Notifications
Clear all
Topic starter
25/06/2026 12:43 am
TL;DR: Independent control assurance and updated cloud, threat intelligence, supply chain, and resilience requirements are emerging as core trust signals for regulated data ecosystems after Raidiam says it has completed a SOC 2 Type II audit and migrated its ISMS to ISO/IEC 27001:2022, according to Raidiam. The real lesson is that ecosystem operators are now being judged on continuous control evidence, not security claims.
NHIMG editorial — based on content published by Raidiam: SOC 2 Type II and ISO/IEC 27001:2022 compliance update
Questions worth separating out
Q: How should teams prepare identity governance for SOC 2 Type II evidence requests?
A: Teams should map each access control to a repeatable piece of evidence, such as approval logs, review records, and offboarding records.
Q: Why does ISO/IEC 27001:2022 matter for IAM and NHI programmes?
A: The 2022 revision places more emphasis on cloud security, threat intelligence, supply chain risk, and resilience, all of which depend on identity controls.
Q: What breaks when identity governance is treated separately from ecosystem assurance?
A: Audit findings become disconnected from real operational risk.
Practitioner guidance
- Map audit evidence to identity controls Tie SOC 2 and ISO 27001 evidence requests to concrete identity events such as joiner, mover, leaver actions, privileged approvals, and service-account changes so control operation can be shown, not merely described.
- Review third-party access as part of ISMS scope Include supplier accounts, delegated admin paths, and external integrations in the same control inventory as internal users so cloud services security and third-party risk are assessed together.
- Prove control continuity across audit periods Test whether logging, access review, offboarding, and incident response still produce defensible evidence after staff changes, platform changes, and dependency changes, not only at certification time.
What's in the full analysis
Raidiam's full post covers the operational detail this post intentionally leaves for the source:
- How Raidiam frames SOC 2 Type II versus Type I for customer assurance and audit readiness.
- The specific areas of the ISO/IEC 27001:2022 upgrade that Raidiam highlights as part of its ISMS migration.
- How the company describes security, privacy, and operational rigor for regulated open data and open finance environments.
- The trust and resilience messaging Raidiam uses for partners, regulators, and ecosystem participants.
👉 Read Raidiam's update on SOC 2 Type II and ISO/IEC 27001:2022 compliance →
SOC 2 Type II and ISO 27001:2022: what it means for IAM teams?
Explore further
25/06/2026 9:42 am
Trust frameworks are becoming evidence frameworks for identity governance. When a platform claims to protect regulated data, the question is no longer whether controls exist on paper. The question is whether access approvals, monitoring, supplier controls, and recovery actions can be demonstrated under independent review. That shifts identity governance from policy assertion to operational proof, which is exactly where IAM, PAM, and NHI programmes are being tested today. Practitioners should assume that auditability is now a core design constraint.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, 46% confirmed and 26% suspected, according to The 2024 ESG Report: Managing Non-Human Identities.
- Enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months, according to Oasis Security and ESG.
A question worth separating out:
Q: How do security teams prove trust continuity across human, machine, and delegated access?
A: They need one governance model that links joiner, mover, leaver events, service-account lifecycle, and privileged third-party access to the same audit trail. Without that linkage, evidence becomes fragmented and no longer proves that the platform can sustain control over time.
👉 Read our full editorial: Raidiam's SOC 2 Type II and ISO 27001:2022 shift raises trust bar
