In short
SOC 2 is not a certification: it is an attestation report issued by an audit firm with licensed CPAs against the AICPA Trust Services Criteria.
ISO 27001 certifies the information security management system and is issued by an accredited body, with a three-year cycle.
Type I assesses the design of controls as of a date, Type II also their operation throughout an observation period.
Most controls and evidence are shared: with a mapping matrix every piece of evidence counts for both assessments.
The choice depends on your clients: ISO 27001 for European markets, SOC 2 for US ones, both if you sell in each.
US clients ask for a SOC 2 report, European ones for ISO 27001. If you sell software, cloud services or managed services in both markets, sooner or later you receive both requests, often in the same quarter. And the question becomes unavoidable: do I need two separate projects, with two consultants, two sets of documents and two audit calendars?
The short answer is no. SOC 2 vs ISO 27001 is not really an either-or choice: the two schemes largely check the same security controls, but they do so with different logics and produce different documents. SOC 2 is an attestation report issued by licensed auditors in the United States; ISO/IEC 27001 is a management system certification issued by an accredited body. In this guide we look at the differences that matter, what they have in common, how to choose based on your clients and how to build a single set of controls and evidence that stands up to both assessments.
SOC 2 and ISO 27001: what is the difference in a nutshell?
The main difference lies in the nature of the outcome. With ISO 27001 you obtain a certificate attesting that your management system conforms to an international standard. With SOC 2 you obtain an attestation report, a document in which an auditor expresses an opinion on the controls of a system against criteria set by the AICPA, the US association of certified public accountants.
This difference has practical consequences: who issues the document, what it contains, who can read it and how long it lasts. The table summarises the main points.
Aspect | SOC 2 | ISO/IEC 27001 |
|---|---|---|
What it is | Attestation report on the controls of a system | Certification of the information security management system |
Reference | AICPA Trust Services Criteria | International standard ISO/IEC 27001:2022 |
Issued by | An audit firm with licensed CPAs | An accredited certification body |
Outcome | Detailed report with system description, auditor's opinion and, in Type II, tests of controls | Certificate with scope, standard and validity, plus audit reports kept by the company |
Who reads it | Clients and their auditors, usually under confidentiality | Anyone: the certificate can be shown publicly |
Typical market | United States and North America | Europe and the rest of the world |
Neither is "better" in absolute terms. They are two different languages for proving the same thing: that you handle the information your clients entrust to you securely.
What is SOC 2 and why is it not a certification?
SOC 2 belongs to the System and Organization Controls family, a suite of services that the AICPA describes as offerings CPAs may provide on the controls of a service organisation. The outcome is a report the auditor issues after an examination of the controls: there is no certificate, no mark to display and no public register. This is why saying "we are SOC 2 certified" is a wording mistake that an experienced US client spots immediately: the correct phrase is "we have a SOC 2 report".
Trust Services Criteria: the five categories
The reference for SOC 2 is the Trust Services Criteria, published by the AICPA. The reference version is the 2017 one, updated with the revised points of focus of 2022: points of focus are guidance that helps apply the criteria, not new requirements. The criteria are organised into five categories: security, availability, processing integrity, confidentiality and privacy.
Security is the basis of every report: its criteria, known as common criteria, are always included. You choose the other categories based on what you promise your clients. If you sell a platform with uptime commitments, it makes sense to include availability; if you handle confidential client documents, confidentiality. Adding categories you do not need widens the work without giving value to those who read the report.
The AICPA periodically updates the criteria through a public consultation process. Before you start, check with the auditor which version applies to the period that will be examined.
Type I and Type II: what changes
The SOC 2 report comes in two forms. Type I assesses the system description and whether the controls are suitably designed as of a specific date. Type II adds the check that the controls operated effectively throughout an observation period, and therefore includes the tests performed by the auditor and any exceptions.
In practice, more mature clients ask for Type II, because it shows that the controls work over time and not just on paper. Type I can serve as a first step, for example when a contract is on its way and the observation period is not yet over. You agree the length of the period with the auditor: what matters is that it matches your clients' expectations and that the controls are genuinely in place from day one.
Who issues the report and who can read it
The SOC 2 report is issued by an audit firm with licensed CPAs, in accordance with AICPA professional standards. This is not a formality: the AICPA explicitly stresses that SOC services should be evaluated carefully and takes action regarding unlicensed practitioners. When choosing who will perform the examination, always check the auditor's licence.
The report contains detailed information about your system and your controls, so it is usually shared with clients and prospects under a confidentiality agreement. For a general audience the AICPA provides SOC 3, a shorter general use report that you can also publish on your website.
What is ISO 27001 certification?
ISO/IEC 27001 is the international standard that sets out the requirements for establishing, implementing, maintaining and improving an information security management system. Certification is voluntary, but, as ISO itself notes, it is often sought to reassure customers, partners and regulators. If you want to explore requirements and the certification path, you will find everything in our complete guide to ISO 27001; here we focus on what sets it apart from SOC 2.
