SOC 2 and ISO 27001 overlap heavily in what they expect you to do, and very little in what they expect you to hand over. A security program built for one covers most of the control substance of the other. What does not carry over is the paperwork around it: ISO 27001 requires a management system (scope, risk assessment, Statement of Applicability, internal audit, management review) that SOC 2 does not, and SOC 2 requires a system description, a management assertion and an auditor's opinion on controls over a period that ISO 27001 does not.
Two frameworks, defined
SOC 2 (System and Organization Controls 2) is an AICPA reporting framework in which a licensed CPA firm examines a service organization's controls against the Trust Services Criteria: Security (always required), plus Availability, Processing Integrity, Confidentiality and Privacy where they apply. A Type I report covers the design of controls at a point in time. A Type II report adds operating effectiveness over a period, commonly three to twelve months. The result is an attestation report, not a certificate. More on the AICPA SOC suite.
ISO/IEC 27001:2022 specifies requirements for an information security management system (ISMS). Clauses 4 to 10 define the management system, and Annex A lists 93 controls in four themes: organizational (37), people (8), physical (14) and technological (34). An accredited certification body audits in two stages and issues a three-year certificate that is kept valid by annual surveillance audits. See ISO 27001.
How do the controls line up?
AICPA publishes a mapping of the 2017 Trust Services Criteria to ISO 27001. Its resource page is dated May 4, 2018; we have not verified that this older mapping covers ISO 27001:2022. The table below is Cyberneza’s own non-authoritative working guide to ISO 27001:2022, not an AICPA or ISO publication. Confirm applicability and evidence expectations with your auditor or certification body before relying on it.
| Area | SOC 2 (Trust Services Criteria) | ISO 27001:2022 | What carries over |
|---|---|---|---|
| Governance, roles and policies | CC1 Control environment; CC2 Communication and information | Clause 5 leadership; A.5.1 policies; A.5.2 roles and responsibilities | The policy set and role assignments. ISO adds documented objectives and management review. |
| Risk assessment | CC3 Risk assessment | Clauses 6.1.2 and 6.1.3 risk assessment and treatment | The risk register. ISO adds a defined method, a treatment plan and owner acceptance of residual risk. |
| Access control | CC6.1 to CC6.3 logical access | A.5.15 to A.5.18 access and identity; A.8.2 privileged access; A.8.5 secure authentication | Fully: MFA settings, access reviews, joiner, mover and leaver records. |
| Physical security | CC6.4 physical access | A.7 physical controls | Often inherited from a cloud provider; both frameworks expect you to show how. |
| Change management | CC8.1 change management | A.8.32 change management | Fully: change tickets, approvals, pipeline evidence. |
| Logging, monitoring and vulnerabilities | CC7.1 and CC7.2 detection and monitoring | A.8.8 technical vulnerabilities; A.8.15 logging; A.8.16 monitoring | Fully: scan results, patch records, alert handling. |
| Incident response | CC7.3 to CC7.5 evaluation, response and recovery | A.5.24 to A.5.28 incident management | Fully: the response plan, tabletop records and incident tickets. |
| Vendor and third-party risk | CC9.2 vendor and business partner risk | A.5.19 to A.5.23 supplier relationships and cloud services | Fully: vendor inventory, assessments and contract terms. |
| Backup and continuity | A1.2 and A1.3 (Availability, optional); CC9.1 | A.5.29 and A.5.30 continuity; A.8.13 backup | Backup and recovery tests. SOC 2 only tests this if you choose Availability. |
| People | CC1.4 competence | A.6.1 screening; A.6.3 awareness and training | Fully: background checks and training completion records. |
What carries over without rework?
The operating evidence. Both audits sample the same kinds of records: access reviews, MFA configuration, joiner, mover and leaver tickets, change approvals, vulnerability scans and patch records, incident tickets and tabletop notes, vendor assessments, training completion and background check records. Your policies carry over too, with edits to reference each framework's requirements.
What does ISO 27001 require that SOC 2 does not?
- A defined ISMS scope, with the organization's context and interested parties (clause 4).
- A risk assessment method, a risk treatment plan and a Statement of Applicability that records every Annex A control as included or justified as excluded (clause 6.1).
- Information security objectives you measure (clause 6.2).
- An internal audit programme and a management review, both completed before certification (clauses 9.2 and 9.3).
- Corrective action and continual improvement (clause 10), and annual surveillance audits across the three-year certificate.
What does SOC 2 require that ISO 27001 does not?
- A system description: the auditor-facing account of your system, its boundaries, service commitments and system requirements.
- A written management assertion about that description and the controls.
- An auditor's opinion on the suitability of control design and, for Type II, operating effectiveness over the period, based on sampling, with exceptions disclosed.
- A position on complementary user entity controls and on subservice organizations such as your cloud host, either carved out or included.
- A choice of which Trust Services Categories apply to your service.
How do you run both without doing the work twice?
- Align the scope. Use the same product and boundary for the SOC 2 system description and the ISMS scope wherever you can.
- Run one risk assessment that satisfies both CC3 and ISO clause 6.1.2.
- Keep one control library and tag each control to both frameworks. GRC platforms such as Vanta and Drata store a control once and map it to several frameworks.
- Collect evidence once, on a calendar, and file it by control rather than by audit.
- Produce the framework-specific artifacts separately: the SOC 2 system description and management assertion, and the ISO Statement of Applicability, internal audit and management review.
- Ask your auditors how they coordinate. A CPA firm performs SOC 2 and an accredited certification body performs ISO 27001; some firms hold both credentials and can schedule fieldwork together.
Which one to start with depends on who is asking. Our SOC 2 vs ISO 27001 guide covers that decision. Cyberneza prepares the evidence for both. A licensed CPA firm issues the SOC 2 report, and an accredited certification body issues the ISO certificate. The path is SOC 2 readiness and ISO 27001 readiness.
Common questions
Can one set of evidence satisfy both SOC 2 and ISO 27001?
Largely for operating evidence: access reviews, change records, incident records, training completion and vendor assessments, which both audits sample. It does not cover the framework-specific artifacts: the SOC 2 system description and management assertion, and the ISO 27001 risk treatment plan, Statement of Applicability, internal audit and management review.
How many controls are in ISO 27001:2022 Annex A?
93, grouped into four themes: organizational (37), people (8), physical (14) and technological (34). The 2013 edition had 114 controls in 14 domains, and certificates issued to the 2013 edition had to transition to the 2022 edition by October 31, 2025.
Does a SOC 2 report satisfy a buyer who asks for ISO 27001?
Not automatically. Some buyers accept either as evidence of a security program, and others name one in their supplier requirements. Ask the buyer which they require and whether a SOC 2 report plus a completed questionnaire is acceptable.
Which should I do first, SOC 2 or ISO 27001?
The one your next buyers name. In general, U.S. B2B software buyers ask for SOC 2 first, while international and regulated buyers more often ask for ISO 27001. Our SOC 2 vs ISO 27001 guide walks through the decision.
Is SOC 2 a certification?
No. SOC 2 is an attestation report issued by a CPA firm, so the accurate claim is that you have a SOC 2 Type II report. ISO 27001 is a certification, issued by an accredited certification body.
Primary sources
- AICPA: 2017 Trust Services Criteria (with revised points of focus, 2022)
- AICPA: SOC suite of services
- ISO/IEC 27001:2022 (ISO)
If you are weighing both and want a plan that reuses the work, send us a message.