SOC 2 vs ISO 27001: What Carries Over and How to Do Both

SOC 2 is an attestation report a licensed CPA firm issues against the AICPA's Trust Services Criteria, describing whether a service organization's controls are designed and operating effectively. ISO 27001 is an international standard; an accredited certification body certifies that an organization runs an information security management system (ISMS) that meets Clauses 4 to 10 and applies the 93 Annex A controls. North American enterprise buyers usually ask for SOC 2. International and public-sector buyers usually ask for ISO 27001.

The two share a large foundation. Mapped control by control, 18 of the 33 SOC 2 Security criteria (CC1 to CC9) map fully to ISO 27001 Annex A controls, 12 map partially, and 3 have no Annex A counterpart. Coming from the other direction, the SOC 2 Security criteria cover 40 of the 93 Annex A controls, and the remaining 53 are new work for a SOC 2 holder, along with the ISMS clauses themselves.

See the exact overlap, control by control: download the spreadsheet.

The question we hear in nearly every first conversation is the same: should we do SOC 2 or ISO 27001, and can we do both without doubling the work? This guide answers it at the control level.

What is the difference between SOC 2 and ISO 27001?

SOC 2 produces a shareable report; ISO 27001 produces a certificate. A SOC 2 report runs 40 to 60 pages and describes the systems in scope, each control, how the auditor tested it, and the results. Buyers read it and evaluate it. An ISO 27001 certificate runs 1 to 2 pages and confirms that the ISMS meets the standard. Buyers accept it as proof without seeing individual controls.

SOC 2 asks are your controls working? ISO 27001 asks do you have a system that keeps them working? Which one you need depends on who you sell to.

What carries over from SOC 2 to ISO 27001?

Most of the technical control work carries over. The governance wrapper is the main new work.

From the SOC 2 side (33 Security criteria):

• 18 map fully. Access control (CC6.1 to CC6.8), system operations and incident response (CC7.1 to CC7.5), change management (CC8.1), vendor management (CC9.2), plus the control environment criteria for structure, competence and policy deployment (CC1.3, CC1.4, CC5.3). The SOC 2 evidence for these satisfies the matching Annex A controls as it stands.
• 12 map partially. Ethics and accountability (CC1.1, CC1.5), board oversight (CC1.2), internal and external communication (CC2.2, CC2.3), objectives and change assessment (CC3.1, CC3.4), monitoring (CC4.1, CC4.2), control selection (CC5.1, CC5.2), and business continuity (CC9.1). The evidence is reusable, with extra documentation for the ISO control.
• 3 have no Annex A counterpart. CC2.1 (quality information), CC3.2 (risk identification) and CC3.3 (fraud risk). ISO 27001 handles these in its main clauses (risk assessment in Clause 6.1, management review in Clause 9.3) instead of in Annex A.

From the ISO 27001 side (93 Annex A controls):

The asymmetry is expected. Annex A is a broader catalogue than the SOC 2 Security criteria, so a SOC 2 program covers less of ISO 27001 than an ISO 27001 program covers of SOC 2. The spreadsheet lists every control, the criteria that map to it, and what a SOC 2 holder still has to build.

The AICPA also publishes an official mapping of the 2017 Trust Services Criteria to ISO 27001. It maps requirements to requirements. Our spreadsheet maps from the evidence side, showing what you can reuse, and our control-by-control mapping guide walks through what transfers.

What does ISO 27001 add for a SOC 2 holder?

The largest new pieces sit in the ISMS clauses, ahead of any Annex A control:

• ISMS scope and context (Clause 4). A defined scope, the internal and external issues, and the interested parties.
• Statement of Applicability. Every one of the 93 Annex A controls is included or excluded with a justification. SOC 2 has no equivalent, and this is typically the single largest piece of new work.
• Risk treatment (Clause 6.1). SOC 2 expects risk assessments and a risk register. ISO 27001 adds a formal treatment process tied to the Statement of Applicability. Scope that spans cloud and on-premises makes this harder; see risk management for hybrid environments.
• Internal audit (Clause 9.2) and management review (Clause 9.3). The organization audits its own ISMS and leadership reviews it on a cadence. These call for executive time and documented decisions, which is different work from implementing controls.
• Continual improvement (Clause 10). A formal process, where SOC 2 relies on monitoring (CC4.1, CC4.2).

