ISO 27001 vs SOC 2: which does your company need?

ISO/IEC 27001 and SOC 2 are the two forms of security assurance buyers ask for most often. ISO 27001 is an international standard for an information security management system, and conformity is shown with a certificate from an accredited certification body. SOC 2 is a report from a licensed CPA firm giving its opinion on your controls against the AICPA Trust Services Criteria. Much of the underlying work is the same. The deliverable, the auditor and the cycle are not.

What is the difference between ISO 27001 and SOC 2?

The shortest answer: ISO 27001 certifies that you run a management system for information security. SOC 2 reports on whether specific controls were designed, and in a Type II report operated, as you describe them.

ISO/IEC 27001:2022 sets out the requirements for an information security management system, or ISMS: how you establish, run, maintain and continually improve your security program. It is published jointly by ISO and IEC, and the current edition was published on October 25, 2022 (IAF MD 26). A short amendment, ISO/IEC 27001:2022/Amd 1:2024, added climate action changes in February 2024 (ISO).

SOC 2 is one of the AICPA's System and Organization Controls services, which the AICPA describes as a suite of service offerings CPAs may provide in connection with system-level controls of a service organization (AICPA & CIMA). The report measures your controls against the 2017 Trust Services Criteria, with points of focus revised in 2022 (AICPA & CIMA).

	ISO/IEC 27001	SOC 2
What it is	A certifiable international standard for an ISMS	An attestation report on a service organization's controls
Who issues it	An accredited certification body	A licensed CPA firm
Deliverable	A certificate, usually a public document	A detailed report, usually shared under a nondisclosure agreement
What is assessed	The management system plus the controls you selected	Controls against the Trust Services Criteria in scope
Control set	Annex A: 93 controls, applied based on your risk assessment	Security criteria always; Availability, Processing Integrity, Confidentiality and Privacy optional
Scope document	ISMS scope statement and Statement of Applicability	System description
Cycle	Three-year certificate with annual surveillance audits	A new report for each period, Type I or Type II
Where it is most often requested	Internationally, and by large enterprises worldwide	US enterprise buyers of SaaS and other services

Who issues each one?

Neither one is issued by the body that wrote the standard.

ISO states plainly that it does not perform certification or issue certificates. Certification is performed by external certification bodies, so a company cannot be certified by ISO (ISO). Certification bodies are in turn accredited by national accreditation bodies, which are members of the International Accreditation Forum. ISO points readers to the IAF's CertSearch database to check whether a certificate is accredited.

Certification bodies that audit an ISMS work to ISO/IEC 17021-1, which sets requirements for bodies certifying any management system, together with the ISMS-specific requirements in ISO/IEC 27006-1:2024 (IEC). When you choose a certification body, ask who accredits it for ISO 27001 and confirm that on CertSearch.

A SOC 2 report can only be issued by a licensed CPA firm, under the AICPA attestation standards. Compliance software vendors and readiness advisers cannot attest to your controls. We explain this in more detail in our article on SOC 2 Type I and Type II reports.

CyberAccord is neither a certification body nor a CPA firm. We prepare you for both audits and work alongside the auditor you engage.

How do the audit cycles compare?

This is where the two differ most in day-to-day effort.

ISO 27001 runs on a three-year certification cycle. ISO/IEC 17021-1 requires the audit program for initial certification to include a two-stage initial audit, surveillance audits in the first and second years following the certification decision, and a recertification audit in the third year before the certificate expires (clause 9.1.3.2). Surveillance audits must happen at least once a calendar year outside recertification years, and the first must fall no more than 12 months after the certification decision (clause 9.1.3.3) (ISO/IEC 17021-1).

The two initial stages have different jobs:

• Stage 1 reviews your ISMS documentation and your readiness. It checks, among other things, that internal audits and management reviews are planned and being performed (clause 9.3.1.2.2).
• Stage 2 evaluates the implementation, including effectiveness, of your management system against all of the standard's requirements (clause 9.3.1.3).

SOC 2 runs report by report. A Type I report covers control design on a single date. A Type II report covers operating effectiveness over an observation period agreed with your auditor. Each report covers its own period, so assurance is kept current by issuing the next report, usually with periods running back to back.

