.svg)
In our experience, a SOC 2 program covers roughly 70 percent of the work for ISO 27001 certification. The policies carry over, and most controls need only small adjustments. By direct mapping, the SOC 2 Security criteria (CC1 to CC9) cover 40 of the 93 ISO 27001:2022 Annex A controls in our mapping spreadsheet, about 43 percent. The other 53 have no direct Security criterion and count as new work for a SOC 2 holder.
This post is the reverse of the SOC 2 to ISO 27001 control mapping, which starts from each SOC 2 criterion. Here every row starts from an Annex A control, in the same order the Statement of Applicability lists them, and shows the SOC 2 criteria that map to it, the coverage, and what a SOC 2 holder still has to build.
Key insight
ISO 27001 vs ISO 27002 in this mapping
ISO 27001 is the ISMS standard that organizations certify against. ISO 27002 is the implementation guide for the same 93 controls, with identical numbering (5.x, 6.x, 7.x, 8.x). The tables below use the ISO 27001:2022 Annex A numbers, which are the same in both documents.
Key insight
Not sure where your ISO 27001 gaps are?
Answer 20 questions and get a personalized readiness score based on your existing security posture. Take the ISO 27001 Readiness Scorecard
How to Read These ISO 27001 to SOC 2 Mapping Tables
Each row maps one ISO 27001:2022 Annex A control to the SOC 2 Security criteria that map to it directly. The Coverage column uses three values from the mapping spreadsheet:
- Full: the evidence produced for at least one mapped SOC 2 criterion satisfies the ISO 27001 control without adaptation. The same log, policy, or record goes into both audit packages.
- Partial: every mapped SOC 2 criterion covers the intent of the control, but the evidence needs supplementing or reframing, typically by adding documented scope, extending a policy, or adding a step to an existing process.
- Not covered: no SOC 2 Security criterion maps to the control directly. The last column names what a SOC 2 holder still has to build.
The Full and Partial ratings come from the overlap type the spreadsheet assigns to each SOC 2 criterion. Of the 40 covered controls, 34 are Full and 6 are Partial.
Annex A controls are grouped by theme: A.5 (organizational), A.6 (people), A.7 (physical), and A.8 (technological). Each SOC 2 criterion links to its own post, and each Annex A control with a dedicated post links to it.
Organizational Controls: A.5.1 to A.5.37
20 of the 37 ISO 27001 organizational controls map directly to a SOC 2 Security criterion. The 20 covered controls group as follows:
- Policies, roles, and segregation of duties: A.5.1 to A.5.3, mapped to CC1.2, CC1.3, CC2.2, CC3.1, CC5.1, CC5.3, and CC6.3
- Access: A.5.15, A.5.16, and A.5.18, mapped to CC6.1 to CC6.3
- Suppliers: A.5.19, A.5.20, and A.5.22, mapped to CC9.2
- Incidents: A.5.25 to A.5.27, mapped to CC7.3 to CC7.5
- Continuity: A.5.29 and A.5.30, mapped to CC7.5 and CC9.1
- Independent review: A.5.35, mapped to CC4.1 and CC4.2
- Other organizational controls: A.5.6 and A.5.31 (CC2.3), A.5.8 (CC3.4), A.5.11 (CC6.5), and A.5.37 (CC5.3)
Four of the 20 are Partial: A.5.6, A.5.8, A.5.31, and A.5.35, because CC2.3, CC3.4, CC4.1, and CC4.2 each carry a Partial overlap rating.
