Menu
A SOC 2 framework comparison chart maps the Trust Services Criteria against other programs so you can see overlapping controls, unique gaps, and which native artifact each buyer still expects. Use it to plan ISO 27001, HIPAA, and PCI DSS around a SOC 2 report while keeping each program’s native artifact.
The compliance frameworks hub answers which program applies at all. This page answers a narrower question: once SOC 2 is on the roadmap, what do ISO 27001, HIPAA, and PCI DSS still require, and when does a SOC 2+ examination help.
Current framework status. ISO/IEC 27001:2013 certificates expired on October 31, 2025. PCI DSS v4.0.1’s formerly future-dated requirements have been mandatory since March 31, 2025. The January 2025 HIPAA Security Rule proposal is still a proposal; HHS’s July 2026 regulatory agenda projects final action in July 2027.
What does a SOC 2 framework comparison chart show?
It shows, on one grid, how SOC 2 differs from ISO 27001, HIPAA, and PCI DSS on trigger, control style, assessor, and output — then which of those outputs a SOC 2 report cannot stand in for. The useful unit is the artifact a customer, regulator, or payment brand will accept, not a generic “compliance” badge.
SOC 2 is an AICPA attestation. A licensed CPA firm examines controls in a described service-organization system against selected Trust Services Criteria. Security (the Common Criteria) is mandatory; Availability, Processing Integrity, Confidentiality, and Privacy are added when the service commitments call for them. Type 1 tests design at a date; Type 2 tests design and operating effectiveness over a period. That Type 1 / Type 2 choice belongs on the Type 1 vs Type 2 guide.
The other three programs are not SOC 2 with extra rows:
- ISO 27001 certifies an Information Security Management System (ISMS), currently ISO/IEC 27001:2022 with 93 Annex A reference controls.
- HIPAA is a US legal obligation for covered entities and business associates that handle protected health information (PHI). There is no HHS-issued HIPAA certificate.
- PCI DSS is a payment-brand standard for entities that store, process, or transmit account data, or that can affect the cardholder data environment. PCI SSC does not issue a certificate.
In CBIZ’s 2024 SOC benchmark, which reviewed 73 SOC 2 reports, Availability appeared in 75.3%, Confidentiality in 64.4%, and 9.6% were issued as SOC 2+ (additional framework criteria in the same report). That is a convenience sample, not a census of all SOC 2 reports. Source: CBIZ 2024 SOC Benchmark Report.
How do SOC 2, ISO 27001, HIPAA, and PCI DSS compare?
SOC 2 produces a CPA attestation report; ISO 27001 produces an accredited certificate; HIPAA is ongoing legal compliance with no official certification; PCI DSS produces an SAQ or QSA-led ROC and AOC set by the compliance-accepting entity.
| Attribute | SOC 2 | ISO 27001 | HIPAA | PCI DSS |
|---|---|---|---|---|
| Decision trigger | A customer, contract, or vendor-risk program asks for assurance over a service. | Procurement asks for an information-security management-system certificate, often outside the US. | A BAA or health-data workflow creates US Privacy, Security, and Breach Notification duties. | The entity’s payment role, account-data flow, or ability to affect CDE security creates scope. |
| What it is | AICPA attestation using the 2017 Trust Services Criteria (revised points of focus 2022). | International ISMS standard, ISO/IEC 27001:2022. | US federal law (HIPAA, HITECH, Omnibus), enforced by HHS OCR. | Contractual security standard, current version 4.0.1. |
| Governing body | AICPA; examination by a licensed CPA firm. | ISO/IEC; certification by an accredited certification body. | HHS Office for Civil Rights. | PCI Security Standards Council; validation path set by brands, acquirers, or other programs. |
| Control model | Criteria-based. Management designs controls that meet the selected criteria and service commitments. | Risk-based ISMS plus a Statement of Applicability against Annex A’s 93 reference controls. | Privacy, Security, and Breach Notification Rules, including required and addressable Security Rule implementation specifications until a final rewrite lands. | Twelve requirements with defined testing procedures; v4.x also permits a customized approach. |
| Primary output | Restricted-use Type 1 or Type 2 report (assertion, system description, opinion, tests). | Publicly verifiable certificate, typically on a three-year cycle with surveillance audits. | No official certificate. Evidence is the risk analysis, policies, BAAs, and control operation OCR or a customer can inspect. | Applicable SAQ or Report on Compliance, plus an Attestation of Compliance. |
| Who performs it | Independent licensed CPA firm. | Accredited certification body, separate from the consultant who built the ISMS. | The entity itself, often with a third-party assessment; OCR investigates and audits. | Eligible self-assessment or a QSA, as the compliance-accepting entity requires. |
| Cadence | Reporting period and customer expectations; many organizations renew annually. | Surveillance in years 1–2; recertification in year 3. 2013 certificates expired 31 Oct 2025. | Continuous legal duty. The Security Rule in force is still the current rule. | Annual revalidation; quarterly ASV scans where required. Future-dated v4.0 requirements became mandatory 31 Mar 2025. |
| Does SOC 2 replace it? | — | No. Shared controls can feed both programs; the certificate is still ISO 27001. | No. A CPA opinion is not HIPAA certification or a substitute for a BAA. | No. A SOC 2 report is not an AOC or ROC. |
Registry summaries and source URLs live on the SOC 2 Type 2, ISO 27001, HIPAA, and PCI DSS reference cards.
