ISO 27001 vs SOC 2: what mid-market service and SaaS firms should buy first

This page is a buying comparison. It is for operations, IT, and compliance leads at mid-market professional-services firms and SaaS companies who are about to ask for a security artifact and cannot agree whether ISO/IEC 27001 or SOC 2 belongs on the request.

Those two products are not interchangeable security logos. ISO/IEC 27001 certification is a certificate issued by an accredited certification body. A SOC 2 report is an attestation report issued by a licensed CPA firm. US enterprise customers often ask for the report. International and EU customers often ask for the certificate. Sales conversations will offer to "cover security" with whichever product the firm already sells. The useful question is a procurement question: which artifact does this cycle have to produce, and can you show the system behind it.

Quality versus information security, when that is the fork, is ISO 9001 vs ISO 27001. Information security versus an AI management certificate is ISO 27001 vs ISO 42001. When the live question is a NIST CSF 2.0 profile versus an ISO/IEC 27001 certificate, that decision is ISO 27001 vs NIST CSF. When the live question is whether to add ISO/IEC 27701 privacy certification to an ISO/IEC 27001 certificate, that decision is ISO 27001 vs ISO 27701. The multi-year sequence is the 9001 → 27001 → 42001 path. Whether a management system is real enough to book Stage 1 is first ISO certification. After you pick the artifact, the ISO half still uses one outbound scope pack. You still choose a registrar for any certificate, read the quote, and verify accreditation for the legal entity and the edition. When the artifact is the ISO/IEC 27001 certificate, the directory profiles that record that standard on a cited accreditation scope are compared in how to choose an ISO/IEC 27001 certification body in the US. This page does not invent prices, audit-day counts, accreditation identifiers, or claims about which firms are accredited or licensed.

The decision here is narrower: a 27001 certificate this cycle, a SOC 2 report this cycle, or neither until the system exists. Then one honest request.

1. What each artifact actually is

Skip the clause lecture. Buyers do not award work because they memorized a control catalogue.

ISO/IEC 27001 is a management-system standard for information security. A certification body samples the information security management system (ISMS): what information and activities are in scope, how you assess and treat risk, and whether the controls you claim actually run. Buyers meet the control decision as a Statement of Applicability. Which Annex A controls apply here, and why the others do not. The 2022 edition groups that annex into organizational, people, physical, and technological themes. Name the edition you will claim. Many quotes this year are still against ISO/IEC 27001:2022. A body can certify a later edition only after its accreditation covers it.

The output is a certificate for a defined scope. Trace the issuing legal entity on IAF CertSearch and the accreditation-body directory, commonly ANAB or UKAS when those are the marks on the proposal. The method is how to verify accreditation. A logo, a sales PDF, and a sister company's schedule are not that check. The certificate shows that an accredited body examined the ISMS. It is not a promise that a breach cannot happen. It is not a penetration-test report or a privacy-law badge.

SOC 2 is an attestation examination of controls at a service organization, reported against the AICPA Trust Services Criteria. The AICPA describes the product on its SOC 2 topic page. The criteria buyers meet are the 2017 Trust Services Criteria, with revised points of focus in 2022: Security, Availability, Processing Integrity, Confidentiality, and Privacy. Security is the common criteria and is part of every SOC 2. The other categories are included only when you and the customer put them in scope.

The output is a report, not an ISO certificate. A Type 2 report typically contains management's description of the system, management's assertion, the service auditor's opinion, and the tests of controls and their results. It is written for specified parties. The customer security team usually wants that report under their request. A logo, a one-page letter, or a sentence on the website is not the report.

The signer is a licensed CPA firm performing an attestation examination. That permission is separate from ISO accreditation. Check the firm that will sign, not an individual CPA and not the marketing brand. Start with the state board of accountancy for the office that will sign. Where that board publishes data through NASBA, use the CPAverify firm search. Absence there is a question, not proof the firm is unlicensed, and a listing does not replace the state board. An AICPA membership mark is not a license. Ask whether the firm may perform attest work, and ask for the date of its most recent accepted peer review. This page does not name firms that pass that check.

SOC 1 (controls relevant to financial reporting), a SOC 3 general-use summary, and a penetration test are different products. Buy the one the customer named.

You can hold a 27001 certificate and a SOC 2 report about the same product. This page is about which one this request is for.

2. Who asks for which

Read the field in the contract, the vendor portal, or the security questionnaire. The country of the logo on the website is a clue. The sentence in the exhibit is the requirement.

US enterprise customers of SaaS and of professional-services firms that touch their data commonly ask for a SOC 2 report, usually a Type 2 covering Security. Availability and Confidentiality show up when uptime or designated confidential information is part of the deal. That ask lives in vendor-risk queues, procurement portals, and customer security teams who want the tests, not only a certificate number.

International and EU customers, and many UK and public-sector buyers, more often name ISO/IEC 27001. They want an accredited certificate they can trace, for a scope that matches the services they buy. A restricted US attestation report does not fill a field that says "ISO/IEC 27001 certificate." A 27001 certificate does not fill a field that says "SOC 2 Type 2 report."

The split is not a law of geography. A US subsidiary of a European group can require the certificate. A European subsidiary of a US group can require the report. A bank, an insurer, or a software marketplace can name either, or both, on a date you can point at. Professional-services firms meet the same split one client at a time: the client whose data you hold writes the artifact.