In Annex A, the uncovered controls cluster in a few places: physical security beyond the perimeter and entry controls (10 of 14 physical controls, such as clear desk, equipment siting and cabling), information handling (classification, labelling, information transfer), threat intelligence (A.5.7, added in the 2022 revision), and the secure development controls (A.8.25 to A.8.31).

What does SOC 2 add for an ISO 27001 holder?

• A system description. A buyer-facing description of the service, infrastructure, people, processes and controls. ISO 27001's scope document serves a different audience.
• Service-specific scoping. The SOC 2 auditor maps controls to the in-scope services and systems, whatever the ISO certificate covers. Teams moving from ISO 27001 to SOC 2 tend to underestimate this.
• Trust Services Categories beyond Security. Availability, Processing Integrity, Confidentiality and Privacy each come with auditable criteria. ISO 27001 touches availability and confidentiality inside Annex A.
• A report buyers read closely. Procurement teams read the SOC 2 report line by line, so the system description and any exceptions need careful writing.

SOC 2 or ISO 27001: which do you need first?

Start with the framework your largest revenue opportunity asks for.

• SOC 2 first when your buyers are in North America and ask for a report during procurement. This is the usual starting point for B2B SaaS, cloud providers and IT service providers selling to US and Canadian enterprises. A Type 1 report can be ready in 8 to 12 weeks while you build toward Type 2.
• ISO 27001 first when your buyers are in Europe, APAC or the Middle East, or when regulations or public procurement outside North America reference ISO standards. The broader ISMS foundation makes SOC 2 faster afterward.
• Both when you sell across markets or large customers ask for both.

ISO 27001 vs SOC 2 Type 2. Buyers comparing the two usually mean the SOC 2 Type 2 report, because it tests operating effectiveness over an observation period, typically 12 months. ISO 27001 reaches a similar assurance level through Stage 2 and the annual surveillance audits. Neither replaces the other in a market that expects it.

Canadian companies follow the same rule: the choice depends on where your customers are, whatever your place of incorporation. Canadian companies selling to US enterprises almost always need SOC 2. Those selling into European or global markets may need ISO 27001.

How do you pursue SOC 2 and ISO 27001 at the same time?

Build one program against both frameworks, then sequence the audits. In our engagements, running both against a shared program takes 10 to 12 weeks of build effort, compared with 16 to 20 weeks when they run as separate projects. Five steps make the difference:

1. Build the control set against the union of both frameworks. Start from the Trust Services Criteria and Annex A together. The combined set is only a little larger than either alone, because the ISO-specific pieces (Statement of Applicability, internal audit, management review, ISMS scope, threat intelligence, granular physical controls) get designed in from the start. GRC platforms support this directly: one control tagged to both frameworks, evidence collected once.
2. Sequence the audits and run one program. The order we see work most consistently: SOC 2 Type 1 to prove design, ISO 27001 Stage 1 and Stage 2, then SOC 2 Type 2 across an observation window that lines up with the first ISO surveillance year. The same access reviews, vendor reviews and change tickets feed both audits.
3. Write each policy once, for both lenses. A dual-framework policy reads like an operational SOC 2 policy with ISMS scope and clause references around it. One policy, one review cycle, credit in both frameworks.
4. Build the risk register and the Statement of Applicability together. Built later, after SOC 2 is live, the Statement of Applicability typically takes 3 to 4 weeks. Built alongside the first risk register, it takes days, because the include and exclude decisions come out of the same conversation.
5. Choose an audit firm that offers both. Several reputable firms run combined SOC 2 and ISO 27001 engagements, which shares walkthroughs and evidence sampling across both audits.

Already certified in one? Adding ISO 27001 to a mature SOC 2 program typically takes 8 to 12 weeks of focused build work and 4 to 6 months to the certificate, once Stage 1, Stage 2 and the certification body's scheduling are included. The timeline assumes the SOC 2 program is well documented.

Can a SOC 2+ report cover ISO 27001?

A SOC 2+ report covers ISO 27001 controls inside a SOC 2 audit. The ISO 27001 certificate itself comes from a separate certification audit. SOC 2+ is the common name for a SOC 2 report with additional subject matter, a reporting option defined by the AICPA. The CPA firm tests the Trust Services Criteria as usual, then maps the same controls, plus any extra controls the second framework requires, to ISO 27001, HIPAA, PCI DSS or CSA STAR. You receive one report covering both sets of criteria.

What a SOC 2+ report gives you. Reasonable assurance that your controls align with the added framework. An ISO 27001 certificate is issued by an accredited certification body. Some customers accept a SOC 2+ report as evidence of ISO 27001 alignment, and others require the certificate. Your customers and contracts decide which one you need.

Choose SOC 2+ when three conditions hold:

• Your customers accept it. Ask procurement directly before you scope the audit, and get the answer in writing where you can. A procurement checklist that asks for "ISO 27001 certified" typically needs the certificate.
• Your SOC 2 program is stable. Controls operate, evidence collection is consistent, and the last audit had few or no exceptions. For a first SOC 2, complete one Type 2 cycle, then add the second framework at renewal.
• Your customers ask for the added framework. Pull your recent security questionnaires and customer audit requests, and count how often each framework appears. Add the one your pipeline asks for.

Which frameworks suit SOC 2+? ISO 27001 is the strongest fit, because its access control, incident response, change management, risk assessment, vendor management and encryption controls overlap with SOC 2. Its governance clauses 4 to 10 (ISMS scope, risk treatment, management review, internal audit) have no SOC 2 equivalent, so that work stays on your plan. HIPAA maps mainly through the Security and Privacy criteria. PCI DSS adds cardholder data environment segmentation, payment application security and penetration testing scoped to payment infrastructure, which the auditor tests separately, so the savings are smaller.

Same control, different evidence. One encryption-at-rest control can satisfy SOC 2 CC6.1, ISO 27001 A.8.24, HIPAA 164.312(a)(2)(iv) and PCI DSS 3.5. Each framework still asks for different evidence: operating effectiveness over the audit period for SOC 2, a place in a documented ISMS with management review for ISO 27001, and validation of specific encryption standards for cardholder data under PCI DSS. A GRC platform tracks the mapping. Someone on your team still confirms that each evidence package meets each framework's intent.

How does ISO 27001 certification work?

1. Stage 1, documentation review. The certification body reviews the ISMS documentation, the Statement of Applicability, the risk methodology and the policies. Gaps become corrective actions to close before Stage 2.
2. Stage 2, evidence-based assessment. The auditor examines how the ISMS operates: logs, staff interviews, controls against their documentation, and signs that management maintains the system.
3. Surveillance audits in years two and three. Lighter annual audits that check ongoing operation, management reviews and continual improvement.
4. Recertification. A full recertification audit takes place before the certificate expires at the end of the three-year cycle.

From kickoff, first certification typically takes 6 to 12 months, or 4 to 6 months with an existing SOC 2 program.

Common mistakes in dual-framework programs

• Generic policy templates. A policy written for a different company creates a gap between what the policy says and what the team does. Auditors in both frameworks are trained to find that gap.
• Two separate projects. Separate teams, evidence repositories and policy sets mean doing the same work twice. One program mapped to both frameworks avoids it.
• Treating ISO 27001 as more controls. Teams coming from SOC 2 often assume this. The management system work (risk treatment, management review, internal audit, continual improvement) needs executive engagement and a review cadence many SOC 2 programs have yet to establish.
• Building evidence for one audit at a time. Evidence types and retention differ between the frameworks. Design the evidence architecture once, with both in mind.

FAQ

How much of my SOC 2 work carries over to ISO 27001?

