ISO 27001 vs SOC 2: Which One Do Your Customers Actually Need?

Key takeaways

• Different outputs: ISO 27001 ends in a certificate for a defined ISMS scope. SOC 2 ends in a detailed report that describes your system and the auditor's tests, usually shared under NDA.
• Different auditors: ISO 27001 certificates come from certification bodies. Only licensed CPA firms can issue SOC 2 reports.
• Different markets: SOC 2 is an AICPA (US) framework, and in our audit work US buyers, especially of SaaS, ask for it most. ISO 27001 is an international standard and is the reference we see most often in Europe, the UK, the Middle East and Asia.
• Large overlap: both are risk based and many controls map to each other. The AICPA publishes mappings between its criteria and other frameworks, so the second one reuses much of the work of the first.
• Decide by contract: read what your largest customers and target markets actually ask for before you choose.

What is ISO 27001?

ISO/IEC 27001 specifies requirements for establishing, implementing, maintaining and continually improving an information security management system. The current edition is ISO/IEC 27001:2022, which was amended in 2024 to add climate change considerations (ISO).

The standard has two parts that matter for an audit. Clauses 4 to 10 set management system requirements: context, scope, leadership, risk assessment and treatment, objectives, support, operation, performance evaluation and improvement. Annex A lists a reference set of 93 information security controls in four themes: organizational, people, physical and technological. You decide which controls apply through your risk assessment and record the decision in a Statement of Applicability.

Certification is voluntary. A certification body audits the ISMS in two stages, issues a certificate for the agreed scope, and returns for surveillance audits during the three-year certificate cycle (ISO/IEC 17021-1). The certificate itself is short: it names the organization, the scope, the sites and the standard. See our ISO 27001 certification page for how the audit works in practice.

What is SOC 2?

SOC 2 is one of the AICPA's System and Organization Controls (SOC) services. A CPA firm examines a service organization's controls relevant to security, availability, processing integrity, confidentiality or privacy. The examination uses the AICPA's 2017 Trust Services Criteria (with revised points of focus, 2022), and the company describes its system using the 2018 SOC 2 Description Criteria (AICPA). Security is always in scope; the other four categories are added when they matter to customers.

There are two report types:

• Type 1 covers the description of the system and whether the controls are suitably designed, at a point in time.
• Type 2 adds whether the controls operated effectively over a period, with the auditor's tests and results. In our experience, enterprise security reviewers usually ask for Type 2 because it shows how controls worked over time.

A SOC 2 report is intended for customers and other parties who understand the system, so it is normally shared under NDA. A SOC 3 report is a short general-use version that can be published, but it leaves out the detailed tests.

The AICPA has recently warned about quality in this market. Its SOC resource page carries a notice that it is looking into anonymously published allegations about the business practices of a compliance vendor offering SOC services (AICPA), and it issued a May 2026 peer reviewer alert on risks observed in SOC 2 engagements. If a provider promises a report in days, ask which licensed CPA firm signs it.

ISO 27001 vs SOC 2: the key differences

The two approaches share a goal but differ in almost every practical detail.

Three differences matter most in sales conversations.

First, a certificate versus a report. An ISO 27001 certificate tells a customer that an independent body found your ISMS conforming for a stated scope. A SOC 2 Type 2 report shows the customer your controls and how each was tested over the period, including any exceptions. Security reviewers who want to read the test results prefer SOC 2; in our experience, procurement teams who want a simple yes or no often accept ISO 27001.

Second, a management system versus a control set. ISO 27001 asks you to run a system: assess risk, set objectives, audit yourself and review results at management level. SOC 2 focuses on whether the controls you describe exist and work. In practice a mature SOC 2 program needs much of the same governance, but ISO 27001 makes it explicit.

Third, the auditor. A SOC 2 report signed by anyone other than a licensed CPA firm is not a SOC 2 report. For ISO 27001, check that the certificate's scope will cover the product and sites your customer buys before you choose a provider.

Which one do your customers actually need?

Start with the documents your customers send you, not with the frameworks.

1. List your top 10 customers and prospects. Note their country and the exact wording in their security questionnaire, master services agreement or data processing agreement.
2. Count what is named. If most name SOC 2, start there. If most name ISO 27001, or are mostly in Europe, the UK, the Middle East or Asia, start with ISO 27001.
3. Check for "or equivalent" wording. Some questionnaires accept either. Ask the customer before you commit to a second program.
4. Consider your next market. A US company selling into Europe, or a European company entering the US, may be asked for the other one as its customer base grows.
5. Plan the second one early. Write your policies, risk register and control evidence so that both a certification body and a CPA firm can use them.

