SOC 2 vs ISO 27001: Which One Does Your Company Actually Need?

What is the difference between SOC 2 and ISO 27001?

SOC 2 is an attestation report: a licensed CPA firm examines your controls against the AICPA Trust Services Criteria and writes an opinion. ISO/IEC 27001 is a certification: an accredited certification body audits your information security management system (ISMS) and, if it conforms, issues a certificate.

That difference in form drives everything else. A SOC 2 report is a long document describing your system, your controls and the auditor's test results. Customers read it, or their security team does. An ISO 27001 certificate is one page that says your ISMS meets the standard for a defined scope. Procurement teams can tick it off without reading anything.

Which customers ask for SOC 2 and which ask for ISO 27001?

US enterprise buyers ask for SOC 2 Type II. It is the default line item in American SaaS security questionnaires, and a Type I will usually only buy you time on a first deal. European, UK and multinational buyers more often ask for ISO 27001 because it is an international standard their own organisations may hold, and because a certificate is easier to check across a large vendor estate.

The practical test is boring and reliable: pull the last 20 security questionnaires and lost-deal notes from your CRM and count which framework was named. In my experience the answer is usually lopsided, and the market tells you the order. If the questionnaires name neither, you are probably early enough that a solid security page, a pen test summary and a completed standard questionnaire will carry the deal for another two quarters.

One more signal: if a buyer asks for both, they usually mean "show us independent assurance," and either one plus a mapping document will satisfy the first round. Ask before you commit budget.

SOC 2 Type I vs Type II: which do you need?

Type I tests whether your controls are designed properly at a single point in time. Type II tests whether they actually operated over an observation period. Enterprise buyers want Type II, because design without evidence of operation tells them little.

• Type I: faster and cheaper. Drata puts it at roughly 1 to 3 months. Useful when a specific deal needs something on paper this quarter and you can commit to a Type II date.
• Type II: the observation window typically runs 3 to 12 months, and Drata's end-to-end estimate is 6 to 12 months. A 3-month window is a legitimate first report; buyers mainly care that the next one covers 12 months.

The mechanism worth understanding: the observation window is calendar time you cannot buy back. A team that starts the window late because it waited for the Type I to finish has added a quarter for no reason. I start the Type II window as soon as the controls are live and treat the Type I as optional.

How much do SOC 2 and ISO 27001 cost?

For a small company, budget roughly $25,000 to $50,000 all-in for a first SOC 2 and something in the $15,000 to $60,000 range for a first ISO 27001, depending on how much of the work you do yourself. The auditor's fee is often the smaller part; platform licences, a penetration test and engineering time make up the rest.

Treat these as orientation, not quotes. Every figure above comes from a vendor with a commercial interest in the answer, and scope swings the price more than anything else. Two levers matter most. First, keep scope tight: one product, one production environment, Security criterion only for a first SOC 2. Second, decide early whether you are buying a consultant, a platform, or both, because doubling up is where first-year budgets most often overrun.

If you need to defend the spend to a board, frame it as sales infrastructure with a measurable payback: deals blocked or slowed by the missing report, divided into the annual cost. My board presentation guide covers how to put that on one slide.

How long does each take?

A first SOC 2 Type II realistically takes 6 to 12 months from kickoff to report, per Drata's estimates. A first ISO 27001 certificate typically lands in a similar window, but the long pole is different: the management system has to run long enough to produce a risk assessment, a Statement of Applicability, an internal audit and a management review before the certification body will start Stage 1.

1. Readiness (4–12 weeks): scope, gap assessment, policies, connect the compliance platform, fix the obvious gaps (MFA everywhere, offboarding, access reviews, logging).
2. Evidence period: SOC 2 Type II observation window (3–12 months) or ISO internal audit and management review cycle.
3. External audit: SOC 2 fieldwork and report; ISO Stage 1 (documentation) then Stage 2 (implementation).
4. Maintenance: annual SOC 2 report; ISO surveillance audits in years two and three, recertification in year three.

If you hold an ISO 27001:2013 certificate from years ago, check it: the transition period to the 2022 edition ended on 31 October 2025, and certificates against the 2013 version are no longer valid.

How much do SOC 2 and ISO 27001 overlap?

A lot at the control level and very little at the management-system level. Access control, encryption, change management, vendor management, incident response, business continuity, HR security and logging appear in both. The AICPA even publishes a mapping of the Trust Services Criteria to ISO 27001 (member download).

What does not carry over from SOC 2 to ISO is the ISMS machinery: a documented scope, a formal risk assessment and treatment methodology, the Statement of Applicability that justifies each Annex A control's inclusion or exclusion, internal audits, and management review. Going the other way, SOC 2 adds the system description and the auditor's detailed test results that US security teams like to read.

So the cheapest path to both is one control set, mapped to both frameworks, with evidence collected once. Sequence the external audits a few weeks apart so the same evidence serves both auditors. Teams that run SOC 2 and ISO as separate projects with separate owners pay for most of the work twice.

Which should you get first? A decision table

If you are a fractional CTO or the first engineering leader at a startup, resist starting compliance because a competitor announced theirs. Start it when a named deal needs it, and size the scope to that deal.

Do compliance automation tools like Vanta and Drata replace the auditor?

No. Platforms such as Vanta, Drata, Secureframe and Sprinto connect to your cloud, identity provider, HR system and code host, continuously check controls, collect evidence and track policies. The audit itself is still performed by an independent CPA firm (SOC 2) or certification body (ISO 27001). Most platforms introduce you to partner auditors, which is convenient but worth a second look on independence and price.

What to actually compare: integrations with your stack (a platform that cannot read your identity provider or your cloud accounts is a spreadsheet with a login), how cleanly one control maps to several frameworks, the quality of policy templates, and the year-two renewal price. Ask every vendor for the renewal number in writing before you sign; first-year discounts are common. The same procurement discipline from my AI vendor RFP guide applies here.

Where does ISO 42001 fit for AI products?

ISO/IEC 42001:2023 is the certifiable management system standard for AI. It uses the same management-system structure as ISO 27001 (context, leadership, planning, support, operation, performance evaluation, improvement), so a company with a working ISMS reuses its policy framework, risk process, internal audit and management review. What it adds is AI-specific: impact assessments, data and model lifecycle controls, and governance of third-party AI.

How much of your existing work carries over is still mostly vendor estimates. Drata, for example, puts its SOC 2, ISO 27001 and privacy controls at roughly 35 to 40 percent coverage of ISO 42001 requirements. That matches what I would expect: the security plumbing transfers, the AI governance does not.

My heuristic for 2026–2027: do not lead with ISO 42001 unless AI is the product and your buyers are regulated. Do answer the AI sections of security questionnaires properly today, maintain an AI system inventory, and write an AI usage policy, because those artefacts are the foundation of a 42001 programme anyway. My AI compliance guide covers the regulatory side, the AI audit guide covers what an assessor looks at, and the enterprise AI governance framework on aistrategy.guide shows how to extend NIST AI RMF and ISO 42001 into an operable control set.

The short version for your next leadership meeting

• US-heavy pipeline: SOC 2 Type II, Security criterion, 3-month first window.
• EU/UK/global pipeline: ISO 27001:2022, tight scope.
• Both markets: one control set, two audits, scheduled weeks apart.
• AI product: inventory and policy now, ISO 42001 when a buyer makes it a requirement.
• Budget: plan $25k–$60k for the first framework at startup scale, and get the year-two platform price before signing.