United States
US buyers ask for SOC 2; international customers and tenders ask for ISO 27001; AI products now draw ISO 42001 questions; manufacturers need ISO 9001. Kellwick helps US companies choose and run the right combination, provides independent ISO internal audits, prepares SOC 2 programmes for a CPA firm's examination and offers fractional CISO leadership. Kellwick's operating company, Sodasoft LLC, is US-registered.
Buyers
Local context
Context for scoping, not legal advice. Whether a law applies to you depends on your entity type, sector and size; where a formal legal position is needed we work alongside your counsel.
SOC 2 reports are issued by licensed CPA firms against the AICPA Trust Services Criteria. Kellwick prepares the controls and evidence; the examination is performed by the CPA firm you engage.
CSF 2.0 organises outcomes across Govern, Identify, Protect, Detect, Respond and Recover. It is widely used as a reporting language for boards and buyers, and there is no certification against it.
The DFARS CMMC rule took effect on 10 November 2025 with self-assessments. In July 2026 the Department suspended Phase 2, including the planned C3PAO requirement, pending review. NIST SP 800-171 obligations under DFARS 252.204-7012 continue. Kellwick provides readiness support; it is not a C3PAO and does not issue CMMC certification.
DORA, NIS2 and the EU AI Act apply to US companies only where they operate in or supply the EU market. We say which, if any, reach you - and leave them out of the plan if none do.
Last verified 16 October 2026 against AICPA - SOC 2.
Last verified 16 October 2026 against NIST - Cybersecurity Framework.
Last verified 16 October 2026 against DoD CIO - CMMC and Federal Register - 32 CFR Part 170.
Services
Delivery
Sectors
Questions
It depends on who is asking. US enterprise buyers usually ask for SOC 2; international and EU buyers and many tenders ask for ISO 27001. Most of the controls overlap, so a combined programme avoids building two.
No. Kellwick provides readiness work - scoping, gap assessment, SSP and POA&M support. Certification assessments are performed by authorised C3PAOs, and Level 3 by DCMA DIBCAC.
The standards, the sites and the deadline are enough to start. A specialist replies within one business day and confirms whether the work is remote, onsite or both.
Kellwick is an independent consulting and internal audit practice. We are not a certification body and do not issue ISO certificates. Certification decisions are made only by accredited certification bodies.