Menu
On this page
SOC 2 vs ISO 27001
Answer 5 questions and get a recommendation built for your situation.
What are customers actually asking for?
Use the written contract, questionnaire, or procurement request when one exists.
Your framework recommendation
Your stated buyer requirement determines the path; the other answers help plan the scope.
Planning both: Coordinate one evidence inventory and price two deliverables. Compare firms that can coordinate both engagements, confirm the CPA firm and accredited certification body, and ask which work each issuer will accept.
Free and anonymous · 3–10 auditor quotes, usually within 48 hours
SOC 2 is a report; ISO/IEC 27001:2022 is a certificate. A licensed CPA firm gives an opinion on your system and its controls in a SOC 2 report. An accredited certification body certifies the management system scope you define under ISO 27001, on a three-year cycle. Neither is a legal requirement, and neither replaces the other unless your buyer says so.
Start with what the contract or security questionnaire asks for. If both are requested, plan one evidence program with two separate examinations. The controls you already operate can help; a generic overlap percentage cannot tell you how much work remains.
SOC 2 and ISO 27001 at a glance
| SOC 2 | ISO/IEC 27001:2022 | |
|---|---|---|
| What you receive | A CPA examination report, including system description, opinion, and test detail | A certification decision and a certificate identifying the ISMS scope |
| Who signs | An independent licensed CPA firm | An accredited certification body; check its accreditation for your scope |
| What it covers | The services and system in the description, against the Trust Services Criteria categories you select (nearly every report includes Security) | The ISMS scope you define, with Annex A controls chosen through risk treatment and recorded in a Statement of Applicability |
| Cycle | Type 1 reports a date; Type 2 reports a stated period. There is no universal expiry date, so each buyer sets how old a report may be, often 12 months | A three-year certificate with surveillance audits in between and recertification before it expires (NQA’s process) |
| What a buyer checks | Report period, system description, opinion, exceptions, and subservice organizations | Certificate scope, issuing body and its accreditation, validity dates, and the Statement of Applicability |
| Legal status | Not a legal requirement in itself; contracts and questionnaires create the demand | Not a legal requirement in itself; ISO says organizations decide whether to certify |
| Where buyers tend to ask (practitioner observation, not a rule) | More often North American customers, per Cherry Bekaert | Often requested outside North America, per Cherry Bekaert. The ISO Survey 2022 reported over 70,000 ISO 27001 certificates in 150 countries |
Related decisions. For a quick first choice, use the five-question SOC 2 vs ISO 27001 selector at the top of this page. The ISO 27001 framework overview covers the standard itself, and our compliance framework comparison covers the frameworks beyond it. To compare certifiers, see ISO 27001 certification companies; firms that can sign both are in the dual-framework auditor directory.
What does each one prove?
SOC 2 is a CPA firm’s opinion on management’s description of a service organization’s system and its controls against the AICPA Trust Services Criteria. A Type 1 report addresses control design at a point in time; Type 2 also addresses operation over the stated period. It is a detailed, restricted-use report for its intended users, shared under NDA in practice, rather than a public certificate.
ISO/IEC 27001 sets requirements for an information security management system (ISMS). An accredited certification body can certify the defined ISMS scope. That scope may cover the whole organization or an identified part of it, and a certification body works out the sites and activities in scope with you before it quotes (NQA describes this step). The certificate is not proof that every product, office, or supplier is covered. ISO describes certification as an optional way to demonstrate conformity.
Check the edition. ISO/IEC 27001:2022 is the current edition, and certificates based on the 2013 edition had to expire or be withdrawn by 31 October 2025 (IAF MD 26, the accreditation bodies’ transition rule). A certificate that still names 2013 is out of date.
Ask for the exact report or certificate in the RFP or security questionnaire. One substitutes for the other only when the buyer explicitly accepts it. Geography is a useful clue to what a buyer may recognize, but it cannot override a written procurement requirement. A US customer can request ISO 27001, and an EU customer can request SOC 2.
