Cybersecurity for B2B SaaS and technology — ISO 27001 as the baseline, ENS for public sector, DORA and NIS2 when the client requires it

Before looking for the first enterprise client — not after. ISO 27001 is the first door to corporate onboarding and, in many public-sector and financial-sector tenders, it is an eliminatory requirement. SaaSes that leave it for 'when the big client arrives' typically lose six to twelve months of commercial work when the first serious prospect appears. Better to anticipate: have the ISMS running before the questionnaire arrives.

No. The SOC 2 Type II audit is performed by a CPA (Certified Public Accountant) accredited by AICPA — it is a US accounting professional regulation. Hard2bit accompanies the readiness and maintenance of the framework: controls aligned with Trust Services Criteria, auditable evidence, automation of evidence capture where possible and audit preparation. The official audit is performed by the accredited CPA.

They share many controls but are not interchangeable. ISO 27001 is an international standard and the dominant model in Europe and the rest of the world; SOC 2 Type II is a US report under AICPA's Trust Services Criteria, dominant in the US. For Spanish SaaS selling in Europe, ISO 27001 comes first. If the SaaS wants to expand to the US or already has US clients, adding SOC 2 Type II readiness on top of the ISO 27001 baseline reduces the incremental cost significantly.

DORA applies if the SaaS is an ICT supplier to the financial sector — the obligation level depends on size and criticality. The Critical Third-Party Provider (CTPP) figure under direct European supervision affects only a small but very important subset. NIS2 may apply to SaaS that is a supplier to an essential sector (healthcare, energy, transport, water, digital government). In both cases, the end client ends up requesting evidence in the questionnaire — it pays to anticipate.

SIG (Standardized Information Gathering, Shared Assessments) and CAIQ (Consensus Assessments Initiative Questionnaire, CSA) are the most common in enterprise due diligence. Recommended practice: keep an always-up-to-date master version of the SIG / CAIQ with answers aligned to ISO 27001 and, where applicable, SOC 2; keep it alive with every change to the ISMS; and review it before each new onboarding. It dramatically reduces questionnaire-closing time.

The Regulation (EU) 2024/1689 classifies AI systems into four risk levels (unacceptable, high, limited, minimal). Obligations change radically. For a B2B SaaS, the critical points are: classifying the product correctly, documenting the system and training data, ensuring transparency and human oversight where applicable, and, in high-risk, registering in the European database. Phased deadlines through 2027 — the prohibitions and general-purpose model milestones are already in force.

The CRA — Regulation (EU) 2024/2847 applies to products with digital elements placed on the EU market. CE marking with cybersecurity requirements, vulnerability management throughout the product lifetime, notification of actively exploited vulnerabilities to ENISA. Progressive application with milestones in 2026 and full application by late 2027. For embedded-software vendors and industrial-IoT product vendors, anticipating the roadmap before the mandatory date is reasonable.

As a central risk, not an implementation detail. The strategy combines architecture (chosen isolation model — single row with tenant_id in every query, schema per tenant, database per tenant — with its implications), code review of tenant filters in the ORM or data-access layer, specific security tests (cross-tenant access tests in pentesting), SOC monitoring of anomalous cross-tenant access patterns and, in some sectors, per-tenant encryption with dedicated KMS.

Continuous dependency inventory (SBOM in CycloneDX or SPDX format), Software Composition Analysis (SCA) integrated in the pipeline to catch vulnerabilities in dependencies before merging, open-source license management and explicit policies on permitted dependencies. Meets modern enterprise-client expectations and, where applicable, CRA. We work on the existing pipeline, not replacing it.

Yes. vCISO is a recurring service for SaaS that needs executive representation in front of clients, ownership of the security committee, ISMS definition and maintenance and overall governance — without hiring a full-time CISO. Especially useful in the 50–250 employee range, where the organization already requires serious governance but does not yet justify a full-time internal CISO.

We adapt the service to the international parent's frameworks (global controls, proprietary frameworks, group-strategic providers) while also covering the applicable Spanish/European framework (ISO 27001, ENS if selling to Spanish public administration, GDPR, NIS2/DORA where applicable). Technical liaison runs in Spanish or English as appropriate, and deliverables are prepared in a format compatible with the client's security committee.

For a B2B SaaS without prior framework and with reasonable scope (productive core + associated critical processes), a first ISO 27001 certification typically takes between six and nine months if the team dedicates real time, and between nine and twelve if attention is partial. Companies with a good technical posture but undocumented practices shorten the timeline; companies with immature practices lengthen it. We determine it honestly in the initial diagnosis — we do not sell impossible deadlines.