SOC 2 vs. ISO 27001: which one does your company need?

If you sell software to larger companies, a security questionnaire will eventually arrive with a question like "Do you have a SOC 2 report or ISO 27001 certification?" Both are respected ways to show you take security seriously, but they're different things, and the right one depends mostly on who your customers are.

What SOC 2 is

SOC 2 is an attestation framework from the AICPA, the American Institute of Certified Public Accountants. An independent CPA firm examines your controls against the Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. Security is required; the others are optional and chosen based on what you promise customers.

• Type I looks at whether your controls are designed properly at a single point in time.
• Type II tests whether those controls actually operated over a period — typically three to twelve months. Most enterprise buyers ask for Type II.
• The result is a report you share with customers under NDA, not a certificate you display.

What ISO 27001 is

ISO/IEC 27001 is an international standard for an information security management system (ISMS) — the policies, risk assessments, and processes you use to manage security over time. An accredited certification body audits you, and if you pass, you receive a certificate.

• The current version is ISO/IEC 27001:2022. Its Annex A lists 93 controls grouped into four themes: organizational, people, physical, and technological.
• Certification runs on a three-year cycle, with surveillance audits in the years between.
• The emphasis is on risk management: you decide which controls apply based on your own risk assessment, and document why.

The practical differences

• Geography: SOC 2 is most common with North American customers. ISO 27001 is recognized worldwide and is often preferred in Europe and Asia, including Hong Kong.
• Output: SOC 2 gives you a detailed report about your specific controls. ISO 27001 gives you a certificate that's easy to show but says less about the details.
• Scope: SOC 2 focuses on the systems behind the service you sell. ISO 27001 covers your management system, which can span the whole organization.
• Overlap: the controls overlap heavily. Companies that do one often find the second takes noticeably less effort.

How to decide

1. 1Look at your sales pipeline. Which one are your customers actually asking for? That's usually the answer.
2. 2If you sell mainly to US companies, start with SOC 2. If your buyers are in Europe or Asia, or you want one credential that travels, start with ISO 27001.
3. 3If you have no requests yet, focus on the underlying controls first — access management, logging, backups, vendor review, incident response. Those are the foundation for both.

What the work actually involves

Either path starts with a gap assessment: comparing what you do today with what the framework expects. Then comes remediation — writing policies, tightening access, setting up monitoring — and collecting evidence that the controls work. Compliance automation tools can collect much of that evidence for you, but they don't replace the decisions only your team can make.