Most of the technical control work. Of the 33 SOC 2 Security criteria, 18 map fully to ISO 27001 Annex A and 12 partially. From the ISO side, SOC 2 covers 40 of the 93 Annex A controls. The rest is the ISMS (scope, Statement of Applicability, internal audit, management review, continual improvement) and controls SOC 2 treats lightly, such as detailed physical security. Download the mapping spreadsheet to see every control.

Is there an official SOC 2 to ISO 27001 mapping?

Yes. The AICPA publishes a mapping of the 2017 Trust Services Criteria to ISO 27001. It maps requirements to requirements; you still decide which of your own controls satisfy both. Our spreadsheet and control mapping guide give the working view from the evidence side.

What is the difference between ISO 27001 certification and SOC 2 attestation?

ISO 27001 certification is a pass or fail outcome from an accredited certification body confirming the ISMS meets the standard. SOC 2 is an attestation report from a licensed CPA firm that evaluates controls against the Trust Services Criteria. A SOC 2 report can include exceptions or a qualified opinion and still be valid. Unresolved major nonconformities in an ISO 27001 audit block certification.

Can I run SOC 2 and ISO 27001 on the same GRC platform?

Yes. GRC platforms such as Vanta, Drata and Secureframe support multi-framework mapping, so one control implementation can satisfy both SOC 2 criteria and ISO 27001 Annex A controls.

Do I need two separate security programs?

One program covers both. Build one effective security program, then map it to each framework. Separate framework-specific programs lead to duplicate policies, duplicate evidence and duplicate audit preparation.

How long does it take to add ISO 27001 if I already have SOC 2?

Typically 8 to 12 weeks of focused build work (ISMS documentation, the Statement of Applicability, gap controls) and 4 to 6 months to the certificate including Stage 1 and Stage 2. This assumes a mature, well-documented SOC 2 program.

Is ISO 27001 cheaper because the full audit happens every three years?

The difference is smaller than it looks. ISO 27001 has annual surveillance audits, plus the cost of running the ISMS and its internal audit. Choose based on what your market asks for.

Do ISO 27001 and SOC 2 need renewing every year?

SOC 2 Type 2 reports cover a defined period, typically 12 months, and customers expect a new report each year. An ISO 27001 certificate runs for three years with surveillance audits in years two and three and a recertification audit before it expires. Both require the controls to keep operating between audits.

Can a SOC 2+ report replace an ISO 27001 certification?

An ISO 27001 certificate is issued by an accredited certification body after the Stage 1 and Stage 2 audits. A SOC 2+ report gives reasonable assurance that your SOC 2 controls align with ISO 27001, within one SOC 2 audit. Some customers accept a SOC 2+ report as evidence of ISO 27001 alignment, and others require the certificate, so ask your customers which one their contracts call for.

ISO 27001 Annex A control implementation guides

We maintain implementation guides for individual Annex A controls, each covering what the control requires, what auditors look for, and how to build the evidence. More control guides are being added as the series expands.

Organizational controls (A.5)

• A.5.7 Threat intelligence
• A.5.15 Access control
• A.5.16 Identity management
• A.5.17 Authentication information
• A.5.18 Access rights
• A.5.24 Incident management planning and preparation

Technological controls (A.8)

• A.8.1 User endpoint devices
• A.8.2 Privileged access rights
• A.8.3 Information access restriction
• A.8.4 Access to source code
• A.8.5 Secure authentication
• A.8.7 Protection against malware
• A.8.8 Management of technical vulnerabilities
• A.8.9 Configuration management
• A.8.12 Data leakage prevention
• A.8.13 Information backup
• A.8.15 Logging
• A.8.16 Monitoring activities
• A.8.20 Networks security
• A.8.24 Use of cryptography
• A.8.25 Secure development life cycle
• A.8.28 Secure coding
• A.8.32 Change management

Further reading

• SOC 2 to ISO 27001 control mapping: what transfers and what's net-new
• ISO 42001 vs ISO 27001
• Building an ISMS that operates
• SOC 2 Trust Services Criteria reference guide
• ISO 27001 internal audit process
• Five ISO 27001 internal audit findings before certification
• ISO 27001 internal audit consulting in Canada