ISO/IEC 27001, PCI DSS and SOC 2 together: one control set, three outcomes: video

Three frameworks, three independent assessors

Service providers that handle card data for US and international clients are often asked for all three: an ISO/IEC 27001 certificate, PCI DSS validation and a SOC 2 report. Each outcome comes from a different independent party under its own rules. An accredited certification body certifies the information security management system, a Qualified Security Assessor or the acquirer's self-assessment route validates PCI DSS, and a licensed CPA firm issues the SOC 2 attestation report.

No single audit can formally cover all three. What one programme can do is build one control set and one evidence base, then plan the assessments close together so people prepare once. This short film walks through how that works.

Service providers handling card data for both US and international clients are the ones most often asked for all three.

Each outcome has its own rules: there is no PCI DSS certificate, since compliance is validated at least annually by a QSA or a self-assessment questionnaire, and a SOC 2 report is a CPA firm's attestation, not a certificate.

Write each control once, use the evidence three times

Each control is written once and mapped to ISO/IEC 27001 Annex A, the PCI DSS requirements and the SOC 2 Trust Services Criteria. The cardholder data environment is scoped deliberately, and whether a Report on Compliance or a self-assessment questionnaire applies is confirmed from the merchant or service provider level the card brands and the acquirer set, before the plan is fixed.

The same logs, tickets and reviews then serve the certification body, the QSA and the CPA firm. The certificate's surveillance audits, the annual PCI DSS assessment and the SOC 2 report period sit on one calendar, so engineers prepare once rather than three times a year, and disruption to the people who run the systems is kept low.

Sterling coordinates the whole programme with a single engagement team and one Effivity workspace, under a fee agreed up front instead of three separate budgets. Sterling prepares; it does not certify, assess or attest.