Which should you do first?
| What is happening now | First move | What to confirm before signing |
|---|---|---|
| A live deal asks for a SOC 2 Type 2 report | Scope a SOC 2 examination | Whether the buyer accepts a Type 1 interim report, the Type 2 period, and the services in scope |
| A live deal asks for an accredited ISO 27001 certificate | Scope the ISMS and certification | Which entity, products, sites, and accreditation the buyer expects |
| Different customers explicitly ask for both | Design one control and evidence program, then price two engagements | Separate issuers and deliverables; which interviews and evidence can be shared |
| No customer has specified either | Ask the highest-value prospects what proof they accept | Whether a questionnaire, contract, or regulator actually calls for an external report or certificate |
| You already hold one credential | Map its evidence to the second engagement | Gaps in scope, period, management-system requirements, and the second auditor’s acceptance |
What work can carry into the second engagement?
Start by identifying which existing records address both sets of criteria. The AICPA publishes mappings of the Trust Services Criteria to other frameworks, but the files are reserved for AICPA and CIMA members. ISO/IEC 27001 requires risk treatment and a Statement of Applicability for the chosen ISMS scope. A mapping is a planning aid; neither auditor is bound to accept the first auditor’s work without its own examination.
The table gives SOC 2 criterion IDs and 2022 Annex A control IDs for each kind of evidence. It is our reading, not an AICPA or ISO crosswalk. The full theme-by-series matrix is in ISO 27001 domains mapped to SOC 2 criteria.
| Evidence you may reuse | SOC 2 criteria | ISO 27001 clauses and Annex A controls (2022) | Where the examinations differ |
|---|---|---|---|
| Access approvals, MFA configuration, and access reviews | CC6.1 to CC6.3 | A.5.15 to A.5.18, A.8.2 to A.8.5, A.6.5 | SOC 2 tests whether controls protected the described system and operated during the report period. ISO asks whether access controls are selected, justified, and operated across the ISMS scope. |
| Change tickets, approvals, and deployment records | CC8.1 | A.8.32, A.8.25, A.8.29, A.5.8 | SOC 2 tests changes to the described system. ISO asks whether the chosen controls and risk treatment cover change throughout the ISMS scope. |
| Incident logs, exercises, and response records | CC7.2 to CC7.5 | A.5.24 to A.5.28, A.6.8, A.8.15, A.8.16 | SOC 2 tests detection, response, and recovery under the criteria. ISO treats incident management as part of the ISMS and its improvement process. |
| Vendor assessments and contracts | CC9.2 | A.5.19 to A.5.23 | SOC 2 considers subservice organizations and vendor risk in the system description. ISO assesses and treats supplier risk within the ISMS boundary. |
| Risk register and management decisions | CC3.1 to CC3.4 | Clauses 6.1.2, 6.1.3, 8.2; A.5.7, A.5.8 | SOC 2 asks whether risk assessment supports management’s controls for the service. ISO requires a documented risk assessment, treatment plan, and Statement of Applicability. Fraud risk (CC3.3) usually needs its own evidence. |
| Monitoring, internal audit, and management review | CC4.1, CC4.2 | Clauses 9.1 to 9.3, 10.2; A.5.35, A.5.36 | ISO makes internal audit and management review required ISMS steps. SOC 2 tests that management monitors its controls (CC4) but does not prescribe those two activities. |
Some work does not transfer. ISO 27001 asks for a defined ISMS, internal audit, management review, and continual improvement. SOC 2 asks management for a system description and assertion, and the CPA performs a separate examination of the described controls. The scope and time period can differ even when the same access log or change ticket is useful to both teams. ISO’s Statement of Applicability guidance explains why Annex A is a reference set for justified control choices, rather than a claim that every organization must implement all 93 controls. ISO 27002 vs ISO 27001 explains how the standard that describes those controls relates to the certifiable one.
What do published overlap percentages say?
Three published comparisons give different figures, and none shows how its percentage was calculated. Checked 15 and 21 October 2026.
| Publisher and page date | Published figure | What the page says it measures |
|---|---|---|
| Moore Colson, a CPA firm, 16 December 2024 | More than 50%, often upwards of 70% | Share of ISO 27001:2022 controls that map to the SOC 2 Trust Services Criteria |
| Strike Graph, updated 22 September 2026 | 80% to 100% | “Potentially” the share of SOC 2 controls that can map to ISO 27001 Annex A controls |
| Secureframe, 18 December 2024 | About 80% | Overlap between ISO 27001 and SOC 2 criteria, attributed to an AICPA mapping spreadsheet |
The figures count different things (controls versus criteria), and the AICPA’s mapping files are reserved for members, so most readers cannot check the attribution. Moore Colson also notes that the AICPA’s published mapping is to ISO 27001:2013; as of December 2024 there was none for the 2022 edition. We do not adopt a percentage as ours. A share of shared evidence tells you nothing about the scope gaps, the period, or what each auditor will re-test, so do not use one to price an engagement.
