ISO 27001 or SOC 2: which do we need?

Start by asking your customers what assurance they will accept. A request for “security certification” is too vague to plan against. Confirm the required output, the service it must cover and the deadline before buying an audit.

Understand the output

ISO 27001 certification concerns an information security management system within a defined scope. An independent certification body assesses it against the standard. ISO describes the management system requirements.

SOC 2 is an examination report issued by a CPA firm. It concerns controls over a service organisation’s system using the relevant Trust Services Criteria. It is not a certificate. AICPA’s SOC resources describe the reporting model.

A SOC 2 Type 1 report addresses a specified date; a Type 2 report also addresses operating effectiveness over a period. That period matters when planning your evidence collection and customer delivery dates. See AICPA’s report review checklist.

Get a usable answer from the buyer

Ask the customer to confirm:

Whether they require ISO 27001, SOC 2, either, or both.
Which product, entities and locations the scope must cover.
For SOC 2, which report type and criteria they expect.
Whether they accept interim evidence while you complete the work.

Do not assume a report for your hosting provider meets a requirement for your own service. Equally, do not commission both outputs simply because a questionnaire lists both.

Compare the ongoing work

Price the preparation and internal effort as well as the external assessment. Include maintaining the controls, responding to findings and preparing for later assessments. A low initial quote may exclude work your team still needs to perform.

Ask prospective assessors to explain the proposed scope and timeline in writing. For SOC 2 Type 2, agree the examination period before assuming an audit date will satisfy a customer deadline.

Reuse evidence with care

If you need both, the same access review or restore test may support multiple requirements. Check that the evidence covers the relevant systems and period, and that it actually demonstrates what each requirement asks.

Yrso supports control mapping and reusable evidence slots. You can link shared work to multiple requirements while retaining the separate assessment criteria. Our tool + team service can help organise preparation; the external assessor remains responsible for its assessment.