In practice, ISO 27001 asks you to keep the management system running between audits: risk reviews, internal audits, management reviews and corrective actions, all producing records. SOC 2 Type II asks you to keep each control running and leaving evidence every day of the period. Both reward a program that runs as part of normal work rather than in a rush before the auditor arrives.

What does each one cover?

ISO 27001 starts with the management system. The requirements in clauses 4 to 10 cover context and scope, leadership, risk assessment and treatment, support, operation, performance evaluation and improvement. An organization claiming conformity cannot exclude any of them (ISO). Annex A then lists reference controls. In the 2022 edition, Annex A references the controls in ISO/IEC 27002:2022, which reduced the set from 114 controls in 14 clauses to 93 controls in 4 clauses (IAF MD 26). The four groups cover organizational, people, physical and technological controls.

You do not implement every Annex A control automatically. You select controls through your risk assessment, compare them against Annex A so nothing necessary is missed, and record the result in a Statement of Applicability: each control, whether it applies, and why.

SOC 2 starts with your service commitments. Security, also called the common criteria, is in scope for every report. You add Availability, Processing Integrity, Confidentiality or Privacy when they match commitments you make to customers. Instead of a Statement of Applicability, you write a system description of the services, infrastructure, people, procedures and data in scope, and the auditor gives an opinion on it.

What do buyers typically ask for?

There is no rule, only patterns. In our experience:

• US enterprise buyers of software and services most often ask for a SOC 2 report, and many expect a Type II. Their security teams like the detail: the auditor's tests, any exceptions and management's responses.
• Buyers outside the US, especially in Europe and Asia, more often ask for ISO 27001 certification, because it is an international standard with a globally recognized accreditation system.
• Large multinational buyers may accept either, or ask for both, and frequently send a security questionnaire regardless.
• Regulated buyers may map either one to their own obligations, but neither replaces a law such as HIPAA or the FTC Safeguards Rule.

The cheapest way to choose is to ask. Look at the recent security reviews you received and the larger deals in your pipeline, and note which form each customer requested or accepted. That answer usually settles the question.

Can you do both without doubling the work?

Yes, and many companies end up there. The control work overlaps heavily. Access control, change management, risk assessment, vendor management, incident response, logging and security awareness training appear in both. The AICPA publishes a mapping between the 2017 Trust Services Criteria and ISO 27001 for its members (AICPA & CIMA). It dates from 2018, before the 2022 revision of Annex A, so check it against the current control numbering.

What does not overlap is mostly ISO 27001's management system layer: a formal ISMS scope, documented risk treatment, internal audits, management reviews and the Statement of Applicability. SOC 2 has its own specifics, chiefly the system description and the evidence that each control operated across a Type II period.

A practical sequence for a company that expects to need both:

1. Build one control set that covers the Security criteria and the Annex A controls your risk assessment selects.
2. Run one evidence routine. Access reviews, change approvals and monitoring records generated once and used by both auditors.
3. Start with what your buyers need first. Usually SOC 2 for a US-focused company, ISO 27001 for one selling abroad.
4. Add the second once the first is running, adding the management system layer or the system description as needed.
5. Align calendars so surveillance audits and SOC 2 report periods do not land in the same busy month, unless one firm is coordinating both.

Which one should you choose?

Your situation	Likely starting point
Selling SaaS or services mostly to US enterprises	SOC 2, planning for a Type II
Selling into Europe, Asia or to global procurement teams	ISO 27001 certification
Customers ask for both, or for "SOC 2 or ISO 27001"	Whichever your largest near-term deals name; plan the second
You want a formal, management-led security program regardless of buyers	ISO 27001, whose clauses require one
A single customer needs assurance soon	A SOC 2 Type I, with a Type II period planned soon after
You are regulated, for example under HIPAA	Your regulatory program first; either can support it

Where to start

Collect what customers have actually asked for, then decide which deliverable to pursue first. Define a scope that covers the products customers buy. Run a gap assessment against the clauses and Annex A of ISO 27001, the Trust Services Criteria, or both. Then close the gaps and build the evidence routine before you engage the auditor.

Our ISO 27001 readiness and SOC 2 readiness and renewal work covers each of those steps, and our advisory services help you decide scope and sequencing. If no one owns the program yet, a virtual CISO can lead it through both audits. If you are deciding between the two for a specific market or deal, talk to us.