Menu
Do I need SOC 2 if I have ISO 27001?
Short answer
It depends on which market you sell into, and the two frameworks do not substitute for each other. SOC 2 is a confidential attestation report issued by a licensed CPA firm under AICPA standards. ISO 27001 is a public certification issued by an accredited certification body. US and Canadian enterprise procurement teams typically ask for SOC 2; EU, UK, and APAC customers ask for ISO 27001. If your pipeline spans both geographies, you will likely need both, but start with whichever framework your current largest deal requires. Some firms offer combined engagements that can cut total cost by 20 to 30 percent versus running two separate projects.
One of 8 SOC 2 buyer guides we maintain.
What people get wrong
Most people assume ISO 27001 satisfies SOC 2 requests from US buyers, but the two deliverables are structurally different (a confidential report with auditor opinion versus a public certificate), and US procurement questionnaires specifically ask for the SOC 2 report by name.
Why this comes up so often
Buyers who already hold ISO 27001 ask whether SOC 2 is duplicative work. The honest answer is: the audit work overlaps a lot, but the deliverable does not. A US enterprise procurement team running a security questionnaire is asking a literal question (do you have a SOC 2 report) and “we have ISO 27001 instead” rarely closes that question.
What overlaps and what does not
Both frameworks examine information security controls: access management, change management, incident response, vendor risk, and so on. A team that has implemented ISO 27001’s Annex A controls has done most of the work needed for SOC 2’s Common Criteria. The diverging part is the form and audience of the deliverable. ISO 27001 produces a public certificate buyers can verify against an accreditation registry. SOC 2 produces a confidential, NDA-gated report that contains the auditor’s opinion plus a description of every tested control and any exceptions found.
The combined-engagement option
Several firms run integrated SOC 2 + ISO 27001 engagements where one team performs both audits in parallel. When the underlying controls are the same, the cost savings come from shared evidence collection, walkthroughs, and documentation. Vendors typically quote 20 to 30 percent off the sum of two separate engagements. Worth asking for if both are on your roadmap within 12 months.
When you only need one
If your customer base is exclusively US (or US-led enterprise) and you have no near-term EU sales motion, SOC 2 alone is fine. If you sell exclusively into the EU, UK, or APAC and you have no US enterprise sales motion, ISO 27001 alone is fine. The “both” answer is for companies whose pipeline genuinely spans both regions.
Sources
Last verified 2026-05-13. Stale or wrong source? Email hello@soc2auditors.org.