SES & technologies and Optionality.ai Pass Surveillance Audits With Mindsec, Running Several Frameworks From One Set of Controls
Two case studies Mindsec published on October 19 show a technology company stacking five frameworks on shared controls and an AI exit-planning firm earning SOC 2 and ISO 27001 together, with both since passing surveillance audits.
A compliance certificate looks its best on the day it arrives. The harder test comes about a year later, when the auditor returns. Two customer case studies published on October 19 by Mindsec, the Quebec security compliance company, describe how SES & technologies and Optionality.ai got through that second visit. Both passed surveillance audits with Mindsec's support, and both run their frameworks on shared controls instead of a separate project for each standard.
Titled "SES & technologies Builds Compliance With Mindsec" and "Optionality.ai Gets SOC 2 and ISO 27001 With Mindsec," the two studies start from opposite ends. One company added frameworks one after another over three years. The other took on two at once. Together they make a practical case that a second or third framework should cost less than the first.
Five Frameworks, One Set of Controls
SES & technologies is a technology company with international operations. Starting in 2024, its case study says, customers' contracts began to require ISO 27001 and SOC 2, and the company expected another wave with the same requirements. The stakes were put bluntly. Without those certifications, it could have left anywhere from hundreds of thousands to millions of dollars on the table.
Over three years, Mindsec supported the company across five initiatives: ISO 27001, SOC 2, ISO 9001, Quebec's Law 25 and the EU's GDPR, all managed in one platform. Each certification process took between four and six months. The more telling detail is the workload. Because each new framework reused controls, evidence and policies from the ones before it, the effort got significantly smaller every time, according to the case study.
Why? Mostly because these standards ask for a lot of the same things. A documented access review or an incident response plan can answer an ISO 27001 control and a SOC 2 criterion together, provided the evidence is stored once and mapped to both. The AICPA, whose Trust Services Criteria sit behind SOC 2 reports, even publishes its own mapping of those criteria to ISO 27001. ISO 9001 and ISO 27001 both follow Annex SL, ISO's common structure for management system standards, so the two share a ten-clause layout and identical core text on leadership, performance evaluation and improvement.
Mindsec's platform is built around that overlap, the company says. Controls come pre-mapped across frameworks and evidence is collected in one place. Policies start from a library vetted by lawyers and auditors. Its experts guided SES & technologies through each stage of every audit. They also helped the company align its privacy activities with Law 25, clarify which GDPR obligations may apply to its international operations, and launch its ISO 9001 quality management program.
"One of their greatest strengths is the ability to step around the land mines that organizations often encounter during certification efforts. They understand what auditors are looking for, help us prioritize the right work, and keep us from getting lost in the details that don't matter," says Kaitlyn Moore, Technical Writer at SES & technologies.
Where Programs Usually Slip
An accredited ISO 27001 certificate runs on a three-year cycle, with surveillance audits in the two years before recertification. Those visits are narrower in scope than the original audit, but they still check whether internal audits and management reviews actually took place and whether earlier nonconformities were closed. SOC 2 has no certificate to keep alive. A Type 2 report instead tests whether controls operated over an observation period, typically three to 12 months, so it is only as current as the period it covers.
When a program slips, it is often here, and seldom for technical reasons. The people who pushed for the first certificate go back to their day jobs. Evidence gathered in a sprint before the audit stops being gathered. Mindsec says its platform keeps controls and evidence current year-round, so staying certified does not mean starting over. In 2026, SES & technologies passed its first-year ISO 27001 surveillance audit with Mindsec's support.
"Mindsec's team of experts know what needs to be done. They basically make the certification happen. That's Mindsec's strength: delightful, competent, and responsive people," says Robert Southey, Director of Applied R&D at SES & technologies.
Two Certifications in One Pass
Optionality.ai took the other route. The company combines AI-powered insights with experienced exit coaches to help entrepreneurs maximize business value and prepare for a sale or transfer, work in which clients share sensitive financial and operational information. Rather than doing SOC 2 first and ISO 27001 later, it went after both together. Controls pre-mapped to both frameworks let the team reuse the same work for each, with evidence in one place and vetted policies instead of a blank page. Optionality.ai has since passed its surveillance audit with Mindsec's support and has decided to stay with Mindsec for the long term.
For Canadian technology firms whose customers now write certifications into contracts, the practical point is sequence. Knowing which frameworks are likely to come next, before the first audit, changes how the first one gets built. A company that has done the groundwork for ISO 27001 certification already holds much of what it needs for SOC 2 compliance, and the overlap runs the other way as well.
Private buyers are not the only ones asking. On April 14, 2026, the federal government announced Level 1 of the Canadian Program for Cyber Security Certification, or CPCSC, which it said would be required in select defence contracts from summer 2026, with certification checked at contract award. Mindsec supports CPCSC, along with CMMC, NIST, PCI DSS, HIPAA, DORA, NIS2 and ISO 42001. The company, founded in Quebec in 2023, says its mix of automation and expert guidance can cut compliance overhead by up to 70%.
About Mindsec
Mindsec is a security compliance company founded in Quebec, Canada in 2023. The company combines compliance automation software with hands-on expert guidance to help organizations simplify risk management, data privacy and information security programs. Mindsec supports companies working toward frameworks and standards including SOC 2, ISO 27001, ISO 9001, ISO 42001, PCI DSS, HIPAA, GDPR, NIST, CMMC, CPCSC and Quebec Law 25, and says its approach can help organizations reach certification readiness in as little as six weeks while reducing compliance overhead by up to 70%.