| Annex A control | Control name | SOC 2 criteria that map to it | Coverage | What a SOC 2 holder still has to build |
| A.5.1 | Policies for information security | CC3.1, CC5.1, CC5.3 | Full | - |
| A.5.2 | Information security roles and responsibilities | CC1.2, CC1.3, CC2.2 | Full | - |
| A.5.3 | Segregation of duties | CC6.3 | Full | - |
| A.5.4 | Management responsibilities | - | Not covered | - |
| A.5.5 | Contact with authorities | - | Not covered | Register of regulator/authority contacts |
| A.5.6 | Contact with special interest groups | CC2.3 | Partial | - |
| A.5.7 | Threat intelligence | - | Not covered | Documented threat intelligence process |
| A.5.8 | Information security in project management | CC3.4 | Partial | - |
| A.5.9 | Inventory of information and other associated assets | - | Not covered | Formal asset inventory scoped to the ISMS |
| A.5.10 | Acceptable use of information and other associated assets | - | Not covered | Acceptable use rules tied to the asset inventory |
| A.5.11 | Return of assets | CC6.5 | Full | - |
| A.5.12 | Classification of information | - | Not covered | Information classification scheme |
| A.5.13 | Labelling of information | - | Not covered | Labelling scheme applied to classified information |
| A.5.14 | Information transfer | - | Not covered | Information transfer procedures and agreements |
| A.5.15 | Access control | CC6.1, CC6.3 | Full | - |
| A.5.16 | Identity management | CC6.2 | Full | - |
| A.5.17 | Authentication information | - | Not covered | Authentication information (secrets) management procedure |
| A.5.18 | Access rights | CC6.2 | Full | - |
| A.5.19 | Information security in supplier relationships | CC9.2 | Full | - |
| A.5.20 | Addressing information security within supplier agreements | CC9.2 | Full | - |
| A.5.21 | Managing information security in the ICT supply chain | - | Not covered | ICT supply chain security requirements |
| A.5.22 | Monitoring, review and change management of supplier services | CC9.2 | Full | - |
| A.5.23 | Information security for use of cloud services | - | Not covered | Cloud service security requirements and exit process |
| A.5.24 | Information security incident management planning and preparation | - | Not covered | Incident management planning and preparation procedure |
| A.5.25 | Assessment and decision on information security events | CC7.3 | Full | - |
| A.5.26 | Response to information security incidents | CC7.4 | Full | - |
| A.5.27 | Learning from information security incidents | CC7.5 | Full | - |
| A.5.28 | Collection of evidence | - | Not covered | Evidence collection procedure for incidents |
| A.5.29 | Information security during disruption | CC7.5, CC9.1 | Full | - |
| A.5.30 | ICT readiness for business continuity | CC7.5, CC9.1 | Full | - |
| A.5.31 | Legal, statutory, regulatory and contractual requirements | CC2.3 | Partial | - |
| A.5.32 | Intellectual property rights | - | Not covered | Intellectual property rights procedure |
| A.5.33 | Protection of records | - | Not covered | Records retention and protection schedule |
| A.5.34 | Privacy and protection of PII | - | Not covered | Privacy and PII protection procedure |
| A.5.35 | Independent review of information security | CC4.1, CC4.2 | Partial | - |
| A.5.36 | Compliance with policies, rules and standards for information security | - | Not covered | Internal compliance review against policies and standards |
| A.5.37 | Documented operating procedures | CC5.3 | Full | - |
The full ISO 27001 to SOC 2 mapping, in both directions, is a live Google Sheet. When the mapping is updated, everyone with the link sees the current version.
Free · Google Sheet
SOC 2 & ISO 27001 Control Mapping
Every SOC 2 Common Criterion mapped to ISO 27001:2022 Annex A, all 93 Annex A controls mapped back to SOC 2 with what a SOC 2 holder still has to build, and two sample control sets, kept current in a shared Google Sheet. Enter your email to open it.
Key insight
Notable gap in A.5.21
Managing information security in the ICT supply chain goes further than SOC 2's vendor management requirements. It requires an inventory of ICT suppliers, security requirements embedded in procurement contracts, and procedures for managing supplier-induced security incidents throughout the supply chain.
People Controls: A.6.1 to A.6.8
4 of the 8 ISO 27001 people controls map directly to a SOC 2 Security criterion. Screening, terms and conditions of employment, awareness training, and the disciplinary process (A.6.1 to A.6.4) map to CC1.1, CC1.4, CC1.5, and CC2.2. A.6.4 (disciplinary process) is Partial, because CC1.1 and CC1.5 each carry a Partial overlap rating.
| Annex A control | Control name | SOC 2 criteria that map to it | Coverage | What a SOC 2 holder still has to build |
| A.6.1 | Screening | CC1.4 | Full | - |
| A.6.2 | Terms and conditions of employment | CC1.4 | Full | - |
| A.6.3 | Information security awareness, education and training | CC1.4, CC2.2 | Full | - |
| A.6.4 | Disciplinary process | CC1.1, CC1.5 | Partial | - |
| A.6.5 | Responsibilities after termination or change of employment | - | Not covered | Post-termination responsibilities clause |
| A.6.6 | Confidentiality or non-disclosure agreements | - | Not covered | Confidentiality / NDA register |
| A.6.7 | Remote working | - | Not covered | Remote working policy |
| A.6.8 | Information security event reporting | - | Not covered | Information security event reporting channel |
Physical Controls: A.7.1 to A.7.14
4 of the 14 ISO 27001 physical controls map directly to a SOC 2 Security criterion. Perimeter, entry, storage media, and secure disposal (A.7.1, A.7.2, A.7.10, A.7.14) map to CC6.4 and CC6.5.
