SOC 2 vs ISO 27001: What Carries Over and How to Do Both

SOC 2 is an attestation report a licensed CPA firm issues against the AICPA's Trust Services Criteria. The report describes whether a service organization's controls are designed and operating effectively. ISO 27001 is an international standard. An accredited certification body certifies that an organization runs an information security management system (ISMS) that meets Clauses 4 to 10 and considers all 93 Annex A controls in a Statement of Applicability.

• North American enterprise buyers usually ask for SOC 2.
• International and public-sector buyers usually ask for ISO 27001.

A SOC 2 holder already covers 40 of ISO 27001's 93 Annex A controls, and 30 of the 33 SOC 2 Security criteria map fully or partially to ISO 27001 (Truvo Cyber, 2026).

See the exact overlap, control by control: download the spreadsheet.

What is the difference between SOC 2 and ISO 27001?

SOC 2 produces a report buyers read. ISO 27001 produces a certificate buyers accept.

SOC 2 asks are your controls working? ISO 27001 asks do you have a system that keeps them working? Which one you need depends on who you sell to.

What carries over from SOC 2 to ISO 27001?

Most of the technical control work carries over. The governance wrapper is the main new work.

From the SOC 2 side (33 Security criteria):

• 18 map fully. Access control (CC6.1 to CC6.8), system operations and incident response (CC7.1 to CC7.5), change management (CC8.1), vendor management (CC9.2), plus the control environment criteria for structure, competence and policy deployment (CC1.3, CC1.4, CC5.3). The SOC 2 evidence for these satisfies the matching Annex A controls unchanged.
• 12 map partially. Ethics and accountability (CC1.1, CC1.5), board oversight (CC1.2), internal and external communication (CC2.2, CC2.3), objectives and change assessment (CC3.1, CC3.4), monitoring (CC4.1, CC4.2), control selection (CC5.1, CC5.2), and business continuity (CC9.1). The evidence is reusable, with extra documentation for the ISO control.
• 3 have no Annex A counterpart. CC2.1 (quality information), CC3.2 (risk identification) and CC3.3 (fraud risk). ISO 27001 handles these in the main clauses (risk assessment in Clause 6.1, management review in Clause 9.3) instead of in Annex A.

From the ISO 27001 side (93 Annex A controls):

Annex A is a broader catalogue than the SOC 2 Security criteria, SOC 2 covers 40 of the 93 Annex A controls, while Annex A covers 30 of the 33 SOC 2 criteria fully or partially. The spreadsheet lists every control, the mapped criteria, and what a SOC 2 holder still has to build.

The AICPA also publishes an official mapping of the 2017 Trust Services Criteria to ISO 27001. The AICPA mapping matches requirements to requirements. Our spreadsheet maps from the evidence side, showing what you can reuse, and our control-by-control mapping guide walks through what transfers.

What does ISO 27001 add for a SOC 2 holder?

The largest new pieces sit in the ISMS clauses, ahead of any Annex A control:

• ISMS scope and context (Clause 4). A defined scope, the internal and external issues, and the interested parties.
• Statement of Applicability. Every one of the 93 Annex A controls is included or excluded with a justification. SOC 2 has no equivalent, and the Statement of Applicability is usually the largest piece of new work.
• Risk treatment (Clause 6.1). SOC 2 expects risk assessments and a risk register. ISO 27001 adds a formal treatment process tied to the Statement of Applicability. Scope that spans cloud and on-premises makes risk treatment harder. See risk management for hybrid environments.
• Internal audit (Clause 9.2) and management review (Clause 9.3). Both need executive time and documented decisions, which is different work from implementing controls.
• Continual improvement (Clause 10). A formal process, where SOC 2 relies on monitoring (CC4.1, CC4.2).

In Annex A, the uncovered controls cluster in four places:

• Physical security beyond the perimeter and entry controls (10 of 14 physical controls, such as clear desk, equipment siting, and cabling)
• Information handling (classification, labelling, information transfer)
• Threat intelligence (A.5.7, added in the 2022 revision)
• Secure development (A.8.25 to A.8.31)

What does SOC 2 add for an ISO 27001 holder?

• A system description. A buyer-facing description of the service, infrastructure, people, processes, and controls. ISO 27001's scope document serves a different audience.
• Service-specific scoping. The SOC 2 auditor maps controls to the in-scope services and systems, whatever the ISO certificate covers. Teams moving from ISO 27001 to SOC 2 tend to underestimate this step.
• Trust Services Categories beyond Security. Availability, Processing Integrity, Confidentiality, and Privacy each come with auditable criteria. ISO 27001 touches availability and confidentiality inside Annex A.
• A report buyers read closely. Procurement teams read the SOC 2 report line by line, so the system description and any exceptions need careful writing.

SOC 2 or ISO 27001: which do you need first?

Start with the framework your largest revenue opportunity asks for.

