United States · Guide
Do US Companies Need Both SOC 2 and ISO 27001?
Most US companies need one first, not both. Start with the one your buyers name: usually SOC 2 for US enterprise customers and ISO 27001 for many overseas buyers and tenders. Add the second when a named deal or market requires it. Because the core controls are shared, the second is an added layer, not a restart.
Did you know SOC 2 or ISO 27001 can cost less than US$10,000, all-inclusive? If you've been quoted more, talk to us before you sign.
100% success, on time: the Sterling Promise
We stay with you until your agreed outcome is achieved, through consulting, audit preparation and the resolution of audit findings. The engagement defines the standard, scope, outcome and responsibilities; your organization puts the agreed controls into use; a US-licensed CPA firm issues the SOC 2 report; an accredited certification body issues the certificate, and that decision stays independent.
Done for you, end to end
We write the policies, set up the controls and evidence, run the internal audit and coordinate the independent audit. You deal with one team from first call to final report.
Simple and quick
A free gap assessment, then one plan with dates from day one. Effivity, our GRC automation platform, is included to keep the evidence moving.
8,100+ client engagements
In 60+ countries over 20+ years, with experts who bring 30+ years of experience.
Under US$10,000, all-inclusive
For most start-ups and SMEs: SOC 2, ISO 27001, ISO 42001, HIPAA or ISO 9001, including the independent audit. A fixed quote follows a free gap assessment.
Included in every engagement
Every Sterling consulting engagement comes with the following, so you are not buying extras to get to the finish line:
- Effivity, Sterling's GRC automation platform, with a full-year subscription, to run your controls, evidence, tasks and audits in one place.
- Sterling Academy: preferential course access, with complimentary awareness training for your people.
- Internal auditor training for your audit team, as applicable to your standard.
- For information-security engagements, a vulnerability assessment.
These are part of the engagement, not a separate purchase. The details depend on the standard you are working toward, which we confirm during the free gap assessment.
Consulting and auditing are always separated: the people who consult never audit you. That keeps your internal audit objective and protects the independence of the CPA firm, Qualified Security Assessor or certification body that performs the final step.
Behind this are 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience.
All-inclusive pricing for start-ups and SMEs
Did you know SOC 2 or ISO 27001 can cost less than US$10,000, all-inclusive? If you've been quoted more, talk to us before you sign.
Sterling's all-inclusive fee for SOC 2, ISO 27001, ISO 42001, HIPAA or ISO 9001 is under US$10,000 for most start-ups and SMEs. It covers our done-for-you consulting and the independent audit: the SOC 2 report from a US-licensed CPA firm, as AICPA standards require, or the certification audit by an accredited certification body. For HIPAA, it covers HIPAA compliance consulting and an independent HIPAA assessment. Effivity, training and a vulnerability assessment are included. That's less than a month's cost of an in-house security hire: the US Bureau of Labor Statistics puts the national median annual wage for information security analysts at $129,180 (May 2025), about $10,765 a month in pay alone[1].
A fixed quote follows a free gap assessment.
What the fee covers, and what it doesn't:
- It is the fee for your first SOC 2 report or your first certification only.
- Annual work is always additional and billed the following year: later SOC 2 report periods, and ISO surveillance and recertification audits.
- It assumes a typical start-up or SME scope: one product or service and one main location.
- Larger or multi-site scopes get a fixed quote after the gap assessment.
- PCI DSS is quoted separately: a fixed quote follows a free gap assessment.
[1] Occupational Employment and Wage Statistics, May 2025: 15-1212 Information Security Analysts, national annual median wage. US Bureau of Labor Statistics. accessed October 23, 2026.
The answer for most US companies: one first, the second when a deal requires it
What you get from deciding well. The deal in front of you unblocks first, and nothing you build is wasted when the second standard arrives.
Few US companies need both on the same day. The costly errors run in opposite directions: buying both before any buyer has requested either, or ignoring ISO 27001 after a buyer in a new region has named it.
A quick reminder of who issues what: a US-licensed CPA firm issues the SOC 2 report, as AICPA standards require[1][2], and an accredited certification body issues the ISO 27001 certificate. Sterling coordinates either route end to end and never certifies. New to the difference? Read SOC 2 vs ISO 27001 first.
Seven US situations and the route each points to
Find the row closest to where your company stands today.
| Your situation | Route | Why |
|---|---|---|
| Selling to US mid-market and enterprise software buyers | SOC 2 first | US security reviewers request it by name |
| Selling mainly into Europe, the UK, the Middle East or Asia | ISO 27001 first | Buyers and tenders there often name it |
| US company landing its first overseas customer | SOC 2, then ISO 27001 | The second reuses the core already built |
| Public-sector or regulated tender naming ISO 27001 | ISO 27001, SOC 2 later | The tender sets the requirement |
| Raising a US round, no buyer has asked yet | Gap assessment only | A dated plan, without premature audit spend |
| Current contracts name both | Both, on one shared core | One build, two outputs |
| Handling card or health data | Add PCI DSS or HIPAA work | Separate regimes, scoped on their own |
Which comes first for a US company, and why the order matters less than you think
Revenue decides the order. Put first the standard that unblocks the earliest US or overseas revenue, and design the work so the second inherits from it.
- SOC 2 first. You get a Type 2 report US buyers recognize, and the controls you run during the observation period become operating evidence for a later ISO audit.
- ISO 27001 first. You get a structured management system, a risk assessment and an internal audit program, which make the later SOC 2 system description quicker to write.
Neither order is wrong. See the SOC 2 timeline and the ISO 27001 timeline for the calendars.
Signals in your US pipeline that it is time to add the second standard
Act on evidence, not on guesswork. Run a gap assessment for the second standard when you see any of these:
- Overseas questionnaire. A buyer outside the US names ISO 27001 and nothing else.
- US enterprise request. A large US customer requests a SOC 2 report while you hold only ISO 27001.
- Tender or framework. A bid you want to win lists one of the two as mandatory.
- New entity or region. You are opening an office, subsidiary or data region abroad.
- Investor or acquirer. Diligence asks which assurance you hold and the gap is visible.
None of these means starting tomorrow. Each means checking how much of the second standard you already have.
What both cost a US start-up
One fee per standard, all-inclusive. For most start-ups and SMEs, Sterling's all-inclusive fee for a first SOC 2 report or a first ISO 27001 certification is under US$10,000, including the independent audit. It assumes a typical scope of one product and one main location, and annual work is billed the following year; the pricing note on this page sets out the conditions. For a combined scope, a fixed quote follows a free gap assessment, because the figure depends on how much of the shared core already exists.
The effort saving is separate from fees: evidence collected once serves two audiences, and Effivity, included with a full-year subscription, maps one control to more than one standard.
Where US companies running both go wrong
- Two projects, two policy sets. Maintenance doubles and documents contradict each other. Keep one policy set with a short mapping to each standard.
- Mismatched boundaries. If the SOC 2 system covers one product while the ISO scope covers the whole company, a careful US buyer will ask why. Align the scopes deliberately, or write down the reason they differ.
- Both audits in one month. The same people answer evidence requests for each. Stagger the dates; Effivity's task calendar makes the stagger visible.
- Loose claims. A SOC 2 report is not an ISO certificate, and the reverse is also true. Name each document correctly in questionnaires and on your trust center.
Five questions for your US leadership team before you commit
A one-page decision. Put these to whoever runs sales, product and finance, and write the answers on a single page:
1. Blocked deals. Which deals in the next two quarters are stalled for lack of assurance, and what exact document do they name? 2. Markets. Which countries or regions do we plan to enter within twenty-four months? 3. Contracts. Do any current or target MSAs, RFPs or framework agreements name a specific standard or report type? 4. Ownership. Who inside the company will run the controls day to day? 5. Diligence. What would a US investor or acquirer ask to see?
That page is where our gap assessment starts. Often it shows the pipeline has already made the one-or-both decision for you.
What we recommend for most US start-ups (Sterling's recommendation)
This recommendation is Sterling's own, drawn from 8,100+ client engagements in 60+ countries over 20+ years. It is not an AICPA or ISO rule.
1. Choose the first standard from the wording in your contracts and questionnaires. 2. Run one gap assessment covering both, so you see the overlap before paying for any audit. 3. Build the shared core once and give every control a single owner. 4. Add the second standard when a named buyer, tender or market requires it. 5. State status exactly: "SOC 2 report issued" or "ISO 27001 certificate issued" only once it is true.
Each standard is covered in depth on the SOC 2 hub and the ISO 27001 hub.
Get started with one gap assessment that answers both questions at once.
How Sterling delivers SOC 2
A SOC 2 engagement has one deliverable that no consultant can hand you: the report. The SOC 2 report is issued by a US-licensed CPA firm, as AICPA standards require[1]. What Sterling does is make sure you get there ready, and that nothing between today and the report lands on your desk.
With Sterling, you deal with one team from start to finish. We coordinate:
- a readiness review and a gap assessment against the Trust Services Criteria;
- the policies, procedures and controls you need, written for how your company actually works;
- evidence collection, so the examination does not become a scramble;
- an internal audit before the examiner arrives, carried out by people who did not advise you on the controls;
- the Type 1 or Type 2 path that fits your deal timeline, and the examination itself, including scheduling, requests and follow-ups.
Our experts bring 30+ years of experience, and the firm has completed 8,100+ client engagements in 60+ countries over 20+ years. You get a single plan, a single point of contact and a clear view of what happens next.
[1] SOC (System and Organization Controls) Suite of Services. AICPA & CIMA. accessed October 23, 2026.
How Sterling delivers ISO certification
ISO management system standards such as ISO/IEC 27001, ISO/IEC 42001 and ISO 9001 are certified by an accredited certification body, not by a consultant[1]. Sterling never certifies. The certificate carries the name of the body that issued it, and that independence is what makes it credible to your buyers.
What Sterling does is prepare your company so that the certification body's audit goes smoothly. We coordinate:
- a gap assessment against the standard;
- the management system itself: scope, risk assessment, policies, procedures and records, sized for your company;
- training for your people and an internal audit before the certification audit;
- management review and corrective actions;
- the certification audit process, from choosing an accredited body to closing any findings.
Consulting and auditing are always separated. The people who consult never audit you, so the internal audit is a genuine test and the certification body's audit is independent.
Sterling has completed 8,100+ client engagements in 60+ countries over 20+ years, and our experts bring 30+ years of experience.
[1] About the IAF MLA (multilateral recognition arrangement). International Accreditation Forum (functions transferred to Global Accreditation Cooperation Inc., 1 Jan 2026). accessed October 23, 2026.
Sources
1. System and Organization Controls: SOC Suite of Services. AICPA & CIMA. accessed October 23, 2026.
2. SOC 2 Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy. AICPA & CIMA. accessed October 23, 2026.
3. 2017 Trust Services Criteria (With Revised Points of Focus - 2022). AICPA & CIMA. accessed October 23, 2026.
4. 2018 SOC 2 Description Criteria (With Revised Implementation Guidance - 2022). AICPA & CIMA. accessed October 23, 2026.
Information only
The information on this page is provided for general informational purposes only. It is not legal advice, and it is not a substitute for advice from a qualified attorney about your own situation.
Requirements depend on your scope, your customers' contracts, your industry and the regulations that apply to you. Two companies asking for the same standard can have very different obligations. We confirm yours during a gap assessment, and we update our content as standards change, but you should check the current text of any standard or rule that matters to you.
Sterling consults and prepares. It does not decide whether you meet a standard. That decision belongs to the independent party that performs the final step: the US-licensed CPA firm for a SOC 2 report, the Qualified Security Assessor or acquirer for PCI DSS, and the accredited certification body for ISO certificates. Timelines and outcomes depend on your readiness and on those parties.
Standards and marks named on this site belong to their respective owners.
FAQs
Frequently asked questions
Do I need both SOC 2 and ISO 27001?
Most companies need only one at first. SOC 2 serves most US enterprise buyers, and ISO 27001 serves many buyers abroad and some tenders. Add the second when a named buyer, tender or market requires it. A single gap assessment shows how much of the second you already have, so the decision rests on evidence rather than a guess.
Can we do both at the same time?
Yes. Some companies do when current contracts name both. The shared core is built once and each standard adds its own layer. The total work is larger than one standard alone, so the plan and calendar should reflect that, with the two independent audits staggered. Ask for a combined scope during the free gap assessment.
Will a SOC 2 report satisfy a buyer who requests ISO 27001?
Usually not by itself. When a contract names ISO 27001, the buyer generally expects a certificate from an accredited certification body. A SOC 2 report shows strong controls but is a different document. You may be able to discuss an alternative with the buyer, but plan on being asked for the document the contract names.
Does one audit cover both?
No. A US-licensed CPA firm performs the SOC 2 examination, and an accredited certification body performs the ISO 27001 audit. They are separate, independent steps with separate outputs. Sterling coordinates both through one engagement, and the people who consult for you never perform either audit, which keeps each one independent.
Is doing both twice the price?
Not twice the effort, because the core work is shared. Sterling's all-inclusive fee for either standard is under US$10,000 for most start-ups and SMEs for the first report or certificate, under the conditions in the pricing note. A combined scope gets a fixed quote after the free gap assessment, based on what you already have.
Which should a US AI or healthtech company start with?
Apply the same test: follow the buyer. US healthtech buyers often request a SOC 2 report and may also need HIPAA work; AI companies selling globally may meet ISO standards, including ISO/IEC 42001. Those cases can involve further standards, so the gap assessment is the right place to set the sequence across all of them.
What if we do neither yet?
You can still answer US buyers accurately with written policies, a completed questionnaire and a dated plan. A gap assessment gives you the evidence for that plan without committing to an audit. Many companies stay at this stage until a first enterprise deal, tender or funding round makes a report or certificate necessary.
Keep exploring
More in Compliance guides for US companies
Compliance guides for US companies
Free gap assessment
Start with a free gap assessment
Not sure where you stand? Start with a free gap assessment. In one conversation, a Sterling consultant looks at what your customers, investors or contracts are asking for, compares it with what you have in place today, and tells you what is missing, in what order to fix it and how long it is likely to take.
usa@sterling-grc.com+1 201 263 4443 (global headquarters) · A Sterling consultant replies within one working day
What would you like to achieve?
Choose a starting point. The enquiry form asks for your name, work email, phone with country code and company.
Book my free gap assessmentContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice