ISO 27001 vs SOC 2: differences and which one your company needs
ISO/IEC 27001:2022 is an international standard for an information security management system: an accredited certification body audits it and issues a certificate valid for 3 years, with annual surveillance audits. SOC 2 is an attestation framework of the AICPA (United States): an independent CPA firm examines your controls against the Trust Services Criteria and issues a report with an opinion, not a certificate. Customers in the United States, especially those buying software or cloud services, often ask for SOC 2; customers and tenders in Europe, Latin America and the rest of the world usually ask for ISO 27001. Much of the work overlaps (risk assessment, policies, access control, incidents, suppliers, evidence), and the AICPA publishes an official mapping between both, so many companies do one first and reuse it for the other.
The main differences at a glance
| Aspect | ISO/IEC 27001:2022 | SOC 2 |
|---|---|---|
| What it is | International standard for a management system (ISMS) | Attestation report on controls of a service organization |
| Who issues it | Accredited certification body | Independent CPA firm (AICPA standards) |
| Result | Public certificate (can be verified) | Report with the auditor's opinion, usually shared under NDA |
| Requirements | Clauses 4 to 10 + Annex A (93 controls) applied through the Statement of Applicability | Trust Services Criteria: Security (always) + Availability, Processing Integrity, Confidentiality and Privacy if chosen |
| Time dimension | Certificate for 3 years; annual surveillance audits and recertification | Type 1: design at a date. Type 2: design and operation over a review period |
| Where it is asked for | Worldwide, tenders, Europe and Latin America | Mostly United States customers of SaaS and cloud services |
| Focus | That the management system works and improves (risks, objectives, audit, review) | That the controls you describe exist and operate as described |
SOC 2 Type 1 and Type 2
A Type 1 report gives an opinion on whether the controls are suitably designed at a specific date. A Type 2 report also tests whether they operated effectively during a review period chosen with the auditor, usually several months. Buyers who ask for SOC 2 normally expect a Type 2, so a Type 1 is often used as a first step while evidence accumulates.
ISO 27001 ISMS documentation toolkit
84 files to document your ISMS based on ISO/IEC 27001:2022.
See the ISO 27001 documentation toolkitWhere the work overlaps
Most of what an ISO 27001 project produces is also evidence for a SOC 2 examination:
- Risk assessment and treatment (ISO 27001 clauses 6.1.2 and 6.1.3; SOC 2 risk assessment criteria CC3).
- Information security policies and roles (clause 5; controls 5.1 to 5.4; SOC 2 control environment CC1).
- Access control, authentication and user reviews (controls 5.15 to 5.18 and 8.2 to 8.5; SOC 2 logical access CC6).
- Incident management (controls 5.24 to 5.28; SOC 2 system operations CC7).
- Change management (control 8.32; SOC 2 CC8) and supplier management (controls 5.19 to 5.22; SOC 2 CC9).
- Internal audit and monitoring (clauses 9.1 and 9.2; SOC 2 monitoring activities CC4).
What does not transfer automatically: SOC 2 requires a system description written according to the AICPA description criteria, and the CPA firm tests samples of evidence over the period. ISO 27001, in turn, requires management-system elements that SOC 2 does not ask for in the same way, such as the Statement of Applicability, security objectives and the management review. The AICPA publishes an official spreadsheet mapping the Trust Services Criteria to ISO 27001.
Which one to do first
| Your situation | Usual first step |
|---|---|
| You sell software or cloud services to United States companies that ask for SOC 2 | SOC 2 (Type 1, then Type 2) |
| You sell in Europe, Latin America or participate in public tenders | ISO 27001 |
| Customers in several regions ask for both | ISO 27001 as the management system base, then SOC 2 reusing the evidence |
| No customer asks for either yet | Build the ISMS basics (risks, policies, access, backups) and decide when a real requirement appears |
Ask your customers what they actually require: some security questionnaires accept either, and others name one of them in the contract.
Change on the way: the proposed 2027 Trust Services Criteria
On 28 October 2026 the AICPA published an exposure draft to update the SOC 2 Trust Services Criteria: it consolidates overlapping criteria, adds others and adds points of focus on artificial intelligence (model oversight and monitoring, prompt manipulation and data poisoning, training data and automated decisions). Comments are open until 15 January 2027 and, if approved, the new criteria would apply to engagements beginning on or after 31 December 2027, with early adoption permitted. Current reports still use the 2017 criteria with the points of focus revised in 2022. If you also use AI in your service, ISO/IEC 42001 covers that management system.
How the NexoDocs ISO 27001 toolkit helps with both
The NexoDocs ISO 27001 toolkit contains the ISMS documents in editable Word and Excel: risk methodology and matrix, treatment plan, Statement of Applicability with the 93 controls, Annex A policies, internal audit programme and checklist, and a gap self-assessment. They are written for ISO/IEC 27001:2022; for SOC 2 they serve as the base of policies, risks and records, but the toolkit does not include the SOC 2 system description or replace the CPA examination. Neither a toolkit nor a consultant can guarantee a certificate or an unqualified opinion: that depends on the controls working and on the auditor.
Next step
Try it free or go straight to the complete solution.
ISO 27001 ISMS documentation toolkit
84 files to document your ISMS based on ISO/IEC 27001:2022.
See the ISO 27001 documentation toolkit
Free sample
Download a reduced version of the toolkit's risk matrix for free (Excel, 10 scenarios, heat map). See how it calculates risk level and category before you decide.
Get the free sampleFrequently asked questions
Is SOC 2 a certification?
No. SOC 2 is an attestation: a CPA firm issues a report with its opinion on your controls. ISO 27001 is the one that ends in a certificate issued by an accredited certification body.
Does ISO 27001 replace SOC 2?
Not automatically. Some customers accept ISO 27001 instead of SOC 2 and others require the SOC 2 report by contract. The work overlaps a lot, so the second one costs much less than the first.
Can a company outside the United States get a SOC 2 report?
Yes. The examination is done by a CPA firm under AICPA standards; many firms work with service organizations in other countries.
How long is each one valid?
An ISO 27001 certificate lasts 3 years with annual surveillance audits. A SOC 2 report covers a date (Type 1) or a period (Type 2); customers usually ask for a recent report every year.
Which Trust Services Criteria are mandatory?
Security (the common criteria) is always included. Availability, Processing Integrity, Confidentiality and Privacy are added depending on what you promise your customers.
Related guides
What is an ISMS and how do you implement it with ISO 27001?
What an information security management system (ISMS) is, what ISO/IEC 27001:2022 requires, which documents you need and how certification works.
Read the guide →ISO 27001 gap analysis: how to find out how far your ISMS is from the standard
How to run an ISO/IEC 27001:2022 gap analysis: the requirements of clauses 4 to 10, the 93 Annex A controls, how to score them and what to do next.
Read the guide →ISO 27001:2022 mandatory documents and records: checklist by clause
Checklist of the documents and records ISO/IEC 27001:2022 requires, clause by clause, which Annex A documents apply and common audit gaps.
Read the guide →Updated: 2026-10-29