The main differences
- Result: ISO/IEC 27001 gives a public certificate. SOC 2 gives a report that is usually shared under a confidentiality agreement.
- Issued by: an accredited certification body for ISO; a licensed CPA firm for SOC 2.
- Focus: ISO requires a management system with risk management at its core. SOC 2 tests controls against the AICPA Trust Services Criteria.
- Markets: ISO is widely recognised worldwide, especially in Europe. SOC 2 is the common request in North America.
SOC 2 in brief
The criteria cover security, which is required, and optionally availability, processing integrity, confidentiality and privacy. A Type I report looks at the design of controls at one date; a Type II report also tests that they worked over a period.
How to choose
- Ask your customers and prospects what they require.
- Selling mainly in Europe or worldwide: ISO/IEC 27001 is often the first choice.
- Selling mainly to US companies: SOC 2 is usually expected.
- Both requested: build one set of controls and evidence, then reuse it for both.
Questions
- Is SOC 2 a certification?
- No. It is an attestation report: an auditor's opinion on your controls. Nobody is SOC 2 certified in the ISO sense.
- Can ISO 27001 work be reused for SOC 2?
- Largely. Many controls and much of the evidence are shared, and the criteria can be mapped to Annex A, though each audit has its own requirements.