Glossary
SOC 2 vs ISO 27001: what’s the difference?
SOC 2 and ISO 27001 are the two most common ways a company demonstrates its security posture. SOC 2 is an attestation report, produced by a CPA firm, on how well your controls meet the AICPA’s Trust Services Criteria. ISO 27001 is an international standard you get certified against, focused on establishing and maintaining an information security management system (ISMS). Buyers often accept either, and larger vendors pursue both.
SOC 2
SOC 2 is governed by the AICPA and results in a report rather than a certificate. A Type I report assesses whether controls are designed appropriately at a point in time; a Type II report assesses whether they operated effectively over a period (commonly 3–12 months). SOC 2 reports are widely used in North America and are shared under NDA.
ISO 27001
ISO/IEC 27001 is an international standard. An accredited body audits your ISMS and, if you pass, issues a certificate valid for three years with periodic surveillance audits. It’s widely recognized globally and emphasizes a risk-based, continually improving management system.
Which do buyers want?
Many buyers accept either as evidence of a mature security program, and both map to overlapping controls. On a security questionnaire, the practical difference is which artifact you attach — a SOC 2 report or an ISO 27001 certificate — and being able to cite the specific control behind each answer.