| Annex A control | Control name | SOC 2 criteria that map to it | Coverage | What a SOC 2 holder still has to build |
| A.7.1 | Physical security perimeters | CC6.4 | Full | - |
| A.7.2 | Physical entry | CC6.4 | Full | - |
| A.7.3 | Securing offices, rooms and facilities | - | Not covered | Secure facilities and room designation |
| A.7.4 | Physical security monitoring | - | Not covered | Physical security monitoring (e.g. CCTV, alarms) |
| A.7.5 | Protecting against physical and environmental threats | - | Not covered | Environmental threat protection assessment |
| A.7.6 | Working in secure areas | - | Not covered | Secure area working rules |
| A.7.7 | Clear desk and clear screen | - | Not covered | Clear desk and clear screen policy |
| A.7.8 | Equipment siting and protection | - | Not covered | Equipment siting and protection standard |
| A.7.9 | Security of assets off-premises | - | Not covered | Off-premises asset security procedure |
| A.7.10 | Storage media | CC6.5 | Full | - |
| A.7.11 | Supporting utilities | - | Not covered | Supporting utilities resilience (power, HVAC) |
| A.7.12 | Cabling security | - | Not covered | Cabling security standard |
| A.7.13 | Equipment maintenance | - | Not covered | Equipment maintenance schedule and records |
| A.7.14 | Secure disposal or re-use of equipment | CC6.5 | Full | - |
Key insight
Notable gap for SaaS organizations
The ten physical controls without a direct SOC 2 criterion split into two situations.
- Data center controls: A.7.5, A.7.11, A.7.12, and A.7.13 apply to data center infrastructure. For SaaS organizations with no on-premises servers, these are typically marked as applicable in the Statement of Applicability, with the cloud provider's SOC 2 report or ISO 27001 certificate as supporting evidence, a justification statement, and a review of what the provider's controls cover.
- Office and device controls: A.7.7 (clear desk and clear screen) and A.7.8 (equipment siting and protection) apply to the organization's own office and employee devices. An ISO auditor will expect a clear desk policy and documented equipment handling procedures wherever the servers are hosted.
Technological Controls: A.8.1 to A.8.34
12 of the 34 ISO 27001 technological controls map directly to a SOC 2 Security criterion: privileged access (A.8.2), malware protection (A.8.7), technical vulnerabilities (A.8.8), configuration management (A.8.9), data leakage prevention (A.8.12), logging and monitoring (A.8.15, A.8.16), software installation (A.8.19), network security and web filtering (A.8.20, A.8.23), cryptography (A.8.24), and change management (A.8.32). A.8.9 (configuration management) is Partial, because its only mapped criterion, CC5.2, carries a Partial overlap rating.
| Annex A control | Control name | SOC 2 criteria that map to it | Coverage | What a SOC 2 holder still has to build |
| A.8.1 | User endpoint devices | - | Not covered | User endpoint device standard |
| A.8.2 | Privileged access rights | CC6.1, CC6.3 | Full | - |
| A.8.3 | Information access restriction | - | Not covered | - |
| A.8.4 | Access to source code | - | Not covered | Source code access control procedure |
| A.8.5 | Secure authentication | - | Not covered | Secure authentication standard |
| A.8.6 | Capacity management | - | Not covered | Capacity management plan |
| A.8.7 | Protection against malware | CC6.6, CC6.8 | Full | - |
| A.8.8 | Management of technical vulnerabilities | CC7.1 | Full | - |
| A.8.9 | Configuration management | CC5.2 | Partial | - |
| A.8.10 | Information deletion | - | Not covered | Information deletion procedure |
| A.8.11 | Data masking | - | Not covered | Data masking standard |
| A.8.12 | Data leakage prevention | CC6.7 | Full | - |
| A.8.13 | Information backup | - | Not covered | Information backup procedure |
| A.8.14 | Redundancy of information processing facilities | - | Not covered | Redundancy design for processing facilities |
| A.8.15 | Logging | CC7.2 | Full | - |
| A.8.16 | Monitoring activities | CC4.2, CC7.1, CC7.2 | Full | - |
| A.8.17 | Clock synchronization | - | Not covered | Clock synchronization standard |
| A.8.18 | Use of privileged utility programs | - | Not covered | Privileged utility program controls |
| A.8.19 | Installation of software on operational systems | CC6.8 | Full | - |
| A.8.20 | Networks security | CC6.6 | Full | - |
| A.8.21 | Security of network services | - | Not covered | Network services security requirements |
| A.8.22 | Segregation of networks | - | Not covered | Network segregation design |
| A.8.23 | Web filtering | CC6.6 | Full | - |
| A.8.24 | Use of cryptography | CC6.1, CC6.7 | Full | - |
| A.8.25 | Secure development life cycle | - | Not covered | Secure development life cycle procedure |
| A.8.26 | Application security requirements | - | Not covered | Application security requirements specification |
| A.8.27 | Secure system architecture and engineering principles | - | Not covered | Secure system architecture and engineering principles |
| A.8.28 | Secure coding | - | Not covered | Secure coding standard |
| A.8.29 | Security testing in development and acceptance | - | Not covered | Security testing plan for development and acceptance |
| A.8.30 | Outsourced development | - | Not covered | Outsourced development security requirements |
| A.8.31 | Separation of development, test and production environments | - | Not covered | Separation of development, test and production environments |
| A.8.32 | Change management | CC8.1 | Full | - |
| A.8.33 | Test information | - | Not covered | Test data protection procedure |
| A.8.34 | Protection of information systems during audit testing | - | Not covered | Audit testing protection procedure |
What Percentage of ISO 27001:2022 Annex A Does SOC 2 Cover?
In our mapping spreadsheet, the SOC 2 Security criteria (CC1 to CC9) map directly to 40 of the 93 Annex A controls, about 43 percent. The other 53 have no direct Security criterion and count as new work for a SOC 2 holder, alongside the ISMS clauses in the next section.
| Annex A theme | Controls | Covered directly by SOC 2 Security criteria | Full | Partial | No direct SOC 2 criterion |
| Organizational (A.5) | 37 | 20 (54%) | 16 | 4 | 17 |
| People (A.6) | 8 | 4 (50%) | 3 | 1 | 4 |
| Physical (A.7) | 14 | 4 (29%) | 4 | 0 | 10 |
| Technological (A.8) | 34 | 12 (35%) | 11 | 1 | 22 |
| Total | 93 | 40 (43%) | 34 | 6 | 53 |
The 53 Annex A controls without a direct SOC 2 criterion, by theme:
- Organizational (A.5), 17 controls: A.5.4, A.5.5, A.5.7, A.5.9, A.5.10, A.5.12, A.5.13, A.5.14, A.5.17, A.5.21, A.5.23, A.5.24, A.5.28, A.5.32, A.5.33, A.5.34, and A.5.36
- People (A.6), 4 controls: A.6.5 (responsibilities after termination), A.6.6 (confidentiality agreements), A.6.7 (remote working), and A.6.8 (event reporting)
- Physical (A.7), 10 controls: A.7.3 to A.7.9 and A.7.11 to A.7.13
- Technological (A.8), 22 controls: A.8.1, A.8.3 to A.8.6, A.8.10, A.8.11, A.8.13, A.8.14, A.8.17, A.8.18, A.8.21, A.8.22, A.8.25 to A.8.31, A.8.33, and A.8.34
Key insight
What covered means in the ISO 27001 to SOC 2 mapping
The spreadsheet counts a control as covered only when a SOC 2 Security criterion maps to it directly. Many of the other 53 still benefit from SOC 2 work: Availability criteria produce evidence for capacity, backup, and redundancy (A.8.6, A.8.13, A.8.14), Confidentiality criteria for classification and labelling (A.5.12, A.5.13), and existing authentication and secure development controls often go a long way toward A.8.5 and A.8.25. Treat that as partial reuse, and confirm every control in the Statement of Applicability with your certification body.
What ISO 27001 Adds Beyond the Annex A Controls
ISO 27001 also requires the ISMS management clauses, which have no SOC 2 equivalent:
- Clause 6.1.3, Statement of Applicability: lists all necessary controls, the justification for including each, whether each is implemented, and the justification for excluding any Annex A controls.
