Firms That Do Both SOC 2 and ISO 27001: 19 firms compared

Can one firm do both SOC 2 and ISO 27001?

ISO 27001 certification-body capability can sit alongside SOC 2 attestation in one provider group. The SOC 2 report and the ISO certificate remain separate deliverables, sometimes issued through related legal entities, so confirm the arrangement in writing before you sign.

Customers that require both a SOC 2 report and an accredited ISO 27001 certificate should verify current accreditation scope, legal entity, and certificate issuer. A generic ISO 27001 credential does not establish that a firm can issue the certificate.

Listed timelines cover SOC 2 fieldwork through report delivery and do not replace the Type 2 observation period or the ISO stage timetable. Treat the price range as a SOC 2 planning input and ask for renewal responsibilities in writing.

Do SOC 2 and ISO 27001 share the same evidence?

SOC 2 and ISO 27001 can share evidence in access control, change management, risk assessment, vendor management, and incident response. The amount of reuse depends on the SOC 2 system boundary, ISO management-system scope, and audit periods, so ask for an evidence map that marks shared work.

A coordinated provider may align interviews, but that is not a fixed saving. Ask the provider to distinguish shared testing from each framework’s separate procedures rather than assuming one fieldwork week covers both.

Shared controls still sit on two programs; the framework primer is ISO 27001 framework explained.

Is the same assessor allowed to issue both reports?

One provider group can deliver both, but the deliverables differ in kind: a SOC 2 report is a CPA attestation, while ISO 27001 is a certificate from an accredited certification body. Related entities may handle the two roles under a coordinated engagement.

Ask for the entities, audit stages, and separate ISO scope in writing. A certification-body logo on a website is not proof that the legal entity in your contract is the one that will issue the certificate.

Entity questions are not a vs-page; that comparison lives at SOC 2 vs ISO 27001: how they differ.

Should ISO 27001 wait until after the first SOC 2 report?

ISO 27001 should wait only when no current buyer requires the certificate. If buyers already need both, coordinating them may reduce duplicate evidence and interviews. Ask the provider to show sequencing rather than assume a combined engagement is cheaper or faster.

How much cheaper is a combined SOC 2 and ISO 27001 audit?

A combined SOC 2 and ISO 27001 audit has no defensible fixed percentage without like-for-like proposals. Coordinated fieldwork can reuse evidence and interviews, but scope determines the result. Ask for a proposal that identifies shared work, then compare it with separately scoped engagements.

A cheaper combined fee that omits Stage 2, surveillance years, or a narrower ISO scope is not a saving. Put shared interviews, unique tests, and each deliverable’s legal issuer on one page before you pick the lower number.

Surveillance-year ISO work and year-two SOC 2 testing are different commercial events. Ask how a stable scope changes each fee instead of assuming the first-year combined number repeats.

Certificate issuers without a SOC 2 cut are listed on ISO 27001 certification companies.