▲ 10 r/soc2
Running PCI, SOC 2, and ISO 27001 at a BPO contact center. Anyone done a combined assessment or is it always three separate efforts
Running compliance at a BPO contact center operation with about 2,000 seats. We just got simultaneous requirements from three different clients: PCI DSS from a new payment-processing client, SOC 2 Type 2 from an enterprise fintech client, and ISO 27001 from a European client. Three separate full assessments would be a significant operational disruption, and we have physical infrastructure, agent workstations, call recording systems, and manual processes that don't map to SaaS-focused compliance guidance at all.
Has anyone in BPO or contact center run combined PCI plus SOC 2 plus ISO 27001? Is a single assessment workable or is it always three separate engagements?
u/RichMorning_3113 — 7 days ago