Before fieldwork, give both auditors a one-page evidence map with the system or ISMS boundary, control owner, evidence source, covered dates, and applicable criterion. Ask each auditor to mark what it can test from that package and what needs separate work.
How should you price and sequence both engagements?
A combined proposal is useful only when you can see where the work is actually shared. Request itemized quotes, including the separate SOC 2 opinion and ISO 27001 certification. A CPA firm may perform SOC 2 while a different accredited body issues the ISO certificate; confirm the contracting and signing entities even when one seller coordinates both.
| Quote line | Ask the provider to specify |
|---|---|
| Readiness and remediation | Who prepares the system description, ISMS, policies, risk treatment, and evidence; what management must do |
| SOC 2 examination | CPA firm, Type 1 or Type 2, report period, services and trust services categories in scope |
| ISO 27001 certification | Certification body, accreditation, ISMS boundary, initial stages, and ongoing surveillance |
| Shared fieldwork | Which interviews, samples, or documents are reused, and whether both issuers accept them |
| Software and support | Platform modules, implementation, auditor access, export, and renewal terms |
| Change control | Price and schedule effect of an added site, service, framework, or audit-period change |
Compare the resulting proposals on the same scope and period. A lower first-year number can omit surveillance, readiness support, or one of the issuers. Our SOC 2 audit cost guide and ISO 27001 certification cost guide own the pricing detail; the dual-framework auditor directory and the ISO 27001 certifying body guide help identify who can sign what. If a consultant will build the ISMS first, compare ISO 27001 consulting services and price that work separately from the certification body’s fee. No fixed bundle discount or universal implementation timeline follows from the standards themselves.
What does a three-year audit calendar look like?
SOC 2 has no certificate cycle: each report stands alone, and buyers want a current one. ISO 27001 runs on a three-year certificate with audits in between. Overlaying them shows which years carry two audits. Year 1 starts when the first report is issued or the certification decision is made; readiness work, the first Type 2 period, and the ISO Stage 1 and Stage 2 audits come before it. Checked 15 October 2026.
| Before Year 1 | Year 1 | Year 2 | Year 3 | |
|---|---|---|---|---|
| SOC 2 only | Readiness, an optional Type 1, and the first Type 2 period, of a length you agree with the CPA firm. The report follows fieldwork. | Next Type 2 period and report | Next Type 2 period and report | Next Type 2 period and report. No recertification step: the new report stands alone. |
| ISO 27001 only | Run the ISMS with a management review and a full cycle of internal audits (NQA asks for at least three months of operation). Stage 1 readiness audit, Stage 2 full assessment, then the certification decision. | Internal audit and management review at planned intervals. First surveillance audit, due within 12 months of the decision. | Internal audit and management review. Second surveillance audit. | Internal audit and management review. Recertification audit of the whole ISMS before the certificate expires, for a new three-year certificate. |
| Both | Two separate engagements, in either order. Agree scope and owners first; reuse fieldwork only where both issuers accept it. | SOC 2 period and report plus the first ISO surveillance audit | SOC 2 period and report plus the second ISO surveillance audit | SOC 2 period and report plus the ISO recertification audit, the fullest ISO audit of the cycle |
If SOC 2 is due first, operate controls for the specified report period while building the ISMS records ISO needs. If ISO certification is due first, preserve dated operating evidence and write the SOC 2 system description before asking the CPA to scope its examination. Set both calendars together so the same control owners are not sitting in two audits at once.
Fees depend on scope, so this calendar has no dollar figures; the SOC 2 audit cost guide and ISO 27001 certification cost guide show how to compare them. A CPA firm quotes the SOC 2 lines, a certification body quotes the ISO lines, and platform vendors and consultants quote theirs separately.
