ISO 27001 and SOC 2: How They Work Together (and Where They Don't)

A company finishes its first SOC 2 Type 2 audit, feels good about the result, and then gets a request from an international prospect asking for ISO 27001 certification. Or the reverse, a company with ISO 27001 certification expands into North America and discovers that enterprise buyers expect a SOC 2 report, not a certificate.

In both cases, the question is the same. How much of what we already built carries over, and how much is new work?

The answer is encouraging, but the details matter. The two frameworks share a significant foundation in risk management, access control, incident response, and change management. But they differ in structure, certification mechanics, and what auditors actually examine. Understanding these differences before starting the second framework is the difference between a 3-month project and a 9-month one.

What ISO 27001 Actually Requires

ISO 27001:2022 is an international standard for information security management systems (ISMS). Unlike SOC 2, which evaluates specific service controls against Trust Services Criteria, ISO 27001 requires a complete management system: a documented, risk-based approach to information security that covers the entire organization.

The standard has two layers. The main body (Clauses 4-10) defines the management system requirements: context, leadership, planning, support, operations, performance evaluation, and improvement. Annex A provides 93 controls organized into four categories: organizational, people, physical, and technological.

Certification requires demonstrating compliance with both layers through a two-stage audit conducted by an accredited certification body.

What SOC 2 Actually Requires

SOC 2 is an attestation framework governed by the AICPA. A licensed CPA firm evaluates an organization's controls against Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy) and issues a report, not a certificate.

The scope is narrower than ISO 27001. SOC 2 focuses on the specific services an organization provides to its customers, not the entire organization. The criteria are outcome-based: CC6.1 requires logical and physical access controls, CC7.1 requires vulnerability identification, CC8.1 requires change management. How those outcomes are achieved is up to the organization.

For a deeper breakdown, we wrote a detailed comparison of the two frameworks and a companion FAQ addressing the most common questions.

Where the Overlap Is Real

Organizations that have completed one framework will find that 60 to 80 percent of the work applies to the other. The overlap is strongest in areas where both frameworks demand evidence of the same operational practices.

Access control is the clearest example. ISO 27001 Annex A 5.15-5.18 covers access control policies, user access provisioning, privileged access, and authentication. SOC 2 CC6.1-CC6.3 covers the same ground. If an organization already has documented access provisioning workflows, periodic access reviews, and MFA enforcement, that evidence satisfies both frameworks with minimal adaptation.

The same holds for:

When the evidence architecture is designed well from the start, the same logs, screenshots, and review records serve both auditors.

Where They Diverge

The differences are not cosmetic. They affect planning, staffing, and timeline.

Scope is where teams get caught off guard. A company with ISO 27001 can't simply hand the certificate to a SOC 2 auditor and expect credit for everything. The SOC 2 auditor will want controls specifically mapped to the in-scope services and systems, regardless of what the ISO certificate covers.

The management system wrapper is the other surprise. Organizations coming from SOC 2 often find they have the security controls but lack the management system: documented risk treatment plans, formal management review meetings, and internal audit programs. ISO 27001 Clauses 9.2 (internal audit) and 9.3 (management review) are a different kind of work than implementing controls.

How to Sequence Them

The sequencing decision depends on where the revenue pressure is coming from.

Start with SOC 2 if most of your customers are North American enterprises requesting SOC 2 reports. SOC 2 has a faster time to value: a Type 1 audit can be completed in 8-12 weeks, and it gives you a report to share with prospects while you build toward Type 2.

Start with ISO 27001 if you sell internationally or your customers require a recognized certification (not just an attestation report). ISO 27001 builds a broader management system foundation that makes SOC 2 faster afterward.

Either way, the key is building an effective security program from the start, not a framework-specific compliance project. When the program is designed around real operational practices, policies that match how the team actually works, and evidence that flows naturally from day-to-day operations, the second framework becomes a mapping exercise rather than a rebuild.

The Certification Process

For teams evaluating ISO 27001, here is what the certification process looks like:

Common Mistakes in Dual-Framework Programs

A few patterns show up repeatedly when organizations pursue both frameworks:

Using generic policy templates. Policies written for a generic SaaS company and applied to an organization with a different architecture, industry, or operating model create the most common source of audit friction: a gap between what the policy says and what the team actually does. Both ISO 27001 and SOC 2 auditors are trained to find exactly that gap.

Treating frameworks as separate projects. Running ISO 27001 and SOC 2 as independent workstreams with separate teams, separate evidence repositories, and separate policy sets doubles the effort. A unified security program with a single set of policies, controls, and evidence sources, mapped to both frameworks, is the more efficient model.

Underestimating the ISMS wrapper. Teams coming from SOC 2 tend to assume ISO 27001 is just more controls. The management system requirements, formal risk treatment, management review, internal audit, continual improvement, are a different kind of work. They require executive engagement, documented decision-making, and a cadence of review that many SOC 2-compliant organizations don't yet have.

Skipping the evidence architecture. Both frameworks require evidence, but the types and retention requirements differ. Designing the evidence architecture once, with both frameworks in mind, prevents the scramble of retroactively collecting evidence for the second audit.

Frequently Asked Questions

Should I pursue ISO 27001 or SOC 2 first?

It depends on where the demand is coming from. If most of your customers are North American enterprises specifically requesting SOC 2 reports, start there. SOC 2 Type 1 can be completed in 8-12 weeks, giving you a report to share with prospects quickly. If you sell internationally or need a certification recognized globally, ISO 27001 is the stronger starting point. Either way, building a unified security program from the start makes the second framework significantly faster.

How much overlap exists between ISO 27001 and SOC 2?

Significant overlap, particularly around access control, risk management, incident response, change management, and vendor oversight. Organizations that have implemented ISO 27001's Annex A controls typically find that 60 to 80 percent of SOC 2's Trust Services Criteria are already addressed. The remaining gaps tend to be in areas where the frameworks have different structural requirements, such as ISO 27001's management system wrapper or SOC 2's service-specific scoping.

How long does ISO 27001 certification take?

For most mid-sized organizations, 6 to 12 months from project kickoff to certification. This includes scoping, risk assessment, control implementation, internal audit, and the two-stage external audit. Organizations with an existing SOC 2 program or mature security practices can often compress this to 4 to 6 months, since the control implementation and evidence collection infrastructure is already in place.

What is the difference between ISO 27001 certification and SOC 2 attestation?

ISO 27001 certification is a pass/fail outcome issued by an accredited certification body, confirming that an organization's ISMS meets the standard's requirements. SOC 2 is an attestation report issued by a licensed CPA firm that evaluates controls against Trust Services Criteria. A SOC 2 report can include qualified opinions or noted exceptions and still be valid. An ISO 27001 audit with unresolved major nonconformities blocks certification entirely.

Do ISO 27001 and SOC 2 require annual renewals?

ISO 27001 certification is valid for three years, with mandatory surveillance audits in years two and three and a full re-certification in year four. SOC 2 Type 2 reports cover a defined period (typically 12 months), and most customers expect a new report annually. Both frameworks require continuous maintenance of controls between assessment cycles, not just preparation before audits.