ISO 27001 or SOC 2: which one first?

Both are ways to prove to someone else that you look after their data. Neither is a law. Both are voluntary. They look similar from the outside, which is why people mix them up.

ISO/IEC 27001 is, in ISO's words, "the world's best-known standard for information security management systems (ISMS)". It defines the requirements an ISMS must meet. An ISMS is the set of policies, risk decisions and routines you use to manage security on purpose, not by accident. ISO says companies can decide whether to go through a certification process, and that a certificate from an accredited conformity assessment body "may bring an additional layer of confidence". ISO itself does not issue the certificates. An outside certification body does.

The current edition is ISO/IEC 27001:2022, published in October 2022, according to the Irish National Accreditation Board (INAB). ISO asks that you say "certified to ISO/IEC 27001:2022", with the full reference, rather than just "ISO 27001".

SOC 2 comes from the American Institute of CPAs (AICPA). It sits in what the AICPA calls the SOC suite of services, which certified public accountants provide as assurance reports on a service organization's controls. A SOC 2 report is relevant to security, availability, processing integrity, confidentiality or privacy. Those five are the categories of the AICPA's Trust Services Criteria, the 2017 set with points of focus revised in 2022. The auditor tests your controls against them and writes an opinion.

There are two flavors of SOC 2 report. In a Type 1, the auditor looks at your controls as of a specific date. A Type 2 also tests how they operated, which means evidence gathered across an audit period. The AICPA has a nonauthoritative illustrative Type 2 report if you want to see what an auditor's opinion looks like. A Type 1 is usually quicker to reach, but buyers often ask for a Type 2 because it shows controls working over time.

There is no official map of this. We know of no neutral statistic on which buyers prefer which, so we do not quote one. What follows is the pattern we hear from teams selling software and IT services, and you should check it against your own pipeline.

• US buyers often ask for a SOC 2 report, especially mid-size and larger companies buying software as a service. SOC 2 comes from a US accounting body, and US procurement teams know it.
• European, UK and Asian buyers often ask for ISO 27001, particularly large enterprises, banks and public bodies. A certificate is easy to check and recognized across borders.
• Government and regulated buyers sometimes name a specific scheme in the tender. When they do, that settles it.
• Everyone else just sends a security questionnaire. More on that in section 07.

A startup in Bengaluru selling to a retail chain in Ohio and a bank in Frankfurt could be asked for both within one quarter. That is the normal case for an exporter, not a sign that you did something wrong.

• Who judges you: for ISO 27001, a certification body, ideally one that is accredited by a national accreditation body. For SOC 2, a CPA firm. The AICPA says it acts against members whose SOC work does not meet professional standards, so the firm you pick matters.
• What you get: ISO 27001 gives you a certificate and a defined scope. SOC 2 gives you a report with the auditor's opinion, a description of your system, and the controls tested. A report has far more detail than a certificate.
• Who sees it: a certificate is easy to share publicly. A SOC 2 report holds sensitive detail about your systems, so companies commonly share it with customers under a non-disclosure agreement. Check the use terms in your own report. The AICPA also offers SOC 3, which covers the same five categories but "do[es] not provide the same level of detail", so it is "considered [a] general use report" that can be freely distributed.
• Rhythm: ISO 27001 runs on a cycle. ENISA describes an audit programme with a two-stage initial audit, surveillance audits in the first and second years, and a recertification audit in the third year. That document dates from 2013, so confirm the current schedule with your certification body. A SOC 2 report is tied to a date or period, and buyers usually want a recent one.
• Flexibility: ISO 27001 lets you decide which controls apply to you, with reasons. SOC 2 lets you and your auditor decide which categories are in scope and how your controls meet the criteria.

Scope is the boundary of what the audit covers: which product, which systems, which teams, which offices. It is the single biggest lever on effort. Both schemes let you define it, and in both a narrow, honest scope beats a broad vague one.

ISO 27001 adds a document most people have not met. The International Accreditation Forum's transition document explains that you compare the controls you decided you need against the reference list in Annex A, then produce a Statement of Applicability (clause 6.1.3 d). In short, it is your list of controls that apply, which ones are in place, and why any are excluded. Auditors read it closely, and customers sometimes ask to see it.

The reference list behind Annex A is ISO/IEC 27002:2022. The same IAF document notes that it holds 93 controls in four clauses, down from 114 controls in 14 clauses in the old edition. You do not have to implement all 93. You have to justify what you leave out.

SOC 2 works the other way round. The criteria are fixed by the AICPA, and you describe how your own controls meet them. The auditor tests what you wrote down.

The overlap is large. Both want you to manage access, keep an inventory of what you run, handle suppliers, back up data, detect and respond to incidents, and train people. A control you build for one usually serves the other, and one set of evidence can often answer both. We cannot give you a reliable percentage, and any vendor who quotes one is estimating. Plan on doing the shared work once and then mapping it to each framework.