A worked example

The scenario below is hypothetical and simplified. A 40-person SaaS company in Germany sells an HR platform. Its pipeline has three German manufacturers, one UK retailer and two US prospects.

• The German and UK contracts name ISO/IEC 27001 in their supplier security clause. One US prospect's questionnaire asks for a SOC 2 Type 2 report; the other accepts "SOC 2 or ISO 27001 or equivalent".
• Five of six deals accept ISO 27001, so the company builds its ISMS first and scopes it to the HR platform, its cloud hosting and the support team.
• It writes its policies and keeps its evidence (access reviews, change tickets, incident records) so a CPA firm can test the same controls later.
• When the US deal that requires SOC 2 reaches contract stage, it engages a CPA firm, starts a Type 2 observation period and reuses most of its ISMS evidence.

The point is the order of decisions: read the contracts, start with the framework most of them name, and design the evidence once.

Can you do both?

Yes, and many companies do. Because both are risk based and cover similar control areas (access control, change management, incident response, supplier management, logging and monitoring), one set of policies and evidence can serve both audits. The AICPA publishes mappings between the Trust Services Criteria and other frameworks to help with this (AICPA).

The audits stay separate. A certification body cannot issue a SOC 2 report, and a CPA firm's SOC 2 opinion is not an ISO 27001 certificate. Plan the timing so that the ISO surveillance audit and the SOC 2 testing period use the same evidence without doubling the work for your team.

### A sample control mapping

The table shows how a few common ISO/IEC 27001:2022 clauses and Annex A controls line up with the AICPA Trust Services Criteria. It is an illustrative extract, not the official mapping; use the AICPA's published mapping for your actual gap analysis (AICPA).

Criteria starting with CC are the Common Criteria for Security, which every SOC 2 report includes; criteria starting with A belong to the optional Availability category.

Timelines and cost drivers

Timelines. An ISO 27001 certification audit runs in two stages: Stage 1 reviews readiness and documentation, Stage 2 tests whether the ISMS works in practice. The certificate then runs for three years with surveillance audits in between (ISO/IEC 17021-1).

A SOC 2 Type 1 report covers one date. A Type 2 report covers a period of operation, and the AICPA does not set one fixed length; in the SOC 2 reports our clients share with us during ISO audits, the period commonly covers 6 to 12 months, and a first report can use a shorter period. Before either audit, most of the calendar time goes into building the controls and collecting evidence.

Cost drivers. We do not publish price ranges here because they depend on your scope. What moves the cost of both is the same: the number of people and sites in scope, the number of systems and cloud services, how many controls already exist, and for SOC 2, which Trust Services Criteria you include and how long the observation period is. Ask any provider to break its quote down by these items. Contact us for an ISO 27001 quote based on your scope.

Common mistakes

1. Choosing by reputation instead of by contract. The "better" framework is the one your customers accept.
2. Treating SOC 2 Type 1 as the finish line. A Type 1 report shows design at one date; reviewers who want evidence of operation over time will ask for Type 2.
3. Scoping too narrowly. An ISO 27001 scope that excludes the product your customer buys, or a SOC 2 system description that leaves out key subservice providers, will raise questions in review.
4. Buying a "fast" SOC 2 without checking who signs it. The AICPA's 2026 warnings are a reason to ask.
5. Running two separate programs. In our audit experience, duplicate policies and evidence can nearly double the effort for little extra assurance.

Next step

If your customers ask for ISO 27001, EUROTECH can audit your ISMS and explain each stage of the process; see how to get ISO certified. If they ask for SOC 2, you will need a licensed CPA firm for that report; an ISO 27001 ISMS gives that audit a strong starting point. Contact us to discuss your scope.

Sources

• ISO, ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection: Information security management systems: Requirements.
• AICPA and CIMA, System and Organization Controls: SOC Suite of Services, including the 2017 Trust Services Criteria (revised points of focus, 2022), the 2018 SOC 2 Description Criteria, criteria mappings and the 2026 notices on SOC 2 quality. Retrieved 19 October 2026.
• ISO, ISO/IEC 17021-1:2015 Conformity assessment: Requirements for bodies providing audit and certification of management systems.
• AICPA and CIMA, Peer Reviewer Alert, May 2026 edition.

About the author

Ersin Çetin is a lead auditor with more than 25 years of experience in management system audits, including ISO 9001, ISO 14001 and ISO/IEC 27001. This article explains the published standards and AICPA guidance as of 20 October 2026; it does not reproduce ISO or AICPA text and is not legal advice. EUROTECH Certification, the publisher of this article, offers ISO 27001 certification and does not issue SOC 2 reports.

Editorial standards: we cite ISO and AICPA publications directly, give edition or retrieval dates for every reference, and mark examples as hypothetical. If you spot an error, tell us through our contact page and we will correct it.