hello@sterling-grc.com +1 201 263 4443 New York ISO & GRC consulting in 60+ countries
Contact Sterling Academy login
SterlingInternational Consulting Talk to a consultantTalk to us
← All videos

Integrated programme

ISO/IEC 27001 and SOC 2 together: one control set for every market: video

A film on building one control set that serves ISO/IEC 27001 certification for international customers and a SOC 2 report for US customers.

  • Integrated programme
  • 3 min 24 s

Key takeaways

  • ISO/IEC 27001 is certified; SOC 2 is an attestation report from a licensed CPA firm.
  • Start with whichever your largest customers ask for first.
  • A SOC 2 Type 2 needs a period of operating evidence, so start the controls early.
  • One control set maps to Annex A and the Trust Services Criteria.
  • The second outcome reuses most of the work of the first.

International customers ask for one, US customers for the other

International customers tend to ask for ISO/IEC 27001; US customers tend to ask for a SOC 2 report. Most SaaS, IT services and BPO companies selling to both markets end up needing each. They are different things: ISO/IEC 27001 is a certifiable management system standard, certified by an accredited body, while a SOC 2 report is an attestation issued only by a licensed CPA firm under the AICPA attestation standards. It is a report, not a certificate.

Their controls, however, overlap. This short film walks through how one control set, mapped to ISO/IEC 27001 Annex A and the SOC 2 Trust Services Criteria, lets the same evidence serve the certification body and the CPA firm.

The usual guide to sequencing is simple: begin with whichever your largest customers ask for first.

Which comes first, and how the second reuses the work

The usual answer to which comes first is the one the largest customers ask for first. ISO/IEC 27001 provides the management system that makes SOC 2 easier, while a SOC 2 Type 2 report needs a period of operating evidence, so starting the controls early helps either way. A Type 1 report covers the design of controls at a point in time; a Type 2 also covers whether they operated over a period.

Annex A controls and the Trust Services Criteria are then met by the same policies and processes. Access reviews, change tickets, monitoring and vendor reviews are collected once and serve both, and whichever outcome comes second reuses most of the work of the first. Security questionnaires from any market can then be answered from one evidence base.

Sterling prepares the controls, the evidence and the SOC 2 system description and stays through the examination and the certification audit, with one consultant, one Effivity workspace and one agreed fee. The CPA firm issues the report and the accredited body issues the certificate.

ISO/IEC 27001 at a glance

Purpose
Information security management: protecting the confidentiality, integrity and availability of information through assessed risks and chosen controls
Relevant to
Any organisation holding client, personal or business-critical information, from technology and BPO to financial services, healthcare and public-sector suppliers
Edition
ISO/IEC 27001:2022 with Amendment 1:2024; 2013-edition certificates lapsed on 31 October 2025
Certification
Assessed and decided by an independent certification body accredited to ISO/IEC 17021-1 and ISO/IEC 27006-1
Sterling's role
Consulting with your team, Effivity, training, vulnerability assessment, internal audit and certification readiness, then Sustain™
Cost and timing
Total investment for an ISO/IEC 27001 ISMS depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 4 to 8 months

ISO/IEC 27001: the complete guide →

ISO/IEC 27001: questions people ask

Is ISO/IEC 27001 only for IT companies?

No. It applies to any organisation that holds information worth protecting, which is every organisation with clients, employees or a bank account. IT firms, BPOs and financial services feel the demand first because their clients ask; law firms, healthcare providers and public bodies certify for the same reasons.

What is the difference between ISO/IEC 27001 and SOC 2?

ISO/IEC 27001 is an international management system standard; an accredited certification body audits it and issues a certificate with a defined scope. SOC 2 is an attestation report on a service organisation's controls against the AICPA Trust Services Criteria, issued by a CPA firm and expected mainly by US clients. They overlap heavily in the controls examined, so one evidence base can serve both, but neither replaces the other; ask your clients which they accept.

How many controls does ISO/IEC 27001 have, and do we need all of them?

Annex A of the 2022 edition lists 93 reference controls in four themes: 37 organisational, 8 people, 14 physical and 34 technological. You are not required to implement every one. You must select controls from your risk treatment, compare the selection with Annex A so nothing necessary is missed, and record in the Statement of Applicability which controls apply, why, and whether they are implemented, with a justification for any you exclude.

Do we need a penetration test to get certified?

The standard requires you to manage technical vulnerabilities and assess risks; it does not prescribe a particular test. A vulnerability assessment is included in a Sterling ISMS engagement, and its findings feed the treatment plan. Whether a deeper penetration test is warranted depends on your risks, your clients' contracts and your regulator.

Does Sterling issue the ISO/IEC 27001 certificate?

No. Sterling consults, trains and prepares. An independent certification body accredited to ISO/IEC 17021-1 and ISO/IEC 27006-1 audits the ISMS in two stages and decides. A provider offering consulting and the certificate on one invoice is selling paper.

More ISO/IEC 27001 questions and answers →

Keep exploring

Related to this video

Read next

Services

Next steps

The complete guide

Everything on ISO/IEC 27001

Start with the ISO/IEC 27001 page · SOC 2, or go straight to the guide you need.

On the ISO/IEC 27001 page

Guides

By country

By industry

Often combined with ISO/IEC 27001

More videos: Integrated programmes

All videos

Talk to a consultant

Plan your ISO/IEC 27001 certification with confidence.

Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.

hello@sterling-grc.com

+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page

What would you like to achieve?

Choose a starting point. The enquiry form takes about a minute.

Your goal
Book my free discovery call

Continue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice