ISO 27001 vs SOC 2: Differences, Overlap and Which to Choose

ISO 27001 vs SOC 2 is a choice between a certificate and a report. ISO/IEC 27001 is the international standard for an information security management system (ISMS): an independent certification body audits it and, if it conforms, issues a certificate valid for three years. SOC 2 is a US attestation: a licensed CPA firm examines the controls behind a service you provide against the AICPA’s Trust Services Criteria and gives its opinion in a detailed report.

The right one is whichever your customers ask for, and the two overlap so heavily that many companies selling into both the UK and the US hold both, built on one set of controls.

Sovereign Secure is ISO 27001 certified and provides ISO 27001 consultancy, with certification audits carried out by our partner certification body, MQA International. We do not issue SOC 2 reports; only licensed CPA firms can. We provide the penetration testing evidence that both frameworks rely on.

ISO 27001 vs SOC 2: what is the difference?

ISO 27001 certifies that you run a management system for information security. SOC 2 reports on whether the controls over a specific service met defined criteria. The table sets out the practical differences.

“SOC 2 certified” is common shorthand, but there is no SOC 2 certificate. Our SOC 2 compliance guide explains the Trust Services Criteria and how an examination works, and our comparison of SOC 2 Type 1 vs Type 2 explains the two report types. ISO describes the standard itself on its ISO/IEC 27001 page.

Is ISO 27001 better than SOC 2?

Neither is better; they answer different buyers. ISO 27001 suits companies selling in the UK, Europe or to the public sector. SOC 2 is the usual answer to a US supplier security review, and some US procurement teams accept nothing else.

Our guide to cyber security certifications in the UK compares both with Cyber Essentials and PCI DSS. If you are an early-stage SaaS or software company facing this choice for the first time, our guide to ISO 27001 for startups shows how to scope a lean ISMS and what it takes.

How much do ISO 27001 and SOC 2 controls overlap?

A great deal. Most of what the SOC 2 security criteria (the Common Criteria, CC1 to CC9) ask for has a counterpart in the ISO 27001 clauses or Annex A. The mapping below is a working guide, not an official crosswalk: your CPA firm and your certification body will each judge your controls against their own framework.

The differences are in what each audit looks at.

What does SOC 2 add to ISO 27001?

• A system description. Management writes a detailed description of the system, its boundaries, its subservice organisations (such as your cloud provider) and the controls your customers must run themselves, known as complementary user entity controls.
• Operating effectiveness over time. In a Type 2 report the CPA firm samples evidence across the whole period, so a control that lapsed for a month can appear as an exception.
• Optional categories. Availability, processing integrity, confidentiality and privacy each bring their own criteria. In ISO 27001 those topics are covered as far as your risk assessment requires.

What does ISO 27001 add to SOC 2?

• A management system. The ISO 27001 requirements in clauses 4 to 10 require context and interested parties, measurable objectives, internal audits, management review and continual improvement.
• A formal risk method. You define risk criteria, assess and treat risks repeatably, and justify every Annex A control you include or exclude in a Statement of Applicability.

Can ISO 27001 replace SOC 2?

Sometimes, but only if the customer agrees. ISO 27001 is not equivalent to SOC 2, because one certifies a management system and the other reports on how specific controls operated, but some US buyers accept an ISO 27001 certificate, the Statement of Applicability and a completed questionnaire instead of a SOC 2 report, while many enterprise procurement teams insist on a SOC 2 Type 2. Equally, a UK tender that asks for ISO 27001 will rarely accept a SOC 2 report. Check the contract wording before you commit to either.

Even where it cannot replace SOC 2, the certificate still counts inside one: the points of focus for CC4.1 list independent certification against established specifications, such as ISO certification, among the separate evaluations management can use to monitor its controls.

Can you do ISO 27001 and SOC 2 together?

Yes, and it takes far less effort than running them separately. The usual approach is to make the ISMS the backbone and map the SOC 2 criteria onto it:

1. Align the boundaries. Make sure the ISMS scope covers everything inside the SOC 2 system description, so one set of controls serves both.
2. Run one risk assessment. An ISO 27001 risk assessment that meets clause 6.1.2 can also serve for CC3, provided it considers the potential for fraud, which CC3.3 asks for explicitly.
3. Keep one control set. Map each control to its Annex A reference and its Trust Services Criteria, and note the evidence each auditor will ask for. An ISO 27001 gap analysis is a sensible starting point if you are not certified yet.
4. Plan one evidence calendar. Schedule recurring activities, such as access reviews, risk assessment, internal audit, disaster recovery tests and the penetration test, so they fall inside the SOC 2 period and before the ISO 27001 audit.
5. Expect two audits. The certification body and the CPA firm are separate organisations working to different standards, so plan for two rounds of fieldwork even when most of the evidence is shared.

If you already hold ISO 27001, the main new work for SOC 2 is the system description and evidence that every control operated throughout the period.

What penetration testing evidence does each framework expect?

Neither framework makes penetration testing an explicit requirement, but auditors for both expect to see how you find and fix technical vulnerabilities, and a recent independent test is the clearest evidence.

One test can serve both audits if its scope covers the ISMS scope and the SOC 2 system, and its date falls inside the SOC 2 period. Our pages on SOC 2 penetration testing and ISO 27001 penetration testing cover each in detail.

What drives the cost of ISO 27001 and SOC 2?

Certification bodies and CPA firms set their own fees, and preparation and internal time are a large part of the cost of either. The main drivers:

Why Sovereign Secure

• ISO 27001 certified ourselves, with ISO 27001 consultancy from gap analysis to certification. Certification audits are carried out by our partner certification body, MQA International, which makes the certification decision.
• Penetration testing evidence for both frameworks: web applications, APIs, cloud environments, networks and mobile apps, scoped to your ISMS and SOC 2 boundaries, plus vulnerability scanning, for the certification body and the CPA firm you appoint.
• A UK company since 2012, headquartered in Accrington, Lancashire, with an office in Los Angeles as well as Singapore, Dubai and Dhaka. We are also a PCI SSC Qualified Security Assessor (QSA) company, for platforms that handle card data.

Plan your route

Tell us which frameworks your customers are asking for and when. We can scope ISO 27001 consultancy and a penetration test that serves both audits. Contact us or call +44 161 523 5276.