Your US prospect wants a SOC 2 Type II report. Your German prospect wants an ISO 27001 certificate. Both are asking the same underlying question — can we trust you with our data? — but they expect the answer in different formats. Picking the wrong one first can cost you months.
This guide explains what each framework is, how the assurance differs, where they overlap, what drives cost and effort, and how to decide which one to pursue first.
The short answer
- SOC 2 is an attestation report issued by a licensed CPA firm under AICPA standards. It describes your system and gives the auditor’s opinion on your controls against the AICPA Trust Services Criteria. It is the default expectation of many North American buyers of SaaS and IT services.
- ISO/IEC 27001 is a certification of your information security management system (ISMS), issued by an accredited certification body against an international standard. It is widely recognised in Europe and internationally.
If most of your revenue comes from one market, start with the format that market expects. If you sell on both sides of the Atlantic, plan for both and build one control set that serves each.
What SOC 2 is
SOC 2 is part of the AICPA’s System and Organization Controls (SOC) suite, which CPAs use to report on controls at service organisations so that their customers can assess the risks of outsourcing. A SOC 2 examination reports on controls relevant to security, availability, processing integrity, confidentiality or privacy.
The Trust Services Criteria
The criteria come from the AICPA’s 2017 Trust Services Criteria, updated with revised points of focus in 2022. There are five categories:
- Security: protection of information and systems against unauthorised access, disclosure and damage. Known as the “common criteria”, this category is included in every SOC 2.
- Availability: the system is available for operation and use as committed or agreed.
- Processing integrity: system processing is complete, valid, accurate, timely and authorised.
- Confidentiality: information designated as confidential is protected.
- Privacy: personal information is collected, used, retained, disclosed and disposed of in line with your commitments.
You choose which of the four optional categories to add, based on what you promise customers. A hosting provider with uptime commitments usually adds Availability; a payroll processor may add Processing Integrity.
Type I vs Type II
- Type I covers the description of your system and whether your controls are suitably designed as of a specific date. It is a snapshot.
- Type II adds the auditor’s testing of whether those controls operated effectively throughout a period. Periods commonly run from several months up to a year.
Most enterprise buyers want Type II, because it shows controls working over time. A Type I is often used as a first step for a young company that needs something to show customers quickly while its Type II observation period runs.
What a SOC 2 report contains
A typical SOC 2 report includes the auditor’s opinion, management’s assertion, a description of the system (prepared against the AICPA description criteria), and, for Type II, the controls tested, the tests performed and the results, including any exceptions. It also lists complementary user entity controls — things your customers must do themselves — and explains how subservice organisations such as your cloud provider are treated.
SOC 2 reports are intended for customers and other parties with sufficient knowledge of the system, so they are normally shared under NDA. The AICPA’s SOC 3 report is a general-use summary you can publish.
What ISO 27001 is
ISO/IEC 27001:2022 specifies requirements for establishing, running, maintaining and continually improving an ISMS. Clauses 4–10 set the management system requirements (context, leadership, planning, support, operation, performance evaluation, improvement). Annex A provides a reference set of 93 controls in four themes: organisational, people, physical and technological. You select controls through a risk assessment and justify them in a Statement of Applicability.
Certification follows a Stage 1 and Stage 2 audit by a certification body, then annual surveillance audits and a recertification audit on a three-year cycle. The 2013 edition is gone: the IAF transition period ended on 31 October 2025, so any valid certificate today is against the 2022 edition. Our ISO 27001:2022 implementation roadmap covers the process step by step.
Attestation vs certification
This is the difference people most often miss.
- A SOC 2 report is an opinion. There is no pass or fail and no certificate. The reader gets detail — controls, tests, exceptions — and decides for themselves whether the result is acceptable.
- An ISO 27001 certificate is a conformity statement. The certification body confirms that your ISMS meets the standard for a defined scope. The certificate is short and can be shared publicly; the audit report stays with you.
Put simply: SOC 2 tells a reader in detail how specific controls performed during a period; ISO 27001 tells them your management system conforms to an international standard and is kept under regular surveillance.
Side-by-side comparison
| Aspect | SOC 2 | ISO/IEC 27001:2022 |
|---|---|---|
| Owner | AICPA (US) | ISO and IEC (international) |
| Output | Attestation report with auditor’s opinion | Certificate of conformity |
| Who performs it | Licensed CPA firm | Certification body, ideally accredited under the IAF arrangement |
| Basis | Trust Services Criteria (Security plus optional categories) | Clauses 4–10 and Annex A (93 controls) |
| Focus | Controls over a defined system or service | The whole management system for a defined scope |
| Time dimension | Type I at a date; Type II over a period | Point-in-time audits plus annual surveillance |
| Validity | Covers a period; buyers usually ask for a recent report each year | Three-year certificate with surveillance audits |
| Sharing | Restricted, usually under NDA (SOC 3 is public) | Certificate can be shared publicly |
| Typical demand | US and Canadian customers | European and international customers, public sector, regulated supply chains |
Geographic expectations
Selling to US customers
In US enterprise procurement, especially for SaaS, a SOC 2 Type II report is the usual first request in security questionnaires. Some US buyers accept ISO 27001, but many will still ask for SOC 2 because their own auditors and vendor risk teams are used to reading it.
