ISO 27001 vs SOC 2: start with the one your customers ask for

ISO/IEC 27001 is published by ISO and the International Electrotechnical Commission (IEC). It sets the requirements for an ISMS: how you decide which information security risks matter, how you treat them and how you keep the system working.

Clauses 4 to 10 cover the management system itself, such as context, leadership, risk assessment, internal audit and management review. Annex A of ISO/IEC 27001:2022 lists 93 controls. You decide which ones apply to you and record that in a Statement of Applicability.

Certification is optional. If you want a certificate, a certification body audits you. ISO notes that a certificate from an accredited certification body can give customers more confidence. Accredited certification runs in a three-year cycle, with an initial audit, surveillance audits in the first and second year and a recertification audit in the third.

SOC 2 comes from the American Institute of Certified Public Accountants (AICPA). It is an examination of the controls at a service organization, such as a SaaS company, against the Trust Services Criteria.

The criteria are grouped into five categories: Security, Availability, Processing Integrity, Confidentiality and Privacy. Every SOC 2 report covers Security, through the Common Criteria. You choose which of the other categories to add to your scope.

A licensed CPA firm performs the examination and issues the report. There are two types:

• A Type 1 report looks at whether your controls are suitably designed, as of one date.
• A Type 2 report also tests whether your controls operated effectively throughout a period, and it describes the auditor's tests and results.

SOC 2 is an attestation report, not a certification. The report is meant for your customers and other specified parties.

• ISO 27001 ends in a certificate. SOC 2 ends in a report with the auditor's opinion.
• A certification body audits ISO 27001. A CPA firm examines your controls for SOC 2.
• ISO 27001 asks for a full management system plus the Annex A controls that apply to you. SOC 2 measures your controls against the Trust Services Criteria for the categories in your scope.
• ISO 27001 is an international standard. SOC 2 is a US framework, so it comes up most with US customers.

Neither one is better in general. The right one is the one your customers accept.

Look at the security questionnaires and contract terms you get from customers and prospects. They tell you which one to do first.

• If most of your customers are in the US and ask for a SOC 2 report by name, start with SOC 2.
• If your customers are in Europe or spread over several regions, start with ISO 27001.
• If nobody has asked yet, ISO 27001 is a reasonable default, because it is an international standard.

Some customers accept either one. Others ask for one by name. When a large customer asks for the other one later, you add it.

If your customers ask for both, you keep one ISMS and run two audits: an ISO 27001 audit by a certification body and a SOC 2 examination by a CPA firm. One audit does not cover the other standard.

Much of the work behind the two audits is shared. An access control policy, a risk assessment or a change management procedure is useful for both, and the evidence you keep for it can be evidence for both. Each auditor decides what to accept as evidence for their own standard.

Compliance by mvdmio has catalogs for ISO 27001:2022 and SOC 2. Crosswalk mappings link related requirements across the frameworks you adopt, and the crosswalk marks each link as Equivalent, Partial or Related.

• The crosswalk marks ISO 27001 A.5.15 on access control as Equivalent to SOC 2 CC6.1.
• It marks ISO 27001 A.8.32 on change management as Equivalent to SOC 2 CC8.1.
• It marks ISO 27001 clause 6.1.2 on risk assessment as Equivalent to SOC 2 CC3.2.

You keep one access control record, and both frameworks show it against their own requirement. The same goes for evidence and findings. Each framework shows what is satisfied and what is still open.

Your ISO 27001 audit and your SOC 2 examination stay separate, because each one covers its own framework. Compliance does not certify you and does not issue a SOC 2 report. It is where you keep the records, evidence and findings your auditors ask to see.

Compliance doesn't connect to your cloud, identity or HR systems to collect evidence. You attach evidence to tasks yourself, or build your own sync through the REST API, the MCP server or the CLI.

More detail on each framework: ISO 27001 in Compliance and SOC 2 in Compliance.

ISO 27001 and SOC 2 are each €999 per framework per year, excl. VAT. You pay for each framework you adopt separately. Users in your organisation are unlimited.

Try Compliance for 30 days without a credit card. The trial gives you full access to every framework. The AI assistant is not part of the trial unless you buy AI credits.

Used at Jewel Software, where Michiel van der Meer is Tech Lead. He built Compliance after taking over an ISMS there and seeing how much hand-work it took.

You can also look around in the public demo first. It uses fictional data.