Do not pick on brand. Pick on who is waiting for your answer.

1. Step 1Ask who is asking. List your last ten sales conversations and open deals. Write down what each security team requested. If most name one framework, that is your first target.
2. Step 2Map where your buyers are. Mostly US customers points to SOC 2 first. Mostly EU, UK or Asian enterprises points to ISO 27001 first. A real mix means picking the one your biggest open deal needs, and planning the second.
3. Step 3Check what they accept in the meantime. Some buyers will take a questionnaire, a pen test summary and a signed commitment to start an audit. That can unblock a deal while you prepare.
4. Step 4Be honest about readiness and budget. Audit fees, tooling and staff time vary widely by auditor, scope and company size, and we are not going to invent a range. Get written quotes from two or three firms. If your basics are weak, spend the first stretch on groundwork, not on an auditor.
5. Step 5Choose the format that fits your stage. If a buyer needs something quickly and accepts it, a SOC 2 Type 1 or a scoped ISO certificate for one product is a reasonable first step. If buyers insist on a Type 2, start the audit period as early as you can, because the time cannot be compressed.

If you are still unsure, a common sequence is to start with whichever your top prospects name, then add the other when a second region matters. Because the groundwork is shared, the second one is usually less work than the first.

Auditors do not want a perfect company. They want one that knows what it runs, who can touch it, and what it does when things go wrong. This is the groundwork, in an order that works for a small team.

• Write the short policies you will really followAccess, acceptable use, change management, incident response, backups. A few clear pages beat a bought template nobody reads.
• Build an asset inventoryLaptops, servers, cloud accounts, databases, SaaS tools. You cannot protect or scope what you have not listed.
• Review who has access, and keep proofRemove leavers, trim admin rights, turn on multifactor sign-in, and record each review with a date.
• Manage your vendorsList suppliers that touch customer data, what they can reach, and what assurance you have from them. Our vendor risk guide covers a practical checklist.
• Get an independent penetration test and act on itAuditors like to see findings tracked to closure. Our guide on how to read a penetration test report helps you decide what to fix first.
• Prove your backups restoreA backup you have never restored is a hope. Test it and note the date.
• Rehearse incident responseName who decides, who tells customers, and who talks to regulators. Run one tabletop exercise and keep the notes.
• Close the obvious technical gapsPatching, secrets in code, open storage buckets, public admin panels. Our website and app security checklist covers the usual ones.

Most failed or painful audits trace back to a handful of avoidable errors.

• Buying a compliance automation tool before scoping. These tools can save real time collecting evidence, but they cannot decide your scope or fix your habits. Define the boundary and the framework first, then see what tooling you actually need.
• Scoping too wide. Putting every system and every team in scope on day one multiplies the evidence and the findings. Start with the product your buyers care about. You can widen the scope at the next cycle.
• Treating it as a one-off project. An ISO certificate runs on surveillance and recertification audits. A SOC 2 report is dated and buyers want fresh ones. Controls that only exist in audit month will show.
• Paper controls. Policies nobody follows are worse than short ones people do. Auditors sample real behavior.
• Choosing a weak auditor to save money. For SOC 2, check that the firm is a licensed CPA firm that does this work routinely. For ISO 27001, prefer an accredited certification body, since ISO notes accreditation can add confidence. A report or certificate that buyers do not trust does not unblock deals.

Shortcuts that work. A trust center is a public page where you list your security practices, subprocessors, certificates and a way to request your report. It answers many first-round questions before a human gets involved. Keep a master questionnaire: one answered set you can reuse for the standard formats customers send. Both save weeks of repeated effort, and neither replaces an audit when a buyer requires one. Keep every answer true. A questionnaire is a statement you may be held to.

ISO 27001 and SOC 2 are not the only names. A few you will run into:

• HIPAA if you handle US health information. It is a law with its own requirements, so a SOC 2 report can support your evidence but does not replace a HIPAA risk analysis. Ask a qualified adviser.
• NIST Cybersecurity Framework is a voluntary framework from the US National Institute of Standards and Technology, published as the Cybersecurity Framework 2.0. NIST describes it as a way to understand and improve how you manage cybersecurity risk. Use it to organize your program, and check with a buyer before assuming it counts as an audit.
• GDPR, NIS2 and the EU AI Act are laws, not badges. They affect what you owe EU customers regardless of which certificate you hold. Our guide to the EU AI Act and GDPR for small businesses is a good place to start.
• India's DPDP Act and CERT-In rules matter if you process personal data of people in India. See our DPDP Act guide.

A certificate or report is evidence that you run security properly. It does not discharge a legal duty, and it is not a guarantee against a breach. Use it for what it is: a way to answer buyers faster and a push to keep your basics in order.