TPRM - would you be ok if the company has a soc2 in a different area aside from the product your choosing?

From my understanding, its possible for a company to have a SOC2 for a particular product and not necessarily one at the organization level.

* Regarding TPRM, if a company does not have a SOC2 for a product but they do have it in another area, would that be ok for you in terms of risk? I mean, some controls do span across the organization.
* I dont know much about ISO 27001, but does the same rules apply?


Wondering …

area cybersecurity organization product soc2 the company tprm understanding