Selling to EU and UK customers
European buyers more often ask for ISO 27001 certification. It also connects naturally to European regulation. NIS2 (Directive (EU) 2022/2555) requires essential and important entities to manage supply chain security and encourages Member States to promote European and international standards; financial entities under DORA must manage ICT third-party risk (see our DORA explainer). Neither law mandates ISO 27001 or SOC 2, but your customers’ compliance teams will look for recognisable assurance from you. In Italy, ACN has supported UNI/PdR 174:2025, a reference practice that helps ISO 27001-certified NIS entities extend their management system towards the national NIS security measures. This is general guidance, not legal advice.
Where they overlap
The control content overlaps heavily. Both expect you to have:
- risk assessment and documented security policies;
- access control, including joiner-mover-leaver processes and MFA;
- change management and secure development;
- logging, monitoring and vulnerability management;
- incident response (see our guide on incident response phases);
- business continuity and backup;
- vendor and subservice management;
- security awareness training and HR security.
The AICPA publishes mappings between the Trust Services Criteria and other frameworks, which helps you build one control set and test it once. In practice, companies that already hold one usually find the second far less work than the first, because the controls, evidence and owners already exist. The main extra work for ISO 27001 is the management system itself — scope, risk methodology, SoA, internal audit and management review. The main extra work for SOC 2 is the system description and sustaining evidence through the Type II period.
What drives cost and time
We are not going to quote prices; fees vary widely by auditor, country and scope, and published figures are rarely comparable. These are the factors that actually move effort and cost:
- Scope. Number of systems, locations, products and teams included. For SOC 2, the number of Trust Services categories.
- Starting maturity. Existing policies, logging, access reviews and change records shorten the project.
- Type II period length. A longer observation period delays your first report but gives buyers more assurance.
- Cloud and suppliers. Heavy reliance on cloud providers means relying on their own reports and carving them out properly.
- Internal capacity. Who owns the project and how much time they have.
- Tooling and readiness support. Compliance automation platforms and consultants can speed things up, but they do not replace operating the controls.
- Auditor choice. For SOC 2, a reputable CPA firm your customers recognise; for ISO 27001, an accredited certification body.
Decision table
| Your situation | Start with | Why |
|---|---|---|
| Most customers are US enterprises buying SaaS | SOC 2 Type II (Type I first if you need something quickly) | Matches what US vendor risk teams expect |
| Most customers are in the EU, UK or Asia | ISO 27001 | Internationally recognised certificate, fits European regulatory supply chains |
| You supply NIS2 or DORA-regulated customers | ISO 27001, then SOC 2 if US demand appears | Gives a risk-based ISMS that supports your customers’ supplier assessments |
| You sell into both markets in volume | Both, built on one control set | Shared controls and evidence; plan audits to reuse testing |
| You need a public trust signal for your website | ISO 27001 certificate or SOC 3 | Both can be shared publicly; SOC 2 normally cannot |
| You have no formal programme and no customer demand yet | A framework baseline such as NIST CSF 2.0 | Build the capability first; choose the attestation when customers ask |
For that last row, our NIST CSF 2.0 guide explains how to use the framework as a starting point that maps to both.
AceFortis runs practical training on ISO 27001, SOC 2 readiness and security governance for teams and management — get in touch to plan a session.
FAQ
Is SOC 2 a certification?
No. SOC 2 is an attestation: a CPA firm issues a report with its opinion. Calling it “SOC 2 certified” is common in marketing but technically inaccurate.
Can a European company get a SOC 2 report?
Yes. The examination must be performed under AICPA standards by a firm licensed to do so, and many large audit firms provide SOC 2 services in Europe. The location of your company does not prevent it.
Does ISO 27001 replace SOC 2 for US customers?
Sometimes. Some US buyers accept an ISO 27001 certificate, often with a completed questionnaire. Many still ask specifically for SOC 2 Type II, so check with your key prospects before deciding.
How often do these need renewing?
SOC 2 Type II reports are usually repeated every year so customers always have a recent period. ISO 27001 certificates run for three years with annual surveillance audits.