A management system, not just a list of controls
ISO 27001 does not certify a set of isolated controls, but the management system that selects them and keeps them under control: context, leadership, risk assessment and treatment, objectives, internal audits, management review, improvement. The reference controls are in Annex A: according to ISO, the 2022 revision details 93 controls grouped into four themes, namely organisational, people, physical and technological.
Not all controls apply to every company. In the Statement of Applicability you state which ones you apply and why you exclude the others. This is where an important difference from SOC 2 shows: in ISO 27001 the selection of controls starts from your risk assessment, whereas in SOC 2 you start from criteria set by the AICPA and describe how you meet them.
Accredited body and three-year cycle
Certification is issued by an accredited certification body operating under ISO/IEC 17021-1. The cycle lasts three years: after the initial two-stage audit, there are surveillance audits in the first and second year and recertification before expiry. The certificate is public and verifiable, and you can cite it on your website, in quotations and in tenders.
The certificate states a precise scope: sites, processes and services covered. When you show it to a client, check that the service you sell them falls within that scope. It is the same principle as SOC 2, where the report covers only the system described.
What do SOC 2 and ISO 27001 have in common?
SOC 2 and ISO 27001 share the substance: most of the required controls are the same. Both require structured access management, data protection, vulnerability and incident management, continuity, supplier assessment and staff training. The AICPA itself has published a mapping between Trust Services Criteria and ISO 27001, a sign that the two references speak to each other.
Risk, controls and evidence
The strongest point of contact is the method. In both cases you must identify risks, choose suitable controls, document them and prove with evidence that they work. An access management procedure, the log of periodic user access reviews, the records of backup restore tests, training records: these are the same evidence that a SOC 2 auditor and an ISO 27001 auditor will ask to see.
Take a 50-person SaaS company that manages its clients' data on a cloud provider. For the quarterly review of administrative access it writes a single procedure, keeps a single log and links it both to the Annex A access control and to the corresponding Trust Services Criteria criterion. One piece of work, two assessments.
Where they really differ
The differences lie in how they verify. The ISO 27001 auditor checks that the management system conforms to the standard and is effective, sampling processes and controls during audits. The SOC 2 auditor, in Type II, tests that each described control operated throughout the whole period: if a planned access review was not carried out in one quarter, that exception appears in the report your client will read.
The description changes too. SOC 2 requires a system description prepared by management in line with the AICPA description criteria, whereas ISO 27001 relies on the scope, the Statement of Applicability and the documented information of the management system. Finally, ISO 27001 requires governance elements that SOC 2 does not examine in the same way, such as management review and the improvement cycle.
SOC 2 or ISO 27001: which one does your company need?
The choice almost always depends on who your clients are and what they ask for in contracts. Before deciding, look at the actual requests you have received in recent months: questionnaires, contract clauses, tender requirements. They are the best indicator of what you really need.
If you sell mainly in Europe
If your clients are mostly European, ISO 27001 is usually the starting point. It is the standard procurement departments know, it often appears in tender requirements and supplier qualification and it is a natural reference for clients who must assess the security of their supply chain, for example because they fall under the NIS2 Directive. You will find more on how the two relate in the guide on ISO 27001 and NIS2.
If you sell mainly in the United States
If your main clients are American, SOC 2 is often the standard request at the due diligence stage. Many US companies have internal processes built around reading the SOC 2 report, particularly Type II, and an ISO 27001 certificate alone may not be enough to complete the assessment. In these cases it is worth asking the client whether they accept a Type I as an interim step.
If you sell in both markets
If you work with European and American clients, you will probably need both. The good news is that you do not have to double the work: you can build a single system of controls and have it assessed twice. An Italian software house with a banking client in Milan and a distributor in Boston can start with ISO 27001, which structures the system, and then begin the SOC 2 observation period on the same controls already running.
If your main problem is the number of questionnaires you receive, even before the document to obtain, also read our guide on how to answer customer security questionnaires: a library of answers based on controls is useful with either scheme.
How to obtain SOC 2 and ISO 27001 by working on your controls only once
The approach that works is to build a single system and link each control to both references. This way every piece of evidence counts twice and the audits become two moments of verification of the same work. The path can be organised in five steps.
Define scope and system: choose which services, sites and infrastructure to include, and make the ISO 27001 scope and the system described in SOC 2 overlap as much as possible.
Assess risks once, with a single method, and from there choose the Annex A controls and the Trust Services Criteria categories to include.
Create a mapping matrix: for each control, the Annex A reference, the linked SOC 2 criterion, the owner, the frequency and the expected evidence.
Collect evidence continuously, with dates and owners, instead of reconstructing it before the audit.
Plan the calendars together: internal audit, management review, ISO surveillance audits and SOC 2 observation period.
The control mapping matrix
The matrix is the core of the method. In one row you find, for example, technical vulnerability management: the corresponding Annex A control, the Trust Services Criteria criterion on system operations, the internal procedure, the IT owner, the monthly scanning frequency and the log that proves it. When the ISO auditor or the SOC 2 auditor arrives, the same row answers both.
