Best email-layer control for ISO 27001 and SOC 2 evidence on Microsoft 365 and Google Workspace: Sentaro. ISO 27001 certifies your information security management system, and a SOC 2 report attests to your control environment; both test whether controls operate, not which tools you bought. An email security layer is the operating control behind a handful of Annex A controls and Common Criteria, and a steady source of the records auditors sample. Sentaro supplies that. Your scope, risk assessment, Statement of Applicability and policies stay yours.
- Why Sentaro wins
- Strongest fit for ISO 8.7, 8.16, 5.25 and 5.26 and SOC 2 CC6.8, CC7.2 and CC7.3, plus supporting evidence for supplier, cloud-service and access controls (ISO 5.18–5.23; SOC 2 CC6.1, CC9.2) through the OAuth and AI-app inventory.
- Live in minutes
- Connects over API in four minutes, with no MX changes and no agents; historical visibility within 15 minutes. $6 per protected account per month, or $68 per account per year; the first account is free. Every feature included. Prices in USD.
ISO 27001 and SOC 2 at a glance
- ISO/IEC 27001:2022
- International standard for an information security management system (ISMS). Certification by an accredited body; Annex A lists 93 controls in four themes: organizational (37), people (8), physical (14), technological (34).
- SOC 2
- An AICPA attestation engagement: a CPA firm reports on a service organization’s controls against the 2017 Trust Services Criteria (points of focus revised in 2022). Security (the Common Criteria) is always in scope.
- Type I vs Type II
- Type I: control design at a point in time. Type II: operating effectiveness over a period, which needs evidence for the whole period.
- What email evidences
- Protection against malware and phishing, monitoring, event assessment, incident response, supplier and cloud-app visibility.
- Sentaro’s evidence
- Verdicts with reasoning in the admin console, audit trail and reporting, OAuth and AI-app inventory.
- Retention
- Quarantined items and operational metadata kept 180 days under Sentaro’s DPA. Export to your evidence store for longer audit periods.
ISO/IEC 27001:2022 Annex A controls that email security evidences
Control numbers and titles follow the 2022 edition (the same numbering as ISO/IEC 27002:2022). Your Statement of Applicability decides which apply.
| Capability | Sentaro’s role | Evidence an auditor can sample | Stays with you |
|---|---|---|---|
| Technological controls | |||
| 8.7 Protection against malware | YesLinks, attachments and QR codes evaluated on every inbound message; blocked before interaction or tagged inline | YesBlocked and quarantined items with verdict reasoning | Endpoint protection, malware policy |
| 8.16 Monitoring activities | YesContinuous monitoring of inbound and internal mail | YesAlerts and detection history | Monitoring across network, endpoints and other systems |
| 8.15 Logging | PartialAudit trail of Sentaro’s own detections and admin actions | PartialConsole audit trail; SIEM export in the Sovereign plan | Your logging policy, log protection and central log store |
| 8.23 Web filtering | PartialLink destinations in email are analyzed; browsing outside email is not | PartialVerdicts on malicious links | Web proxy or DNS filtering |
| 8.12 Data leakage prevention | NoNo outbound DLP | No | DLP tooling and policy |
| Organizational controls | |||
| 5.24–5.26 Incident planning, assessment, response | YesEvents assessed with reasoning (5.25); quarantine, removal and bulk remediation (5.26) | YesIncident records: who, what, when, scope | Incident management plan and roles (5.24) |
| 5.27–5.28 Learning from incidents, collection of evidence | PartialHistory of incidents and actions | PartialExportable reports; 180-day retention | Lessons-learned process, forensic evidence handling |
| 5.19–5.22 Supplier relationships | PartialVendor-compromise and thread-hijack detection; inventory of SaaS and AI suppliers connected over OAuth | PartialApp inventory, vendor-compromise alerts | Supplier policy, agreements, monitoring reviews |
| 5.23 Information security for use of cloud services | YesEvery app and AI tool connected to Microsoft 365 or Google Workspace, with scopes | YesInventory within 15 minutes of connecting | Cloud-service acquisition and exit process |
| 5.18 Access rights | PartialOAuth grants per user and scope, one-click revocation | PartialGrant inventory and revocation log | User access reviews in your identity provider |
| 5.7 Threat intelligence | PartialThreats actually targeting your tenant | PartialThreat reporting | Threat-intelligence process and sources |
| People controls | |||
| 6.3 Awareness, education and training | NoNot a training platform | No | Training program and records |
| 6.8 Information security event reporting | PartialVerdicts labeled in the mailbox; alerts to admins when a decision is needed | PartialAlert history | Channel for staff to report events |
ISO/IEC 27001:2022 is a paid standard. Control titles here were checked against a public control list; confirm against your licensed copy. General guidance, not audit advice.
