CyphrQ
Menu

SOC 2 vs ISO 27001: What Each Is and How to Choose

SOC 2 is an auditor's report on controls; ISO/IEC 27001 is a certified management system. How audits and proof differ, and how to pick the right one.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

9 min read

SOC 2 is a report; ISO/IEC 27001 is a certificate. A SOC 2 is an independent CPA's examination of a service organisation's controls, written up for customers to read. ISO/IEC 27001 is an international standard for an information security management system, and an accredited body can certify that you run one. Pick by who is asking for proof and where they are.

What is SOC 2?

The AICPA, the US accounting body behind it, describes System and Organization Controls (SOC) as a suite of services CPAs may provide on a service organization's controls. The point is to give users information they need to assess the risks of outsourcing a service to someone else.

SOC 2 is the version aimed at technology and service providers. The AICPA's guide describes it as an assertion-based examination of two things: management's description of its system, and its controls relevant to security, availability, processing integrity, confidentiality or privacy. "Assertion-based" means your management states what the system and controls are, and the auditor gives an opinion on that statement.

Those five areas are the Trust Services Criteria. The AICPA publishes them as the 2017 Trust Services Criteria, with points of focus revised in 2022. The same guide says the criteria are used to judge how controls are designed and how they work.

The result is a report you hand to customers. It is not a pass or fail grade. It is the auditor's opinion plus a description of your system and controls, which your customer's risk team reads.

ISO/IEC 27001 at a glance

ISO/IEC 27001 is, in ISO's own phrase, the world's best-known standard for information security management systems (ISMS). Put another way, the management system means the roles, policies, routines and risk checks a company relies on to run something steadily. The standard sets out the requirements that system must meet, for organisations of any size and sector.

The current edition is ISO/IEC 27001:2022, "Information security, cybersecurity and privacy protection - Information security management systems - Requirements" (ISO catalogue entry). You have to buy the standard, so I won't quote its clauses; the summaries here are mine.

Certification is optional. ISO's committee page says companies can implement the standard without certifying, or certify to reassure customers, and that using an accredited certification body adds confidence because an accreditation body has confirmed its competence. ISO also asks that you cite it in full, as "certified to ISO/IEC 27001:2022".

How do SOC 2 and ISO 27001 differ at a glance?

SOC 2 ISO/IEC 27001:2022
What you get An auditor's report with a system description A certificate for a defined scope
Who issues it A licensed CPA firm An accredited certification body
Who sets the rules AICPA (Trust Services Criteria) ISO and IEC (the standard)
What is assessed Controls against the criteria you select A management system and the controls you chose for it
Origin US accounting profession International standards bodies
What the reader sees A detailed report Usually a certificate and its scope

The deepest difference is the question each answers. SOC 2 asks: do these controls, as described by management, meet the criteria? ISO/IEC 27001 asks: does this organisation run a risk-driven management system that keeps improving?

How do SOC 2 and ISO 27001 audits differ?

A SOC 2 examination produces an opinion. The AICPA's own material describes a Type 1 as evaluating controls as of a specific date, and a Type 2 as also covering operating effectiveness. In plain terms: Type 1 says the controls were designed and in place on one day. Type 2 says they also worked in practice. Your customers will usually find Type 2 more useful, because a control that existed on one day tells them less than a control that was shown to work.

ISO/IEC 27001 certification is an audit of the management system against the standard by a third party. The usual pattern in ISO management systems is an initial certification audit, then periodic surveillance audits and a recertification audit. I did not find that cycle on the ISO page I could read, so confirm the cycle and timings with your certification body.

Two practical consequences follow:

  1. SOC 2 is read, ISO 27001 is displayed. A SOC 2 report is something the customer's reviewers open and test against their own questions. An ISO certificate is shown as a badge, and the reviewer checks the scope.
  2. Scope is your choice in both, so scope is the thing to read. A SOC 2 report covers the system in the description. An ISO certificate covers its stated scope. A certificate for one product or site says nothing about another.

Should you choose SOC 2 or ISO 27001?

There is no universal winner. Use who is asking as the deciding factor.

If this is true Lean towards
Most customers are US companies and their security questionnaires name SOC 2 SOC 2
Customers, tenders or regulators outside the US ask for an ISO certificate ISO/IEC 27001
You want a management system your own team runs, not just a report ISO/IEC 27001
Buyers want to read detail on your controls and the auditor's opinion SOC 2
You sell globally to both Both, built on one set of controls

Ask your three biggest customers or prospects what they accept. Their answer settles it faster than any comparison article, including this one.