- Clause 9.2, internal audit programme: a documented programme with defined frequency, methods, responsibilities, planning requirements, and reporting.
- Clause 9.3, management review: documented reviews at planned intervals with required inputs and documented decisions on continual improvement.
- Clause 10.2, nonconformity and corrective action: a documented process for identifying nonconformities, determining causes, implementing corrective actions, and reviewing their effectiveness.
The SOC 2 to ISO 27001 control mapping covers each clause in detail, including the required management review inputs.
Key insight
ISO 27001 timeline for SOC 2 holders
The typical timeline to ISO 27001 certification is 4 to 6 months for organizations with a mature SOC 2 program, compared with 9 to 12 months from scratch. Most of that time goes to building the ISMS management artifacts, completing an internal audit cycle, and scheduling the Stage 1 and Stage 2 external audits.
The SOC 2 vs ISO 27001 comparison covers how the two frameworks relate, including audit mechanics, certification timelines, and what carries over.
Adding ISO 27001 to SOC 2?
We map what transfers and build only the net-new work toward an effective security program.
Frequently Asked Questions About ISO 27001 to SOC 2 Mapping
How many ISO 27001 Annex A controls map to SOC 2?
In our mapping spreadsheet, the SOC 2 Security criteria (CC1 to CC9) map directly to 40 of the 93 ISO 27001:2022 Annex A controls, about 43 percent: 20 of 37 organizational, 4 of 8 people, 4 of 14 physical, and 12 of 34 technological. Of the 40, 34 are Full and 6 are Partial. The other 53 count as new work for a SOC 2 holder.
Which ISO 27001 controls have no SOC 2 equivalent?
In our mapping spreadsheet, 53 of the 93 Annex A controls have no direct SOC 2 Security criterion: 17 organizational, 4 people, 10 physical, and 22 technological. The tables above list each one with what a SOC 2 holder still has to build, such as threat intelligence (A.5.7), classification and labelling (A.5.12, A.5.13), and secure coding (A.8.28).
Can SOC 2 evidence be used for the ISO 27001 certification audit?
Yes, for the 40 Annex A controls a SOC 2 Security criterion maps to directly. Where the mapping is Full (34 controls), the same log or record goes into both audit packages. Where it is Partial (6 controls), existing evidence is a starting point that needs supplementing. The ISMS documents are ISO-specific and need to be built: the Statement of Applicability, internal audit reports, and management review records.
What is the difference between ISO 27001 and ISO 27002 in a SOC 2 mapping?
ISO 27001 defines the requirements for an information security management system and is what organizations certify against. ISO 27002 is the companion implementation guide, using the same 93 controls and the same numbering (5.x through 8.x). A mapping of ISO 27002 controls to SOC 2 uses the same Annex A structure as this post.
Does adding Availability or Confidentiality increase ISO 27001 overlap?
Yes. In our mapping spreadsheet, the Security criteria alone map directly to 40 of 93 Annex A controls. Availability criteria add evidence for capacity, backup, and redundancy (A.8.6, A.8.13, A.8.14), and Confidentiality criteria add evidence for classification and labelling (A.5.12, A.5.13) and partial coverage of data masking (A.8.11). Confirm each control in the Statement of Applicability.
Is there a spreadsheet version of the ISO 27001 to SOC 2 mapping?
Yes. The full mapping is a live Google Sheet that covers both directions: SOC 2 criteria to Annex A, and all 93 Annex A controls back to SOC 2 with what a SOC 2 holder still has to build. Google Sheets can export it to Excel through File, Download, Microsoft Excel.
Further Reading
- SOC 2 to ISO 27001 Control Mapping: What Transfers: the same mapping starting from each SOC 2 criterion, across all five Trust Services Criteria
- SOC 2 vs ISO 27001: What Carries Over and How to Do Both: scope differences, certification mechanics, and sequencing decisions
- SOC 2 Trust Services Criteria: A Practitioner's Guide: what each criterion requires
- Building SOC 2 Evidence Architecture: how to design evidence collection so the same records serve multiple frameworks
Ready to Start Your Compliance Journey?
Get a clear, actionable roadmap with our readiness assessment.
Contact Us
Sample SOC 2 Control List
Input your email to download the list.
About the Author
Former security architect for Bank of Canada and Payments Canada. 20+ years building compliance programs for critical infrastructure.