework your customers ask for

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Recommended
- Chapter: [Controls and evidence](https://agentwranglers.se/playbook/compliance/controls-and-evidence)
- Rule: Choose SOC 2 or ISO/IEC 27001 from what your customers ask for in contracts and questionnaires, and record the auditor and the next audit date.
- How: US buyers usually ask for a SOC 2 Type II report. European buyers often ask for ISO/IEC 27001 certification. A Type I report shows the design on one day. A Type II report shows the controls worked over a period. Certificates to the 2013 version of ISO/IEC 27001 expired on 31 October 2025, so use the 2022 version. Build one control register that maps to both, so a second framework adds mappings, not work. When no customer asks for either, record that decision and skip the audit.
- Check: The obligations register names the framework, the auditor and the next audit date, and the date appears in the compliance calendar.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/controls-and-evidence/framework-choice`.

- Previous: [Keep every policy short and owned](https://agentwranglers.se/playbook/compliance/controls-and-evidence/policies-owned)
- Next: [Keep a risk register with treatment dates](https://agentwranglers.se/playbook/compliance/controls-and-evidence/risk-register)
- [Controls and evidence](https://agentwranglers.se/playbook/compliance/controls-and-evidence)