If you need both, the overlap is large, because both ask you to know your risks, assign owners, control access, log activity, handle incidents and keep evidence. Treat the work as one control set that you map to two outside frameworks, not two separate projects.

Neither is a legal requirement by itself. They are voluntary assurance. If a law applies to you, such as the NIS2 Directive, a SOC 2 report or an ISO certificate may help as evidence but does not replace what the law requires. Ask your legal adviser what each shows in your case. If you are also looking at AI governance, the ISO/IEC 42001 explainer covers the AI-specific sibling of 27001.

Going deeper: for security and IT teams

Type I vs Type II. A Type 1 report speaks to design and implementation at a point in time; a Type 2 adds operating effectiveness. The AICPA's panel discussion notes the Type 1 evidence problem: if the auditor gathers evidence after the as-of date, the question becomes what extra steps they took to validate a control that was in place in the past. For you, that means keeping dated evidence from the as-of date itself. Read the opinion paragraph of any report you receive to see which type it is and what it covers.

Period of review. Because Type 2 tests operating effectiveness, the report names the period tested. I could not open the AICPA illustrative report in full (the PDF needs a free account), so check the period in the report itself. What to verify as a reader: does the period end recently enough for your purposes, and does it cover the systems and sub-services you depend on? What to do as the audited party: pick control owners now and collect evidence continuously, because gaps in the period become exceptions in the report.

Criteria and selection. The 2017 Trust Services Criteria cover five categories. You and your auditor decide which categories are in scope. A report that covers only security says nothing about availability or privacy. Check the categories listed on the report's cover and in management's assertion. Also note the AICPA's 2018 description criteria (revised implementation guidance 2022), which are used to judge whether management's system description is fairly presented.

Standards behind the report. The AICPA says its SOC 2 guide was updated to reflect SSAE No. 20 and SSAE No. 21, and that the illustrative Type 2 report meets the SSAE 21 reporting requirements, effective for service auditor reports dated on or after 15 June 2022 (read on the AICPA illustrative report page). Ask whether the report you receive was issued under that attestation standard.

Statement of Applicability (SoA) and control mapping. In an ISO/IEC 27001 programme, the SoA lists which of the standard's Annex A controls you apply, whether each is implemented, and why any are excluded. Auditors will expect it to match your risk assessment, so make sure each inclusion and exclusion has written reasoning. For a dual programme, keep one control register and map each control to a Trust Services category on one side and an SoA entry on the other. A reviewer can then trace any SOC 2 control to your ISMS.

The 2022 edition and the transition. IAF's page of transitions lists ISO/IEC 27001:2022 with a transition deadline of 31 October 2025. That date has passed, so a certificate that cites 27001:2013 should no longer be valid. If a supplier sends you one, ask for the current certificate to the 2022 edition. I read the date at IAF. I did not read the exact audit cutoffs, so confirm them with your certification body.

Bridge letters and gaps. A SOC 2 report covers a fixed period, so customers often ask for a letter from management about the time since the period ended. I did not find this in AICPA or ISO sources I could open, so treat it as customer practice rather than a standard artefact. If you issue one, state only what management can support, and do not extend the auditor's opinion.

Questions to ask a vendor or auditor:

  • Which type of report, which categories, and what period or date?
  • Which systems, sub-service organisations and locations are in scope?
  • Were there exceptions or qualified opinions, and what did management do about them?
  • For ISO: which edition, which scope statement, which certification body, and is it accredited for 27001?
  • Can I see the SoA summary and the date of the last surveillance audit?

What should you do next about SOC 2 or ISO 27001?

  • Ask your top customers which they accept before spending anything.
  • Write down your intended scope in one paragraph: systems, teams, locations.
  • Build one control register with an owner and evidence for each control.
  • Run a readiness check against your first choice and fix the gaps before the audit.
  • When you receive someone else's SOC 2 report or ISO certificate, read the scope, the dates and the exceptions, not just the logo.

Key takeaways

  • SOC 2 is an AICPA-based examination that produces an auditor's report; ISO/IEC 27001:2022 is a standard for an ISMS that an accredited body can certify.
  • Type 1 looks at controls as of one date; Type 2 also covers operating effectiveness.
  • Both are voluntary and both depend on scope, so read the scope first.
  • The 31 October 2025 transition deadline for ISO/IEC 27001:2013 has passed.
  • Choose by what your customers and markets accept, and build one control set if you need both.

Sources