Calendar sources: NQA’s certification process for the three-year certificate, annual partial surveillance audits, full recertification, and the operating period before the first audit; our ISO 27001 certifying body guide for the first surveillance audit within 12 months of the decision; ISMS.online on management review for planned intervals, which the standard does not fix; and OneUptime on SOC 2 report age for the absence of a universal SOC 2 expiry date.
Australian companies follow the same contract-first rule. A customer selling into the US may ask for SOC 2; an APAC buyer may ask for ISO 27001. Neither label alone settles what an Australian procurement team will accept. If SOC 2 is the required report, compare Australian SOC 2 auditors who can issue it.
Is SOC 2 or ISO 27001 legally required?
Neither is a legal requirement in itself. A contract, a customer questionnaire, or a sector rule can require a SOC 2 report or an ISO 27001 certificate, so the requirement that counts is the one written into your deal or your regulator’s rules.
No blanket rule says every NIS2-covered entity or supplier must hold an ISO 27001 certificate. NIS2 Article 21 sets risk-management measures, including supply-chain security; national implementation and contracts determine the applicable obligation. ENISA’s technical guidance supplies examples of evidence and mappings. Certification may be useful evidence when a customer asks for it, but it is not a substitute for checking the actual requirement.
The same discipline applies to GDPR: ISO 27001 can help document security management, but GDPR Article 32 does not name ISO certification as a universal condition. The European Data Protection Board has cautioned that an ISMS alone does not establish Article 32 compliance. A buyer may ask for a certificate, a SOC 2 report, a data processing agreement, or answers about particular controls. Respond to the request you have, rather than treating a framework logo as legal compliance.
Questions buyers ask
Is SOC 2 a certification?
No. SOC 2 is an attestation: a licensed CPA firm issues an opinion on a described system and its controls against the AICPA Trust Services Criteria, and the deliverable is a report, not a certificate. Buyers and vendors still say “SOC 2 certification” as shorthand, so write “SOC 2 Type 2 report” in contracts and questionnaires. Why SOC 2 is an attestation, not a certification explains the wording.
Is ISO 27001 equivalent to SOC 2?
No. Both examine security controls, but they produce different things: a CPA’s opinion on a described system for SOC 2, and a certification of a defined management system for ISO 27001. One stands in for the other only when the buyer’s contract or questionnaire says so. Shared evidence can help with both, and each auditor still tests it separately.
Is ISO 27001 outdated?
No. The current edition is ISO/IEC 27001:2022, the third edition, published in October 2022; ISO lists one amendment, on climate action changes. Certificates to the 2013 edition had to expire or be withdrawn by 31 October 2025, so a certificate or Statement of Applicability that still names 2013 is out of date. ISO 27001 domains and themes shows what changed.
Can ISO 27001 replace a SOC 2 report?
Only if the buyer accepts it. ISO 27001 certifies a defined ISMS; SOC 2 reports a CPA’s examination of a described service organization’s system. Ask procurement whether an alternate report or certificate is acceptable before changing the engagement.
How much of a SOC 2 audit can be reused for ISO 27001?
Access, change, incident, vendor, and risk evidence may support both, as the criterion and control IDs above show. There is no defensible fixed percentage without comparing the actual scopes and control sets. ISO also requires ISMS management records that a SOC 2 report does not provide; each auditor evaluates evidence independently.
Does NIS2 require ISO 27001 certification?
NIS2 sets cybersecurity duties for covered entities and includes supply-chain security. It does not impose a blanket ISO 27001 certificate requirement on every supplier. Check the national rules and customer contract that apply to your case.
Do companies need both SOC 2 and ISO 27001?
Get both when distinct buyers or contracts require both. Otherwise, meet the current requirement first and keep a control and evidence map so the second examination can use the work that transfers.
What should a combined quote include?
Put the SOC 2 report, ISO certificate, issuers, scope, periods, certification stages, surveillance, readiness, software, and shared fieldwork on separate lines. Ask each signer what evidence it will accept before treating the quote as a combined engagement.
Still choosing the first path? Use the five-question framework selector at the top of this page for a quick direction, then bring the relevant customer requirement to the auditor comparison or the SOC 2 auditor directory.
More in Framework Comparisons