• SOC 2 first when your buyers are in North America and ask for a report during procurement. B2B SaaS, cloud, and IT service providers selling to US and Canadian enterprises usually start here. A Type 1 report can be ready in 8 to 12 weeks while you build toward Type 2.
• ISO 27001 first when your buyers are in Europe, APAC, or the Middle East, or when regulations or public procurement outside North America reference ISO standards. The broader ISMS foundation makes SOC 2 faster afterward.
• Both when you sell across markets or large customers ask for both.

ISO 27001 vs SOC 2 Type 2. Buyers comparing the two usually mean the SOC 2 Type 2 report, which tests operating effectiveness over an observation period, typically 12 months. ISO 27001 reaches a similar assurance level through Stage 2 and the annual surveillance audits. Neither replaces the other in a market that expects a specific one.

Canadian companies follow the same rule: customer location decides, not place of incorporation.

Canadian teams that want outside help with that first report can compare SOC 2 consulting firms in Canada on engagement model, framework breadth and price.

Truvo's SOC 2 consulting services scope that first report around the services buyers ask about, then map ISO 27001 onto the same program when a European customer asks for ISO 27001.

How do you pursue SOC 2 and ISO 27001 at the same time?

Build one program against both frameworks, then sequence the audits. In our engagements, a shared program takes 10 to 12 weeks of build effort, against 16 to 20 weeks for separate projects. Five steps:

1. Build one control set for both frameworks. Start from the Trust Services Criteria and Annex A together, and design the ISO-only pieces in from the start: the Statement of Applicability, internal audit, management review, ISMS scope, threat intelligence, and the granular physical controls. GRC platforms tag one control to both frameworks and collect evidence once.
2. Sequence the audits. The order we see work most often: SOC 2 Type 1, then ISO 27001 Stage 1 and Stage 2, then a SOC 2 Type 2 observation window that lines up with the first ISO surveillance year. The same access reviews, vendor reviews, and change tickets feed both audits.
3. Write each policy once. Write an operational SOC 2 policy, then add the ISMS scope and clause references. One policy, one review cycle, credit in both frameworks.
4. Build the risk register and the Statement of Applicability together. Built after SOC 2 is live, the Statement of Applicability usually takes 3 to 4 weeks. Built with the first risk register, the Statement of Applicability takes days.
5. Pick an audit firm that offers both. A combined engagement shares walkthroughs and evidence sampling across the two audits.

Already certified in one? Adding ISO 27001 to a mature, well documented SOC 2 program usually takes 8 to 12 weeks of build work and 4 to 6 months to the certificate, including Stage 1, Stage 2, and the certification body's scheduling.

Want a fixed schedule? The ISO 27001 Accelerator is built to reach certification-ready in eight weeks.

A virtual CISO can own the combined program and both audit calendars.

The diagram below shows the audit calendar for one program that covers both frameworks, from the shared build to the third year of the ISO 27001 certificate.

One build, one evidence stream, two audit calendars. Click to enlarge.

Can a SOC 2+ report cover ISO 27001?

A SOC 2+ report covers ISO 27001 controls inside a SOC 2 audit, an option defined by the AICPA. The CPA firm tests the Trust Services Criteria, then maps the same controls, plus any extra controls, to ISO 27001, HIPAA, PCI DSS, or CSA STAR. You receive one report. The ISO 27001 certificate still needs a separate audit by an accredited certification body.

A SOC 2+ report gives reasonable assurance that your controls align with ISO 27001. Some customers accept that as evidence of alignment. Others require the certificate. Your customers and contracts decide.

Choose SOC 2+ when:

• Your customers accept the report. Ask procurement before you scope the audit, in writing where you can. A checklist that asks for "ISO 27001 certified" usually needs the certificate.
• Your SOC 2 program is stable. Controls operate, evidence collection is consistent, and the last audit had few or no exceptions. For a first SOC 2, complete one Type 2 cycle, then add the second framework at renewal.
• Your pipeline asks for the added framework. Count how often each framework appears in recent security questionnaires.

Which frameworks fit SOC 2+ best?

• ISO 27001: the strongest fit, since most Annex A controls overlap with SOC 2. Clauses 4 to 10 have no SOC 2 equivalent, so that work stays on your plan.
• HIPAA: maps mainly through the Security and Privacy criteria. See SOC 2 vs HIPAA.
• PCI DSS: smaller savings. Cardholder data environment segmentation, payment application security, and penetration testing scoped to payment infrastructure are tested separately.

Same control, different evidence. One encryption-at-rest control can satisfy SOC 2 CC6.1, ISO 27001 A.8.24, HIPAA 164.312(a)(2)(iv), and PCI DSS 3.5. Each framework still wants different evidence:

• SOC 2: proof the control operated across the audit period
• ISO 27001: a place in a documented ISMS with management review
• PCI DSS: validation of specific encryption standards for cardholder data

A GRC platform tracks the mapping, and someone on your team confirms that each evidence package meets each framework's intent.

How does ISO 27001 certification work?

1. Stage 1, documentation review. The certification body reviews the ISMS documents, the Statement of Applicability, the risk methodology, and the policies. Gaps become corrective actions to close before Stage 2. The certification body also checks that internal audits and management reviews are planned and performed, so complete one cycle of each before the audit.
2. Stage 2, evidence-based assessment. The auditor checks how the ISMS operates: logs, staff interviews, and controls against their documentation.
3. Surveillance audits in years two and three. Lighter annual checks of ongoing operation, management review, and continual improvement.
4. Recertification. A full audit before the three-year certificate expires.