Three dated facts change how you read older charts:
- ISO/IEC 27001:2013 is finished. IAF transition rules required 2013 certifications to expire or be withdrawn by October 31, 2025. New and remaining certificates use ISO/IEC 27001:2022. See IAF MD 26.
- PCI DSS v4.0.1 is the active standard. PCI SSC published the limited revision on June 11, 2024, retired v4.0 on December 31, 2024, and left the March 31, 2025 effective date for the previously future-dated requirements unchanged (PCI SSC announcement).
- The HIPAA Security Rule rewrite is not in force. OCR published the NPRM in the Federal Register on January 6, 2025. HHS later moved projected final action from May 2026 to July 2027 and listed the rulemaking as a long-term action (Davis Wright Tremaine, July 8, 2026, citing RIN 0945-AA22). Map SOC 2 to the current Security Rule until a final rule is published.
What overlaps with SOC 2, and what still needs a native artifact?
Access management, logging, change control, vendor oversight, and incident response often produce evidence that more than one program can use. Encryption-of-PHI, cardholder-data scope, and ISMS scaffolding usually cannot be borrowed from a SOC 2 report alone. There is no defensible universal overlap percentage across all four programs.
Map artifacts, not logos. A joiner-mover-leaver ticket can support SOC 2 logical-access criteria, an ISO 27001 access-control objective, a HIPAA technical-safeguard specification, and a PCI DSS identity requirement — if the population, system boundary, and testing period match each program. A SOC 2 sample over a SaaS production account set does not automatically cover a cardholder data environment or an ISO Statement of Applicability.
| Work area | Often reusable with SOC 2 Security | What the other program still needs |
|---|---|---|
| Identity and access | Provisioning, MFA, privileged-role lists, access reviews, termination tickets. | HIPAA: ePHI systems named in the risk analysis. PCI: every in-scope CDE and security-impacting component. ISO: access rules tied to the ISMS scope and SoA. |
| Change and vulnerability management | Pull requests, approvals, test evidence, patch and scan records. | PCI: CDE and payment-page changes, scan types, and ASV duties. ISO: change and technical-vulnerability controls as selected in the SoA. |
| Logging and incident response | Log sources, alert review, incident plan, exercises, tickets. | HIPAA: PHI incident handling and breach-notification clocks. PCI: log coverage, retention, and payment-incident procedures. |
| Vendor management | Inventory, due diligence, contracts, monitoring. | HIPAA: BAAs. PCI: written provider acknowledgments and PCI status. ISO: supplier-security controls in Annex A. |
| Management-system and legal extras | Control environment, risk assessment, policy communication. | ISO: ISMS scope, risk treatment, SoA, internal audit, management review. HIPAA: designated privacy/security officials, workforce training, OCR-ready risk analysis. PCI: CDE boundary and the applicable SAQ or ROC path. |
Do not plan from “test once, comply four times.” Ask the CPA, the ISO certification body, and — when payment scope exists — the QSA to name the shared artifact, the separate criterion or requirement, the in-scope population, and the leftover work.
Pairwise depth lives elsewhere: SOC 2 vs ISO 27001 for sequencing and Annex A mapping; SOC 2 vs PCI DSS for SaaS for payment architecture; SOC 2 + HIPAA overlay engagements for how firms actually staff the HIPAA half.
Does a SOC 2+ report replace ISO 27001, HIPAA, or PCI DSS?
No. A SOC 2+ report is a SOC 2 examination that also covers additional subject matter against additional suitable criteria. It remains a CPA attestation. It does not issue an ISO 27001 certificate, a HIPAA certification, or a PCI DSS AOC. Some customers accept the extra criteria in the SOC 2 report; others still demand the native artifact.
