ISO 27001 vs SOC 2: which one buyers need

ISO 27001 vs SOC 2: which one does your customer actually need?

ISO 27001 results in a certificate issued by an accredited certification body, valid for a three-year cycle with an audit in every calendar year. SOC 2 results in an attestation report written by a CPA firm. Both can show a customer that your controls are examined by someone independent, but they answer different questions and reach the buyer in different forms, so the first step is to read the request exactly. If a questionnaire, contract clause or regulator asks for an ISO 27001 certificate, a SOC 2 report will not satisfy it, and the reverse is also true. If the request says only "independent assurance of information security," ask the customer which form of evidence their procurement or risk team will accept and how they plan to verify it.

The organization owns its controls under either route. An implementation partner such as DeployOpen can plan the systems, configure the logging and access controls, and assemble the policies, records and evidence that an assessor will test. DeployOpen does not issue audit reports, attestations or certificates. Only an independent auditor, a CPA firm for SOC 2, or an accredited certification body for ISO 27001 can do that. Before you commit budget, confirm with the customer whether they will verify a certificate in the public IAF CertSearch database, or whether they expect to read a restricted SOC 2 report under a non-disclosure agreement, because that choice determines which evidence you need to prepare first.

How the two differ on issuer, cycle, scope and sharing

This table compares ISO 27001 certification and a SOC 2 report on who issues them, what they produce, how long they stay current, what they test against and who can read them. Read each row as a buyer deciding which assurance a vendor should show you, and check whether the artifact you receive matches the question you need answered.

Dimension	ISO 27001 certification	SOC 2 report
Who issues it	An accredited or unaccredited certification body audits the management system and decides on certification. ISO itself does not certify organizations.	A CPA firm performs the examination as an attestation engagement and issues the report.
What is produced	A certificate that states the scope of the information security management system certified against ISO/IEC 27001:2022.	A report with the auditor's opinion. A Type 1 addresses control design as of a specified date. A Type 2 adds operating effectiveness over a period and a description of the auditor's tests.
Assessment cycle	A three-year certification cycle with at least one audit, surveillance or recertification, in every calendar year.	An examination covering a specified period (Type 2) or a point in time (Type 1). It is not a multi-year certificate with annual audits.
Control basis	The 93 Annex A controls in four themes, plus the management system requirements in clauses 4 to 10, such as risk assessment, internal audit and management review.	The AICPA 2017 Trust Services Criteria for security, availability, processing integrity, confidentiality or privacy, applied to the entity, a subsidiary or a division.
How buyers verify it	Look up the certificate in the IAF CertSearch database, which ISO points to for accredited certificates. The certificate is a public document. Check the scope and the certification body's accreditation.	Ask the vendor for the report itself. Use of a SOC 2 report is generally restricted, so the vendor may require a non-disclosure agreement first.
Public alternative	Not applicable. The certificate is already public and verifiable.	A SOC 3 report covers the same subject matter in less detail and can be distributed freely. It does not replace the detailed Type 1 or Type 2 report for due diligence.
Standards that govern the issuer	Accredited certification bodies operate to ISO/IEC 17021-1 and ISO/IEC 27006-1:2024.	CPA attestation work follows the AICPA framework for attestation engagements. Confirm the firm's standards with the firm.
Common reason to request it	Customers and partners who need an externally certified management system with a public record.	Customers and partners who need a detailed, period-based view of controls and the auditor's testing.

Who issues an ISO 27001 certificate and who issues a SOC 2 report

ISO does not certify organizations. ISO publishes ISO/IEC 27001:2022, but an organization becomes certified only when a certification body audits its information security management system and issues a certificate. Accredited certification bodies work to ISO/IEC 17021-1:2015 together with ISO/IEC 27006-1:2024, the requirements that IAF MD 29:2024 required them to apply to all clients by 31 March 2026. Some bodies are unaccredited, and a certificate from one of them carries less weight with buyers and regulators. Before you rely on any certificate, confirm the body's accreditation with its accreditation body and check the certificate itself in IAF CertSearch, which ISO still points to for accredited certificates. Global ACI has assumed the IAF and ILAC roles since 1 January 2026, so ask the body which accreditation body granted its status.

A SOC 2 report is different in kind. A certified public accountant (CPA) firm performs a SOC 2 examination under AICPA attestation standards and signs an opinion on the service organization's controls against the 2017 Trust Services Criteria. There is no certificate and no accreditation body. The quality of the report depends on the firm's independence and competence, so ask whether the firm is independent of the parties that prepared your controls and whether the report type matches what your customers need.

