ISO 27001 vs SOC 2: Which Should You Get First?

Both show customers you take security seriously, but they're not the same thing and they don't answer the same question. Here's what each one actually covers, and a practical way to decide where to start.

What ISO 27001 actually certifies

ISO/IEC 27001 certifies that you operate an information security management system, an ISMS, that meets the standard's clauses 4 through 10, and that you've assessed and addressed the 93 Annex A controls relevant to your organisation in a Statement of Applicability. It's a management-system standard before it's a control checklist: an auditor is checking that you have a running process for identifying risk, deciding what to do about it and reviewing whether it's working, not just that individual technical controls exist in isolation.

Certification is issued by an accredited certification body after a two-stage audit: a Stage 1 review of your ISMS documentation and scope, followed by a Stage 2 audit that tests whether the controls are actually operating. The certificate is typically valid for three years, with surveillance audits in between.

What SOC 2 actually attests

SOC 2 is an attestation, not a certification. A licensed CPA firm examines your controls against the AICPA's Trust Services Criteria, security is always in scope, with availability, processing integrity, confidentiality and privacy as optional additional criteria, and writes a report describing what they found. There's no "SOC 2 certificate" to hang on a wall; what you get is a detailed report you share directly with customers, usually under NDA.

There are two report types. A Type I report describes your controls as designed at a single point in time. A Type II report goes further, describing how those controls actually operated over an observation window, commonly three to twelve months, which is why Type II carries more weight with enterprise buyers and takes longer to obtain the first time.

Side by side

How to decide which to pursue first

The honest answer is usually: whichever one your actual customers, regulators or tenders are asking for. If you don't have a specific ask yet, a few patterns hold reasonably well:

• Selling mainly to US enterprise or SaaS buyers? SOC 2, usually Type II, is the more commonly expected report in procurement and security review processes.
• Selling internationally, into government, or in a market where certification carries more procurement weight than a report? ISO 27001 tends to be the one that's asked for by name.
• Need something fast while a bigger deal is in progress? A SOC 2 Type I can be achieved sooner than ISO certification or a SOC 2 Type II, though it carries less weight than either.
• Not sure yet, but know you'll eventually need both? Start wherever your current pipeline is pointing, and build the evidence base so the second framework is mostly a mapping exercise rather than starting over.

Why you don't have to choose forever

ISO 27001 and SOC 2 overlap substantially in the actual controls underneath them: access control, change management, vendor risk, incident response and logging all show up in both. Most organisations that hold both frameworks aren't running two separate compliance programmes; they're mapping one evidence base to two sets of requirements. Done well, the second framework costs a fraction of the effort the first one did, because the risk assessment, the policies and the control evidence already exist, and the work is mostly showing how they satisfy the second framework's specific language.

This is the approach Touchpoint's Attest is built around: assessments against ISO 27001, SOC 2 and other frameworks share one risk register and one evidence base, so holding more than one certification or report doesn't mean running more than one programme. Read more on the Attest page, or go straight to the individual framework pages for ISO 27001 and SOC 2.

Frequently asked questions