The AICPA allows a service organization to engage the service auditor to examine subject matter beyond the system description and Trust Services Criteria, using additional suitable criteria (AICPA: additional subject matter in SOC 2 engagements). The October 2022 SOC 2 guide also includes an illustrative SOC 2+ report.
That is why “SOC 2 + HIPAA” and “SOC 2 + ISO 27001” get used loosely:
| Named extra criteria | What the CPA can do in one SOC 2+ examination | What you still do not get |
|---|---|---|
| HIPAA Security Rule | Evaluate whether described controls meet those additional criteria, if the firm will take that subject matter. | No HHS certificate. BAAs, OCR risk analysis, and Privacy/Breach duties remain. Many firms still deliver a SOC 2 report plus a separate HIPAA gap analysis because HIPAA has no AICPA-promulgated attestation standard — see the overlay engagement guide. |
| ISO 27001 Annex A / ISMS topics | Report on additional criteria mapped from ISO 27001. | No accredited ISO 27001 certificate and no three-year certification cycle. EU and APAC buyers who asked for the certificate still need the certification body. |
| PCI DSS | In principle, additional criteria are possible. In practice, overlap is narrower because CDE scope and testing procedures are payment-specific. | No AOC/ROC. The acquirer or payment brand still sets validation. |
| CSA STAR / CCM, NIST CSF, CMMC, GDPR | Possible only when the extra criteria are suitable and the framework owner allows combined reporting. | Each program’s native status, certificate, or legal file. Hand off: SOC 2 vs NIST CSF, SOC 2 vs CMMC, SOC 2 vs FedRAMP, SOC 2 vs GDPR, SOC 2 vs HITRUST. |
CBIZ’s 2024 sample found SOC 2+ in 9.6% of the 73 SOC 2 reports reviewed and warned that some security standards restrict combined reports. Confirm with the CPA and the other program’s owner before promising one binder to a customer.
How should you sequence a second framework?
Complete the obligation that can stop a deal or create legal exposure first; add the next named artifact using one evidence map and two (or more) conclusions. Do not start from a control-overlap percentage.
| Situation | First constraint | SOC 2 still? |
|---|---|---|
| US enterprise buyers are sending SOC 2 questionnaires; no PHI and no card data in scope | SOC 2 Type 2 for the service they actually buy | This is the default commercial path. |
| A hospital or health plan needs a BAA and PHI will sit in the product | HIPAA Security Rule program (risk analysis, safeguards, BAAs) | Add SOC 2 when those same buyers — or other verticals — also want a CPA report. A combined window is efficient; the deliverables stay distinct. |
| Checkout, stored PANs, or a service that can affect a CDE | Confirm PCI DSS role and validation path with the acquirer or brand | SOC 2 covers the broader SaaS control environment. It does not retire PCI validation. |
| EU, UK, or APAC procurement asks for ISO 27001 by name | ISO/IEC 27001:2022 certification | Keep SOC 2 for US buyers. Sequence from the larger open market; see SOC 2 vs ISO 27001. |
| Two or more of the above are already in contracts | Write every requested artifact and due date, then one evidence map | A SOC 2+ examination is optional extra criteria inside the CPA report, not a substitute for ISO, HIPAA, or PCI outputs the contract named. |
For GRC tooling that maps one control to several frameworks, use the SOC 2 automation page. For the firm that will sign the SOC 2 opinion — including shops that also run ISO or HIPAA work — compare licensed SOC 2 audit firms against the same system description so quotes stay comparable.
Frequently asked questions
Is SOC 2 Type 2 HIPAA compliant?
No. Type 2 means the CPA tested operating effectiveness over a period. HIPAA is a statute. Shared Security Rule safeguards and SOC 2 criteria do not produce HIPAA certification or close OCR exposure.
Can you get SOC 2 and HIPAA in the same engagement?
You can share fieldwork and still need two kinds of conclusion. Ask in writing whether the firm will (a) add HIPAA Security Rule criteria inside a SOC 2+ report, (b) issue a separate HIPAA gap analysis in the same window, or (c) both. Do not assume a single “SOC 2 + HIPAA report” until you have seen the engagement letter.
Does a SOC 2 report replace ISO 27001?
No. US procurement is built around the SOC 2 report; many international buyers want the ISO 27001 certificate. Shared controls reduce duplicate evidence collection. They do not make the artifacts interchangeable.
Is SOC 2 legally required?
Not by a federal SOC 2 statute. It is required when a contract or customer says so. HIPAA is legally required when you are a covered entity or business associate. PCI DSS is required when your payment role and the compliance-accepting entity say so.