The independence boundary is the same for both. Your organization owns its policies, controls, risk decisions and sign-off. An implementation partner, consultant or tool vendor can build systems, collect evidence and prepare documentation, but it cannot issue the output. Only the certification body (for ISO 27001) or the CPA firm (for SOC 2) can do that. Write this split into your statement of work: the partner's deliverables should stop at evidence and readiness, and the auditor's engagement letter should name the scope, criteria and dates. Avoid any arrangement where the party that wrote your controls also audits them.

What each framework tests: control sets compared

ISO/IEC 27001:2022 has two layers. Clauses 4 to 10 set the requirements for the management system itself: how the organization understands its context and interested parties, sets the scope, shows leadership commitment, plans risk treatment, provides resources and awareness, operates the ISMS, evaluates performance and improves it. A certification body audits these clauses in every audit, so they apply to the organization as a whole rather than to individual systems.

Context and scope (clauses 4.1 to 4.4): The organization defines the issues and interested party requirements that shape the ISMS and sets the scope that appears on the certificate.
Risk assessment and treatment (clauses 6.1.2 and 6.1.3): The organization identifies and analyzes information security risks, then produces a risk treatment plan and a Statement of Applicability.
Internal audit and management review (clauses 9.2 and 9.3): Management checks that the ISMS works through an internal audit programme and documented management reviews.
Nonconformities and improvement (clause 10): Findings lead to corrective action and continual improvement of the ISMS.
Annex A controls: Clauses 4 to 10 are paired with the 93 Annex A controls, which are normative and grouped in four themes: organizational (37), people (8), physical (14) and technological (34).

Before you compare with SOC 2, ask your certification body to show how each Annex A control is covered in your Statement of Applicability.

Why a SOC 2 Type 1 is not the same as a Type 2

A SOC 2 Type 1 report and a Type 2 report are not interchangeable, and a buyer who treats the label as the answer will misjudge the vendor. A Type 1 report addresses the suitability of control design as of a specified date: the auditor looks at whether the controls, as described by management, could meet the relevant trust services criteria at that moment. It says nothing about whether those controls ran consistently before or after that date. A Type 2 report adds operating effectiveness over a period, along with a description of the auditor's tests and the results of those tests. Before relying on either report, read the description of the system, the criteria in scope, the period covered and any listed exceptions. Those sections show what was actually tested.

ISO 27001 works on a different rhythm. Certification follows a two-stage initial audit, and the resulting certificate is valid for a three-year cycle with at least one audit in every calendar year, either surveillance or recertification. The certificate is a point-in-time statement that the management system met the standard at the time of the audit, kept up by annual checks, so it does not come with a test period in the way a Type 2 report does. A vendor holding both an ISO 27001 certificate and a SOC 2 Type 1 report has evidence of design at one date and a certified system under regular review, but neither document alone proves consistent operation over a year. Ask the vendor which of their controls were tested over an observation window and which were assessed only as designed.

Practical checks for the procurement team: confirm the report type and the exact dates in the report, not in the vendor's summary; read every exception and check whether the vendor has remediated it; and ask whether the period covers the months your contract will run. If a Type 1 is the only report available, consider it a starting point and ask for a timeline to a Type 2. Confirm details like the report period and carve-out treatment directly with the vendor and, where needed, with the CPA firm that issued the report, since the report itself is generally restricted to the vendor's stakeholders.

How customers verify an ISO 27001 certificate and a SOC 2 report

Buyers verify ISO 27001 and SOC 2 differently, because one is a public certificate and the other is a restricted attestation report. The cards below cover the checks a vendor review should include for each, and a regulator's proposed guide lists both as independent assessments to review (91 FR 58438).

Check the certificate in IAF CertSearch

An accredited ISO 27001 certificate can be looked up in the IAF CertSearch database, which ISO points to for checking accredited certificates. Since 1 January 2026, Global ACI has assumed the IAF role, so confirm the certificate's issuing body is accredited and that the certificate is current. Match the certified organization name and site list against the vendor you are assessing, and confirm the certificate is still valid on the day you check it.

Request a SOC 2 report under NDA

A SOC 2 report is an attestation issued by a CPA firm and its distribution is generally restricted. Ask the vendor for the full report under a non-disclosure agreement, and confirm the CPA firm that issued it. Check that the report covers the systems and services your contract uses, since a SOC 2 report only speaks to the scope the service organization and auditor defined.

Ask for a SOC 3 for public use

A SOC 3 report covers the same subject matter as a SOC 2 report in less detail and can be distributed freely. It suits public procurement portals, website trust pages and early screening questionnaires. It cannot replace the full SOC 2 report for due diligence, because it omits the auditor's tests and detailed exceptions that a reviewer needs.

