“Vanta estimates a 60-65% overlap between the controls required for SOC 2 and ISO 27001 compliance.”