SOC 2 Type II vs ISO 27001: Which One Actually Matters to Your Customers?

Pick the one your buyers are already asking for. SOC 2 is an attestation report by a CPA firm against the AICPA's Trust Services Criteria, and it is the default request from US customers (AICPA). ISO/IEC 27001 is a certification of your information security management system, and it is the more common ask from European and multinational buyers. If you sell into both markets, the controls overlap heavily, so the second one costs far less than the first.

We get this question from mid-market clients right after a big deal stalls in security review. Procurement sends a questionnaire, asks for "your SOC 2 or ISO certificate," and the team realizes it has neither. Here is how to decide without guessing.

What each one actually is

SOC 2 is an examination performed by an independent CPA firm. The auditor evaluates your controls against the 2017 Trust Services Criteria, which cover five categories: Security, Availability, Processing Integrity, Confidentiality, and Privacy (AICPA). Security is mandatory; the others are optional and chosen based on what you promise customers. A Type I report tests whether controls are designed properly at a point in time. A Type II report tests whether they operated effectively over a period, typically three to twelve months. Buyers who know the difference will ask for Type II.

The output is a restricted-use report, usually shared under NDA, that describes your system, lists your controls, and states any exceptions the auditor found. There is no pass/fail certificate. Readers judge the report themselves.

ISO/IEC 27001 is an international standard for an information security management system (ISMS). An accredited certification body audits whether you have established, implemented, and continually improve that management system, including a risk assessment and a Statement of Applicability against the Annex A control set. The output is a public certificate with a defined scope, valid for three years with annual surveillance audits. The current version is ISO/IEC 27001:2022, and the deadline to transition certificates from the 2013 version was October 31, 2025 (GLOCERT International). If a vendor shows you a 2013 certificate today, it has lapsed.

The practical differences

• Who asks. US enterprise and mid-market buyers default to SOC 2. EU, UK, and APAC buyers, and many multinationals, default to ISO 27001.
• What it proves. SOC 2 Type II shows specific controls worked over a period, with evidence. ISO 27001 shows you run a risk-driven management system that the certification body found conforming.
• How it is shared. SOC 2 reports go out under NDA. ISO certificates can be posted publicly, which helps with inbound trust.
• Scope flexibility. Both let you scope. ISO scopes are printed on the certificate, so a narrow scope is visible to anyone who reads it.
• Cadence. SOC 2 Type II is typically renewed annually with a new observation period. ISO 27001 runs a three-year cycle with annual surveillance.

How to choose the first one

1. Look at your last 20 security questionnaires. Count how many asked for SOC 2 versus ISO. That count usually settles it.
2. Look at where the next year of revenue is. If the expansion plan is Europe, ISO 27001 will shorten more sales cycles. If you are also facing NIS2 supply-chain clauses or DORA requirements from EU financial clients, an ISMS maps well to what those customers will ask.
3. Look at what you already run. If you already maintain a risk register, documented policies, and management review, you are closer to ISO than you think. If you have strong technical controls but thin documentation, SOC 2 Security-only is often the faster first win.

Where most first audits stumble

In our experience the hard part is rarely the policy writing. It is producing evidence that controls ran continuously: log review, vulnerability management, access reviews, incident handling, and change management, all with timestamps. That is exactly what a Type II observation period tests. Organizations that outsource monitoring to a provider that cannot export clean evidence end up rebuilding it by hand at audit time. Before you sign with any provider, ask how its SOC evidence maps to the criteria your auditor will test. Our MSSP shortlist questions cover that conversation.

Doing both

The control sets overlap substantially, and many audit firms offer combined or mapped engagements. A common sequence for US companies with international growth is SOC 2 Type II first, then ISO 27001 within 12 to 18 months using the same control library. The reverse also works. What does not work is running two separate programs with two separate evidence stores.

If you are trying to figure out which controls you can stand up yourself and which to hand to a managed provider before an audit window opens, we are happy to walk through it.

Frequently asked questions

Is SOC 2 a certification?

No. SOC 2 is an attestation report issued by a CPA firm after examining your controls against the AICPA Trust Services Criteria. There is no certificate; customers read the report and its exceptions.

What is the difference between SOC 2 Type I and Type II?

Type I evaluates whether controls are suitably designed at a point in time. Type II evaluates whether controls operated effectively over an observation period, typically three to twelve months, which is why buyers usually prefer it.

Is an ISO 27001:2013 certificate still valid?

No. The transition deadline from ISO/IEC 27001:2013 to ISO/IEC 27001:2022 was October 31, 2025. Certificates that were not transitioned have lapsed.

Which should a US company get first, SOC 2 or ISO 27001?

Usually SOC 2 Type II if most customers are in the US and ask for it. Choose ISO 27001 first if your pipeline is weighted toward European or multinational buyers, or if you already run a documented, risk-based management system.

Can one program satisfy both SOC 2 and ISO 27001?

Largely, yes. The control sets overlap, and many audit firms map one to the other. Maintaining a single control library and evidence store makes the second audit much cheaper than the first.