Review the ISO scope and Statement of Applicability

The ISO 27001 certificate names the scope of the management system, and that scope is what the customer is buying. Read the scope for the products, services, sites and people it covers, and then ask for the Statement of Applicability to see which Annex A controls the organization applied and which it excluded, with justification. Exclusions that remove controls your data depends on are a reason to ask questions before signing.

Review the SOC 2 period and exceptions

A Type 2 report states the period over which operating effectiveness was tested and includes the auditor's test descriptions and any exceptions found. A Type 1 report reflects control design on one date only. Read the period against your contract dates, check whether a bridge letter covers the gap to today, and read every exception and management response, since exceptions show where controls did not work as designed.

When organizations pursue both, and in what order

The sequence lets one body of evidence serve two different assurance products, so the organization avoids building the same controls twice and knows which report each customer will accept before work starts.

Confirm the exact wording of the requirement
Ask the customer, contract owner or regulator to quote the clause that asks for assurance, and record whether it names ISO/IEC 27001, a SOC 2 report, a SOC 3 report, or a general independent assessment. Compliance or legal staff own this step, and the output is a written note filed with the request. The step is done when the named report or certificate, its report type and its scope are written down rather than inferred from a questionnaire.
Identify the audience and its usual expectations
Map which buyers, markets and regulators sit behind the demand. US financial customers often ask for a SOC 2 report, while international or multi-jurisdiction buyers often ask for an ISO 27001 certificate. Sales, account management and the security lead own this step. The output is a short list of audiences with the assurance each one usually accepts, marked as a working assumption until the customer confirms it in writing.
Decide whether to build one ISMS for both
Decide whether a single information security management system and a single set of controls can serve both demands, with a separate report or certificate for each. The CISO and leadership own the decision, and the record should show which systems, processes and locations are in scope for each assurance product. The step is done when the organization has agreed to one control environment, or has documented why two separate environments are needed.
Map shared controls and evidence once
Build a crosswalk between the Annex A controls in ISO/IEC 27001:2022 and the criteria in the AICPA 2017 Trust Services Criteria, using the AICPA's published mapping as a starting point and checking it against your own environment. Compliance and engineering staff own the mapping. The output is an evidence register that lists each control, its owner, its recurring evidence and the report or certificate it supports. Gaps appear where one framework asks for something the other does not.
Sequence the work so evidence is reused
Start with the controls and records both frameworks depend on, such as access reviews, change records, vendor reviews, incident handling and risk assessment, and make sure they are produced on a schedule that serves both audits. Platform and security teams own the work, often with an implementation partner preparing systems and evidence. The step is done when one evidence source can answer both an ISO 27001 auditor's sample and a SOC 2 auditor's test without a second collection exercise.
Plan the separate assessments with independent bodies
Agree with a certification body and a CPA firm, separately, which of them will examine the environment and on what timetable. The organization owns the controls, while each independent party issues its own report or certificate. The step closes when both engagements are scoped in writing and each assessor has confirmed the boundary it will test, so that no single firm is asked to certify or attest to the other's work.
Confirm accepted reports with each customer
Before committing to one path or both, ask each customer which report or certificate it accepts, whether a SOC 3 summary is sufficient for public use, and how it verifies the assurance it receives. Account managers and the compliance lead own this check. The step is done when each customer has confirmed its requirement in writing, and the answers are recorded so the sequence can be adjusted if a customer's demand changes.

What must be in place before either audit starts

Whether the target is an ISO 27001 certificate or a SOC 2 report, an auditor will first look at whether the boundary, controls and records already exist. The five items below are the foundations both audits depend on, and each one can be checked before a fee is paid.

A defined scope or system description

For ISO 27001, the ISMS scope under clause 4.3 states which parts of the organization, locations and services the certificate covers. For SOC 2, the system description defines the services, infrastructure, software, people and data that the report covers. Check that the boundary names the same systems a customer would ask about, because the certificate scope or report boundary is what buyers read first and what auditors sample from.

Controls designed and owned internally

Each control, whether an Annex A control in ISO 27001 or a criterion in the SOC 2 Trust Services Criteria, needs a documented design and a named owner inside the organization. Auditors test whether the design fits the risk and whether the owner runs it. Check that every control has a written procedure, an owner with authority to act, and a description of how it works day to day, not only a policy that states the goal.

Evidence collected over time

A SOC 2 Type 2 report tests operating effectiveness across an observation period, and ISO 27001 surveillance audits sample records from each year of the three-year cycle. Evidence therefore has to exist before the audit starts, not be assembled for it. Check that access reviews, change tickets, vulnerability scans and training records are generated on a schedule and kept in a retrievable form for the period the auditor will sample.

