ISO 27001 vs SOC 2: which do you need?

ISO 27001 and SOC 2 are the two security credentials customers ask for most — and they're often confused. They prove similar things in very different ways.

The core difference

• ISO 27001 is an international certification. You build a management system, an accredited body audits it, and you either pass or fail — resulting in a certificate you can show anyone.
• SOC 2 is a US attestation report. A licensed CPA firm examines your controls against the AICPA's Trust Services Criteria and issues a report (with an opinion) that you share, usually under NDA, with customers.

One is a badge you hold; the other is a detailed report you hand over.

SOC 2 in brief

• Built around five Trust Services Criteria: Security (always included), plus optionally Availability, Processing Integrity, Confidentiality, and Privacy.
• Comes in two types:
  • Type I — controls are suitably designed at a point in time.
  • Type II — controls operated effectively over a period (commonly several months to a year).
• Widely expected by US buyers; less recognised outside North America.

ISO 27001 in brief

• A globally recognised standard with a certificate valid on a three-year cycle (with surveillance audits).
• Built around an ISMS and Annex A controls selected via risk assessment and a Statement of Applicability.
• The default expectation for European and international buyers.

Where they overlap

Both are risk- and control-based, and the underlying security work — access control, change management, incident response, vendor management, monitoring — is largely the same. Organisations that need both can reuse most controls and evidence across them.

Which should you choose?

• Selling mainly to US companies → SOC 2 is often what's asked for.
• Selling in the EU or globally → ISO 27001 is the common expectation.
• Facing both markets → many companies do both, mapping one control set to each.

If EU regulation is also in play, remember ISO 27001 additionally underpins much of NIS2 and GDPR — see NIS2 vs ISO 27001. New to ISO 27001? Start with the SMB guide.