From kickoff, first certification typically takes 6 to 12 months, or 4 to 6 months with an existing SOC 2 program.

SOC 2 and ISO 27001 together: what mistakes should you avoid?

• Generic policy templates. Auditors in both frameworks look for gaps between what a policy says and what the team does.
• Two separate projects. Separate teams, evidence repositories, and policy sets mean doing the same work twice.
• Treating ISO 27001 as more controls. The management system work (risk treatment, management review, internal audit, continual improvement) needs executive time and a review cadence many SOC 2 programs lack.
• Building evidence for one audit at a time. Evidence types and retention differ. Design the evidence architecture once, for both.

Frequently Asked Questions

How much of my SOC 2 work carries over to ISO 27001?

Most of the technical control work: 18 of the 33 SOC 2 Security criteria map fully to ISO 27001 Annex A and 12 partially, and SOC 2 covers 40 of the 93 Annex A controls. The new work is mostly the ISMS and controls SOC 2 treats lightly, such as detailed physical security.

Is there an official SOC 2 to ISO 27001 mapping?

Yes. The AICPA publishes a mapping of the 2017 Trust Services Criteria to ISO 27001, requirement to requirement. Our spreadsheet and control mapping guide show which evidence you can reuse.

What is the difference between ISO 27001 certification and SOC 2 attestation?

ISO 27001 certification is a pass or fail outcome from an accredited certification body. SOC 2 is an attestation report from a licensed CPA firm. A SOC 2 report can include exceptions and still be valid. Unresolved major nonconformities block ISO 27001 certification.

Can I run SOC 2 and ISO 27001 on the same GRC platform?

Yes. GRC platforms such as Vanta, Drata, and Secureframe support multi-framework mapping, so one control implementation can satisfy both SOC 2 criteria and ISO 27001 Annex A controls.

Can we complete SOC 2 and ISO 27001 audits in the same year?

Yes for the SOC 2 Type 1 report and the ISO 27001 certificate, when one program is built against both frameworks. The SOC 2 Type 2 report follows after the observation window, typically 12 months, which lines up with the first ISO surveillance year. The same access reviews, vendor reviews and change tickets feed both audits.

Do SOC 2 and ISO 27001 need the same audit firm?

Each framework calls for a different auditor: a licensed CPA firm issues the SOC 2 report, and an accredited certification body issues the ISO 27001 certificate. Some firms offer both, which shares walkthroughs and evidence sampling across the two audits. With two separate firms, the shared program and evidence still save the build work, and each firm tests separately.

Can a SOC 2+ report replace an ISO 27001 certification?

Not always. A SOC 2+ report gives reasonable assurance that your controls align with ISO 27001, while only an accredited certification body issues the certificate. Some customers accept the report and others require the certificate, so check your contracts.

How long does it take to add ISO 27001 if I already have SOC 2?

Typically 8 to 12 weeks of build work (ISMS documentation, the Statement of Applicability, gap controls) and 4 to 6 months to the certificate, for a mature, well-documented SOC 2 program.

Is ISO 27001 cheaper because the full audit happens every three years?

The difference is smaller than it looks. ISO 27001 has annual surveillance audits, plus the cost of running the ISMS and the ISMS internal audit. Choose based on what your market asks for.

Do ISO 27001 and SOC 2 need renewing every year?

SOC 2: yes, customers expect a new Type 2 report each year. ISO 27001: the certificate runs three years, with surveillance audits in years two and three and recertification before expiry. Both need the controls to keep operating between audits.

ISO 27001 Annex A control implementation guides

Each guide covers what the control requires, what auditors look for, and how to build the evidence.

Organizational controls (A.5)

• A.5.7 Threat intelligence
• A.5.15 Access control
• A.5.16 Identity management
• A.5.17 Authentication information
• A.5.18 Access rights
• A.5.24 Incident management planning and preparation

Technological controls (A.8)

• A.8.1 User endpoint devices
• A.8.2 Privileged access rights
• A.8.3 Information access restriction
• A.8.4 Access to source code
• A.8.5 Secure authentication
• A.8.7 Protection against malware
• A.8.8 Management of technical vulnerabilities
• A.8.9 Configuration management
• A.8.12 Data leakage prevention
• A.8.13 Information backup
• A.8.15 Logging
• A.8.16 Monitoring activities
• A.8.20 Networks security
• A.8.24 Use of cryptography
• A.8.25 Secure development life cycle
• A.8.28 Secure coding
• A.8.32 Change management

Further reading

• SOC 2 to ISO 27001 control mapping: what transfers and what's net-new
• ISO 42001 vs ISO 27001
• Building an ISMS that operates
• SOC 2 Trust Services Criteria reference guide
• ISO 27001 internal audit process
• Five ISO 27001 internal audit findings before certification
• ISO 27001 internal audit consulting in Canada