Current risk assessment and Statement of Applicability

ISO 27001 requires a documented risk assessment and risk treatment, and the Statement of Applicability records which of the 93 Annex A controls apply, why, and their status. SOC 2 has no equivalent document, but a current risk assessment still shows auditors how the control set was chosen. Check that the risk register is dated, that treatment decisions match the SoA, and that the SoA reflects the systems in scope today.

Internal audit and management review cycle

ISO 27001 clauses 9.2 and 9.3 require an internal audit programme and management review, and a certification body checks that both happened and that findings led to action. SOC 2 auditors look for similar monitoring evidence under the common criteria. Check that internal audits are planned, performed by someone independent of the area audited, and that management review minutes show decisions, owners and deadlines.

Your team, an implementation partner and the independent auditor

Your organization is the only party that can own the controls, the policies, the risk decisions and the scope of the management system or SOC 2 system description. No outside firm can accept those accountabilities on your behalf, and an assessor will ask who made each decision and when. Your team also runs the management review and the internal review cycle, which are the points where leadership shows it is actively steering security.

Scope and boundary: decide which systems, locations, services and people are in scope, and document the reasons for any exclusion.
Risk decisions: approve the risk assessment method, accept or treat risks, and sign off the treatment plan.
Policies and ownership: write, approve and assign owners for policies and procedures, and keep them current.
Management review: hold the periodic review where leadership examines security performance and records decisions.
Day-to-day operation: run access reviews, change approvals, incident handling and vendor follow-up as ongoing work, not as a project.

Before engaging any outside party, confirm which of these items your own staff can carry in practice and which need a named owner with time allocated to them.

How to check an auditor, certification body or implementer

A SOC 2 report and an ISO 27001 certificate are only as useful as the body behind them. The checks below apply whether you hire a CPA firm, a certification body or an implementation partner, and they separate the party that issues the assurance from the party that prepares your systems and evidence.

Confirm the right assessor for each framework

A SOC 2 report must come from a CPA firm performing an attestation engagement. An ISO 27001 certificate must come from an accredited certification body operating to ISO/IEC 17021-1 and ISO/IEC 27006-1:2024. Ask for the accreditation certificate and the scope it covers, then look up the certificate in IAF CertSearch before relying on it. An implementer cannot issue either assurance.

Confirm independence between implementer and auditor

The party that designs your controls should not be the party that tests them. Ask the implementer whether it has any ownership, reseller or referral arrangement with the auditor or certification body, and ask the auditor how it handles impartiality when a consultant has built the system. Clear separation protects the credibility of the report or certificate that your customers will read.

Ask for experience with your framework and stack

Ask which SOC 2 or ISO 27001 engagements the partner has supported, and for which kinds of systems. Ask how it would handle your cloud accounts, identity provider, endpoints and CI/CD pipeline, and which of those it has documented before. Ask the auditor how many engagements in your sector it has performed. Treat unverifiable claims as unverified, and ask for references you can contact.

Require a written fixed scope before work starts

Ask for a written statement of scope, deliverables, milestones and exclusions before any work begins. For ISO 27001, the scope should name the ISMS boundary and the Statement of Applicability deliverable. For SOC 2, it should name the trust services criteria in scope and the report type, Type 1 or Type 2. Fixed-scope agreements make changes visible and make cost comparisons between quotes meaningful.

Ask what evidence you will keep

Ask the partner to list every artifact it will hand over, such as policies, the risk register, access reviews, change records, logs and configuration baselines, and in what format. Confirm that you own those records and can give them to your auditor directly. The organization owns its controls, so the evidence should remain in your environment after the engagement ends.

Questions buyers ask before choosing ISO 27001 or SOC 2

Is ISO 27001 or SOC 2 legally required for our company?

Neither standard is a general legal requirement in the sources we rely on, so the answer depends on contracts, regulators and customer policies. ISO 27001 is a voluntary certification of an information security management system, and SOC 2 is an attestation report issued by a CPA firm. The Federal Reserve's proposed third-party risk guide for community banks (91 FR 58438) lists SOC 2 reports and ISO reports as examples of independent assessments a bank may review when judging a cybersecurity vendor. Ask each customer or regulator which report or certificate it accepts, in what form, and whether it expects a current one. That answer, not a general rule, sets your path.

Can the same controls serve both ISO 27001 and SOC 2?

