ISO/IEC 27001 vs SOC 2: which one do your customers want, or both?

The short answer, and what each one is

Start with who is asking. A vendor-risk team at a US enterprise will usually expect a SOC 2 report, preferably a Type 2; a tender panel or a customer outside North America is more likely to require ISO/IEC 27001 certification. Sell into both markets and you will be asked for both.

ISO/IEC 27001, currently the 2022 edition as amended in 2024, sets requirements for an information security management system: scope it, assess and treat risks, check your controls against the 93 in Annex A and keep improving. A certification body accredited to ISO/IEC 17021-1 and ISO/IEC 27006-1 audits it in two stages and decides whether to certify.

SOC 2 comes from the accounting profession. The AICPA presents its Trust Services Criteria as control criteria for attestation or consulting engagements, and a licensed CPA firm examines your controls against them and issues a report with its opinion. Nothing is certified, and no public register lists it.

Who asks for which: regions, sectors and procurement habits

Requests arrive in three typical shapes.

• A security review from a US enterprise. North American security and procurement teams routinely ask SaaS, cloud, payroll, fintech and outsourcing suppliers for a current SOC 2 Type 2 report. A certificate helps, but it does not answer that request.
• A tender or supplier pre-qualification. Public bodies, multinational groups and customers outside North America more often require a valid ISO/IEC 27001 certificate from an accredited body, with a scope covering the service offered.
• A global customer's questionnaire. Organisations with international supply chains often accept either, and some ask for both.

Customer location matters more than sector: outsourcing, managed-service and fintech providers with clients on several continents usually end up holding both. Collect the exact wording from recent questionnaires, contracts and tenders before you choose.

Scope and control models: an ISMS against a described system

ISO/IEC 27001 judges a management system. Its scope can be the whole organisation or a defined part, and no requirement in clauses 4 to 10 may be excluded. Controls follow from risk treatment, are compared with Annex A so nothing necessary is missed, and are recorded with their justification in the Statement of Applicability.

SOC 2 judges a system: the service clients depend on, as management describes it. Security is always in scope; availability, processing integrity, confidentiality and privacy are added where your commitments make them relevant. No control list is imposed: management designs controls to meet each criterion, and the points of focus are guidance rather than a checklist.

Underneath, the two converge on access, change, logging, incidents, suppliers and recovery. ISO/IEC 27001 adds management-system duties such as objectives, internal audit and management review; SOC 2 adds a formal system description, dated evidence across a period and explicit points such as governance oversight and fraud risk.

What you receive: a three-year certificate or a report on a period

ISO/IEC 27001 ends in a decision. After Stage 1, the certification body's readiness review, and Stage 2, the certification audit, you close any nonconformities and the body decides. The certificate names your scope and edition and stays valid for three years, subject to annual surveillance audits, before recertification. You can publish it, and customers can verify it with the issuing body.

SOC 2 ends in a report with no pass mark. A Type 1 covers the design of controls at one date; a Type 2 adds their operating effectiveness over a period, usually six to twelve months, and describes any exceptions. The report goes to clients under a non-disclosure agreement; a SOC 3 report is the general-use version. A new report is expected each year, with a bridge letter from your management covering the gap. See SOC 2 Type 1 vs Type 2: which report, and when.

Cost and effort: the logic behind each budget

For ISO/IEC 27001, the certification body sets audit time from headcount, sites and scope under ISO/IEC 27006-1, and that time drives its fee for the initial audit, surveillance and recertification. Internal effort goes into the management system as well as the controls.

For SOC 2, the CPA firm's fee follows the report type, period length, categories and the controls it samples, and recurs every year. The heavier internal cost is continuity: controls must leave dated records throughout the period.

Doing both does not double the effort, because the risk assessment, policies, controls and most records serve both. The ISO/IEC 27001 drivers are set out in ISO/IEC 27001 certification cost: what moves the price.

Doing both from one control set

Keep one control library in which each control has an owner, a frequency and a record, mapped to the Annex A controls it implements and the criteria it supports. One risk assessment, one internal audit programme and one management review then serve both. Align the ISMS scope with the SOC 2 system boundary.

Three mistakes that cost time and credibility

• Calling SOC 2 a certification. There is no SOC 2 certificate and no register. A "SOC 2 certified" badge tells an informed reader that nobody checked the claim; say instead that you hold a SOC 2 Type 2 report for a stated period.
• Assuming one replaces the other. A certificate does not answer a request for a SOC 2 report, and a report does not meet a tender that makes certification mandatory.
• Running two programmes on two evidence bases. Two risk registers that disagree, policies written twice and access reviews done in two formats waste owners' time and hand auditors contradictions.

ISO/IEC 27001 vs SOC 2: questions buyers ask