ISO 27001 or SOC 2? How to choose which to do first
Both prove your security program works, but they are built for different buyers. A practical guide to choosing between ISO 27001 and SOC 2, and when to do both.
By Cyber Ally ·
It is one of the first questions we hear from growing technology companies: our customers are asking for proof of security. Should we get ISO 27001 or SOC 2?
The honest answer is that it depends on who you sell to. The good news is that the two overlap heavily, so the work you do for one is rarely wasted if you later need the other.
The short version
| Aspect | ISO 27001 | SOC 2 |
|---|---|---|
| What it is | An international certification | An attestation report |
| Issued by | An accredited certification body | A licensed CPA firm |
| Most requested in | Europe, UK, Middle East, Asia Pacific, government | North America |
| What you receive | A certificate, valid for three years with annual surveillance audits | A report, usually renewed every year |
| Focus | A management system for information security risk | Whether your controls meet the Trust Services Criteria |
When ISO 27001 is the better first step
ISO 27001 is the globally recognised benchmark. Choose it first if:
- Your customers are in Australia, New Zealand, Asia, Europe, the UK or the Middle East.
- You sell to government or large regulated enterprises, which often specify ISO 27001 by name.
- You want a management system, not just a set of controls: a repeatable way of identifying risk, choosing controls and improving them.
The certificate is simple for buyers to verify, and the three-year cycle gives you a stable rhythm.
When SOC 2 is the better first step
SOC 2 was developed by the American Institute of CPAs and is the default expectation in the US market. Choose it first if:
- Most of your pipeline is North American.
- Prospects are already sending you questionnaires that ask for a SOC 2 Type 2 report.
- Your customers’ security teams want to read detailed descriptions of your controls and the auditor’s test results, which a SOC 2 report provides and an ISO certificate does not.
Remember that SOC 2 comes in two types. Type 1 looks at whether controls are designed properly at a point in time. Type 2 tests whether they operated effectively over an observation period. Most buyers ultimately want Type 2.
When to do both
If you sell across regions, you will likely need both eventually. The efficient way to get there is to build one security program and map it to each framework, rather than running two parallel projects.
The core of both is the same: risk assessment, access control, supplier management, incident response, business continuity, secure development and evidence that it all runs. In our experience, a well-built ISO 27001 program covers most of what a SOC 2 auditor will test, and the reverse is largely true too.
Questions to ask before you decide
- Where are your next ten customers? Let the market you are selling into make the call.
- What are prospects actually asking for? Look at your last few security questionnaires.
- What is your timeline? A SOC 2 Type 2 needs an observation period, so plan for it early.
- Do you need both within 18 months? If so, design for both from day one.
Getting started
Whichever you choose, the foundations decide how smoothly it goes: a precise scope, tailored policies and controls adapted to how you operate. Read more about ISO 27001 and SOC 2, or talk to us and we will help you choose.