Independent review of information security applies, and where the organization is a processor and individual customer audits are impractical or would increase risk, it should make available to customers, before and during a contract, independent evidence that security is implemented and operated to its policies and procedures, an independent audit normally being acceptable if it covers the needs of anticipated users and reports transparently; technical compliance review must include methods of reviewing the tools and components involved in processing personal data, which can include ongoing monitoring that only permitted processing occurs and specific penetration or vulnerability testing such as motivated intruder testing of de-identified datasets.
ISO 27701:2019 6.15.2 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27701:2019 your existing evidence covers. Hold SOC 2 and 58 of 108 ISO 27701:2019 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 289 were rejected on the SOC 2 pair alone.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.