Building it requires attention to differences in detail. Some SOC 2 criteria ask you to describe controls that ISO 27001 covers with a more general requirement, and vice versa. The mapping published by the AICPA is a good starting point, but it must be adapted to your actual controls and checked with whoever will perform the examination.
Continuous evidence, not snapshots
Type II changes the way you collect evidence. It is not enough to show that a control exists on the day of the audit: you must prove it worked at the stated frequency for the whole period. If you write that user accounts are reviewed every quarter, you need four dated records, not one. This discipline also benefits ISO 27001, because it makes surveillance audits much simpler.
The typical mistake is to declare ambitious frequencies to look good: monthly reviews that then become quarterly, weekly restore tests that nobody records. Better a realistic frequency, always met, than an optimistic one with exceptions in the report.
The internal audit as a dress rehearsal
The internal audit is an ISO 27001 requirement and also the best moment to check, before the SOC 2 auditor does, that the controls really worked. Companies that follow the path with Complaion carry out the internal audit with us: it is conducted by the Complaion Lead Auditor, who does not audit their own operational work and thus maintains the impartiality required by the standard. You will find a dedicated guide on the method in ISO internal audit.
What are the most common mistakes when tackling SOC 2 and ISO 27001?
The most frequent mistakes come from treating the two schemes as separate projects or as paperwork exercises. These are the ones we see most often.
Two parallel projects with different documents, owners and calendars: the work doubles and inconsistencies arise between what is declared to the ISO auditor and to the SOC 2 auditor.
Talking about "SOC 2 certification" in quotations and on your website: SOC 2 is an attestation report and US clients know it.
Including all five categories in SOC 2 for no reason, widening tests and evidence without real benefit to clients.
Starting the Type II observation period before the controls are truly operational: every gap becomes an exception in the report.
Different scopes between the ISO certificate and the SOC 2 system, forcing you to explain to every client what is covered and what is not.
Collecting evidence only just before the audit, reconstructing after the fact records that should have existed throughout the year.
Almost all these mistakes are avoided with single coordination of the system: one person in charge of coordination, one matrix, one calendar.
How Complaion supports you towards SOC 2 and ISO 27001
With Complaion you build a single system of controls that supports both ISO 27001 certification and the SOC 2 examination. A dedicated Lead Auditor follows your company: they help you define the scope, assess risks, choose the Annex A controls and the relevant Trust Services Criteria categories, and propose the path best suited to your needs, starting from what your clients ask of you. They also conduct the internal audit, so you reach the external assessments knowing where you stand.
The platform collects the evidence linked to each control, manages the system documents, keeps the schedule of reviews, tests and audits and helps you prepare for the audit. The path with Complaion avoids nonconformities and leads to the external audit with a 100% success rate. More than 1,000 clients have already chosen Complaion to get certified and maintain their certification over time.
Discover the path to ISO 27001 certification and the one for SOC 2, or contact us for a quote built around your clients and your markets.
Frequently asked questions on SOC 2 and ISO 27001
Is SOC 2 a certification?
No. SOC 2 is an attestation report: an audit firm with licensed CPAs examines the controls of a system against the AICPA Trust Services Criteria and expresses an opinion. There is no certificate and no public register. The correct phrase to use with clients is "we have a SOC 2 report", stating whether it is Type I or Type II and the period covered.
If I have ISO 27001, will US clients accept it anyway?
It depends on the client. Some accept the ISO 27001 certificate, perhaps together with a security questionnaire; many others have assessment processes built on the SOC 2 report and ask for it regardless. It is worth asking early in the negotiation. If SOC 2 is needed, the controls already running for ISO 27001 are the basis to start from.
Is it better to start with SOC 2 or ISO 27001?
It depends on your main market. If most clients are European, starting with ISO 27001 gives you a complete management system onto which you can later add SOC 2. If the most urgent contract is with a US client, you can start with SOC 2 while designing your controls from the outset with the Annex A structure, so ISO certification follows without redoing the work.
What is the difference between SOC 2 Type I and Type II?
Type I assesses the system description and the design of controls as of a specific date. Type II also checks that the controls operated effectively throughout an observation period, with the auditor's tests and any exceptions. More mature clients usually ask for Type II, because it shows operation over time.
Who can issue a SOC 2 report?
Only an audit firm with licensed CPAs, performing the examination in accordance with AICPA professional standards. It cannot be issued by an ISO certification body as such, nor by a consultant or a software provider. Before awarding the engagement, check the auditor's licence: a report issued by an unlicensed practitioner risks not being accepted by clients.
How long are SOC 2 and ISO 27001 valid?
The ISO 27001 certificate follows a three-year cycle, with annual surveillance audits and recertification before expiry. The SOC 2 report has no formal expiry date, but it refers to a specific date or period: clients tend to ask for a recent report and, for this reason, companies renew it on a regular basis.
Can I use the same documents for both?
Yes, largely. Policies, procedures, risk assessment, logs and minutes can serve both if they are linked to a matrix showing the corresponding Annex A control and SOC 2 criterion. SOC 2 additionally requires a system description in line with the AICPA criteria, ISO 27001 the Statement of Applicability and the management system elements. The rest is a single repository of evidence.