Often yes, because much of the underlying work overlaps, but the outputs differ. The AICPA publishes a mapping of ISO 27001 requirements to the 2017 Trust Services Criteria, available to AICPA and CIMA members, which shows where the two sets line up. ISO 27001 Annex A lists 93 reference controls, and clauses 4 to 10 add management system duties such as risk assessment, internal audit and management review that a certification body audits. SOC 2 is organized around criteria chosen for your service commitments. Build one control library, then test whether each report's specific wording, scope and evidence period is met before you claim coverage.

How long is each cycle for ISO 27001 and SOC 2?

An ISO 27001 certificate runs on a three-year cycle, and a certification body must audit in every calendar year of that cycle, either as surveillance or recertification. This follows ISO/IEC 17021-1 as explained in the European Accreditation FAQs 51.7 and 37.12. A SOC 2 Type 1 report tests control design as of one date. A Type 2 report tests operating effectiveness over an examination period that your auditor and you agree on, and most buyers ask for a recent period that ends close to the request date. Confirm with your CPA firm how long the examination period will be and when the report will be issued.

What drives the cost, and where do exact fees come from?

Cost depends on the size and complexity of the scope, the number of people and sites in scope, the number of systems, the report type, and the internal effort your team spends preparing evidence. For ISO 27001, certification body audit fees recur across the three-year cycle and rise with audit time. For SOC 2, the CPA firm's examination fee depends on the criteria, the examination period and the sample testing required. No fee figure is supplied for this comparison, so use the auditor's or certification body's written quote as the source. Ask each to itemize initial work, annual audits or examinations, travel, re-audit fees and any additional scope costs.

Can our own team do the work without outside help?

Yes, many organizations prepare internally, provided someone owns the management system or control set, the scope is clear and the team has time to produce consistent evidence. ISO 27001 requires the organization to own its risk assessment, Statement of Applicability, internal audit and management review, so these cannot be handed off entirely. Check whether your team can run an internal audit that a certification body accepts, and whether it can sustain evidence across the full cycle. The auditor or certification body issues the report or certificate in every case, so independence from whoever prepares your evidence matters.

What can an implementation partner take off our hands?

A partner can plan the work, build or configure systems, prepare technical evidence, document procedures, run gap assessments and support readiness reviews. DeployOpen plans, implements, hardens, backs up, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks, and prepares systems and evidence for compliance assessments. It does not issue audit reports, attestations or certifications, and it does not replace the risk owners who must make your decisions. Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts, and any fee follows from that written scope.

Which should a US financial vendor expect to be asked for?

A US financial vendor should expect to be asked for independent assurance, and the proposed Federal Reserve guide for community banks names SOC 2 reports and ISO reports among the assessments a bank may review. The guide also lists SSAE 18 SOC reports among assessments a community bank may rely on. Most bank due diligence asks for a SOC 2 Type 2 report, and some ask for ISO 27001 as well, especially for international operations. Confirm the exact report type, period and scope with each bank's third-party risk team, and check their current guidance, because the Federal Reserve guide is a proposal.

Should we pursue ISO 27001 and SOC 2 together?

Pursue both when customers in different markets ask for different assurance, since the two reports answer different questions. A SOC 2 report gives a CPA's opinion on controls for your services, while an ISO 27001 certificate shows an accredited body has audited your management system against the standard and can be verified publicly. Sequence the work so one control library and one evidence repository serve both, and confirm scope definitions early, because a certificate's scope and a SOC 2 system description can differ. Ask your certification body and CPA firm how they will each use shared evidence before you start.

How DeployOpen prepares the evidence for your audit

DeployOpen is a Chainscore Labs company that plans, implements and documents self-hosted open-source platforms inside your own infrastructure. We prepare systems, controls and evidence for an ISO 27001 certification body or a SOC 2 CPA firm, but we do not issue reports or certificates; those come only from the independent auditor or certification body you choose.

How we scope

Each engagement starts with a written scope that names the framework, systems and sites covered.
The scope states which ISO 27001 clauses or SOC 2 criteria the work will address and what is excluded.
Engagements are fixed-scope, so deliverables and timelines are agreed in writing before work starts.

How we build

We configure self-hosted tools in your cloud accounts, data centers or air-gapped networks to run the controls.
Policies, the Statement of Applicability and control records are drafted for your review and ownership.
We test the technical controls and record results so you can show how they operated during the period.

How we hand over

You receive documented configurations, runbooks and an evidence index mapped to your chosen framework.
Evidence is organized by control so your auditor can sample items without rebuilding the trail.
Your team is trained to collect and maintain evidence after the engagement closes, without relying on us.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after the initial engagement.
Retainers can cover evidence refreshes ahead of surveillance audits or the next SOC 2 examination period.
Ask any prospective partner to confirm in writing which parts of the audit remain with your own staff.