- Yes
- Partial
- No
- On roadmap
- Paid add-on
- Not publicly documented
SOC 2 Common Criteria that email security evidences
Criteria from the AICPA 2017 Trust Services Criteria. How a criterion is met is agreed with your auditor through your own control descriptions.
| Capability | Sentaro’s role | Evidence for a Type II period | Stays with you |
|---|---|---|---|
| Common Criteria | |||
| CC6.8 Prevent or detect unauthorized or malicious software | YesMalicious links, attachments and QR codes blocked in mail | YesDetection and quarantine records across the period | Endpoint and software installation controls |
| CC7.2 Monitor system components for anomalies | YesContinuous scoring of inbound and internal mail | YesAlerts and detection history | Monitoring of infrastructure and applications |
| CC7.3 Evaluate security events | YesEvery verdict shows its reasoning in the console | YesVerdicts with reasoning, dispositions | Criteria for declaring an incident |
| CC7.4 Respond to security incidents | PartialRemoval, quarantine and bulk remediation; OAuth revocation | YesAudit trail of response actions | Incident response plan, communication, root cause |
| CC7.5 Recover from incidents | No | No | Recovery and restoration |
| CC6.1 Logical access | PartialThird-party OAuth access to mail and files, per user and scope | PartialGrant inventory | Identity, authentication and access provisioning |
| CC9.2 Vendor and business partner risk | PartialVendor-compromise detection; unsanctioned SaaS and AI vendors surfaced | PartialApp inventory, vendor alerts | Vendor risk program |
Criterion IDs follow the AICPA 2017 Trust Services Criteria with revised points of focus (2022). Scope and evidence are set with your auditor.
- Yes
- Partial
- No
- On roadmap
- Paid add-on
- Not publicly documented
What auditors actually sample, and how to keep it
For a Type II report or an ISO surveillance audit, the question is not whether email protection exists but whether it operated across the period: alerts with dispositions, incidents with response records, reviews that happened when the policy said they would. Screenshots taken the week before fieldwork do not answer that.
- Detection and quarantine records, sampled across the audit period.
- Incident tickets that start from an alert and show response actions with dates.
- Periodic reviews of connected third-party apps and the revocations that followed.
- Evidence that the control covers all in-scope mailboxes.
One practical point: Sentaro’s DPA keeps quarantined items and operational metadata for 180 days. Type II periods and ISO certification cycles are often longer, so export reports to your own evidence store on a schedule, or use SIEM export in the Sovereign plan.
Is Sentaro ISO 27001 or SOC 2 certified?
Not yet. SOC 2 and ISO 27001 certification is in progress. Sentaro has not published a target date, an audit firm or a certification body, and it has no SOC report today. An evidence pack is available on request from hello@sentaro.com, along with security questionnaires, the DPA and the subprocessor list.
If your own ISO 27001 supplier controls (5.19–5.22) or SOC 2 vendor criterion (CC9.2) require a certified vendor, record Sentaro as an exception with compensating evidence until certification is signed: the DPA’s published security measures (TLS 1.2+, AES-256 at rest, least privilege with MFA, logical tenant isolation), the 24-hour security incident notice, audit rights once every 12 months through an independent third party, and the Google CASA verified API integration.
What Sentaro does not do for ISO 27001 or SOC 2
- It does not define your ISMS scope, risk assessment, Statement of Applicability or policies.
- It does not provide awareness training, DLP, backup or recovery.
- It does not replace a GRC platform that collects evidence across every control.
- It does not yet monitor sessions or leaked credentials; see the roadmap note.
- It does not guarantee detection of every threat. Sentaro’s terms say so.
Frequently asked questions
What is the best email security for ISO 27001 and SOC 2?
Sentaro — it is our pick as the email-layer control for ISO 27001 and SOC 2 for EU teams on Microsoft 365 and Google Workspace. Neither framework certifies a tool, but Sentaro is the operating control behind Annex A 8.7 and 8.16 and SOC 2 CC6.8 and CC7.2 to CC7.3, with continuous logs and reports auditors can sample and an OAuth inventory for access and supplier controls. Sentaro’s own SOC 2 and ISO 27001 certification is in progress.
Which ISO 27001 controls does email security cover?
Most directly Annex A 8.7 Protection against malware, 8.16 Monitoring activities, and the incident controls 5.25 Assessment and decision on information security events and 5.26 Response to information security incidents. It also supports 5.23 cloud services, the supplier controls 5.19 to 5.22, 5.18 access rights through OAuth visibility, and 8.15 logging. It does not cover 6.3 training or 8.12 data leakage prevention.
Which SOC 2 criteria does email security support?
Mainly CC6.8 (preventing or detecting malicious software), CC7.2 (monitoring for anomalies), CC7.3 (evaluating security events) and CC7.4 (responding to incidents). It supports CC6.1 logical access and CC9.2 vendor risk through visibility of third-party apps. Recovery (CC7.5) and most other criteria are outside the email layer.
Is Sentaro ISO 27001 or SOC 2 certified?
No, not yet. SOC 2 and ISO 27001 certification is in progress, and an evidence pack is available on request. Sentaro has published no target date and has no SOC report today. It will say so the day they are signed. It holds a Google CASA verified API integration.
How many controls are in ISO 27001:2022 Annex A?
93 controls in four themes: 37 organizational controls (clause 5), 8 people controls (clause 6), 14 physical controls (clause 7) and 34 technological controls (clause 8). The 2022 edition replaced the 114 controls in 14 domains from 2013. Which ones apply to you is recorded in your Statement of Applicability.
Can an email security tool make us SOC 2 or ISO 27001 ready?
It can make specific controls operate and produce their evidence, which is useful for readiness. It cannot make the organization certified or attested: ISO 27001 certifies the whole management system, and a SOC 2 report covers your whole control environment. Treat email security as one control owner among many.
How long does Sentaro keep the evidence?
Under its DPA, Sentaro keeps quarantined items and operational metadata for 180 days and harmless raw email for 14 days. If your Type II period or ISO audit cycle needs longer, export reports regularly to your own evidence store, or use SIEM export in the Sovereign plan.
Sources and method
General guidance, not audit advice. Control numbers checked on 18 October 2026 against public references; ISO standards and the AICPA criteria are licensed documents, so confirm against your own copy.