Put ISO/IEC 27001 on this cycle when most of these are true:

• The customer, portal, insurer, or bid names ISO/IEC 27001, or an accredited information-security certificate, on a date you can point at.
• You can describe the information in scope, where it lives, and which legal entity operates it.
• Someone owns risk treatment, access, incidents, and suppliers, and can be interviewed.
• The Statement of Applicability matches the system you operate. Applicable controls have evidence. Exclusions have a reason you will defend at Stage 1.
• The SOC 2 ask is a forecast: a US logo you hope to win, a questionnaire you have not received, a board slide. A forecast is not a date that kills a contract this cycle.

Put SOC 2 on this cycle when most of these are true:

• A named US customer, portal, or marketplace will not onboard this product without a SOC 2 report, and the field says Type 1 or Type 2.
• You can name the system they are buying: the SaaS product, the managed service, the processing you perform for them. "The whole company" is a scope you will have to defend.
• The controls in the description are controls people run: access, change, logging, incidents, vendors. A policy folder nobody uses will not survive the examination.
• You know which Trust Services Criteria categories the customer named. Security is the baseline. Extra categories are a customer sentence, not a brochure.
• The 27001 ask is a forecast. An international expansion plan is not a certificate field that blocks revenue this quarter.

If neither list is true, build the system before you send. The person who writes the controls should not be the signer. That split is consultant vs certification body, and the same independence rule applies to the CPA firm.

A GDPR article, a HIPAA letter, a FedRAMP authorization, a PCI assessment, a CMMC certificate, and Cyber Essentials are different products. If the exhibit names one of them, leave it off this request.

3. Where the controls overlap

The daily work can look similar, which is why the two products get treated as one purchase. Both expect a boundary, a way to decide risk, and evidence that people do what the description says.

In a mid-market SaaS company or a professional-services firm, that shared evidence often includes:

• who may access production, customer data, and admin tools, and how joiners and leavers are removed
• how changes reach production, and how a failed change is backed out
• how logs are kept and how an incident is raised, contained, and learned from
• how vendors and subprocessors are chosen and reviewed, including the cloud, identity, and email services the product actually uses
• how people are trained for the work they do, and how physical access works if there is an office that matters

The ISMS adds a management system around that evidence. Context, leadership, objectives, competence, internal audit, management review, and corrective action are part of what a certification body samples. The Statement of Applicability is the control decision. Annex A is the reference list. Marking every control applicable, with no evidence, is a hollow document. Excluding a control that the product plainly needs will not survive Stage 1. The pack does not need the full Statement of Applicability attached. It does need an honest map. That honesty rule is already in the scope pack.

The SOC 2 examination tests the description you assert, against the categories you included. There is no Statement of Applicability. Security is not an optional annex you can exclude. If you add Availability, the firm will look at availability commitments and the controls behind them. If you add Confidentiality, the firm will look at information you have designated as confidential. Privacy is a different category, about personal information, with its own criteria. A contract that says "keep our data confidential" is not, by itself, a reason to buy the Privacy category. Ask the customer which categories their field requires.

A mapping between Annex A and the Trust Services Criteria can help one evidence set feed two reviews. A mapping is a worksheet. It does not make one signature produce both outputs, and it does not make the sampling plans identical. Do not paste a blog's crosswalk into the request as if the two documents were the same control list. Do not ask either firm to invent a mapping you have not checked against the system you run.

The boundaries have to tell the same story when both artifacts describe one product. A 27001 scope that covers "consulting services" and a SOC 2 description that covers "the SaaS platform" are two systems. Write that split on purpose, or pick the boundary the customer is actually buying.

4. Sequencing, including Type 1 and Type 2

Four sequences cover almost every mid-market room. Pick one and write it in the first paragraph of the request.

SOC 2 first, 27001 later. Use this when US enterprise revenue is blocked on the report, and international customers have not named a certificate. Build the controls once. Commission the attestation. Put one line on the file that 27001 is a later add, with a recheck date. Do not ask an accredited certification body to quote a certificate you will not staff this cycle.

27001 first, SOC 2 later. Use this when the certificate is the gate, and the US report is a forecast. Certify the ISMS. The later attestation can reuse evidence. It is still a separate examination, with its own period if it is a Type 2. An existing certificate does not set that period and does not remove the CPA firm's work.

Both this cycle. Use this only when two customers, or one customer with two fields, have dates, and you can show both the ISMS and a system description that matches Tuesday. You may still use one evidence binder. You still have two products, two permissions, and two outputs. Section 5 is how to decide whether one organization or two should do the work.

Neither this cycle. Use this when the requirement is real but the system is a slide. Send the request after internal audit and management review have touched the ISMS, or after the description only lists controls you can show. A date on a sales forecast is not a reason to book either engagement.

Type 1 and Type 2 are not two logos for the same report. Type 1 is a point-in-time opinion on whether the controls are suitably designed. Type 2 adds operating effectiveness over a period. Many US enterprise customers will not accept Type 1 as the ongoing artifact. Buy Type 1 when a named customer has agreed to accept it as a bridge, and you have that agreement in writing. Otherwise the buy is Type 2, and the period is part of the request.

This page does not set the length of that period. Ask the CPA firm what period they will examine, and ask the customer what period they accept. Two firms quoting different periods are not quoting the same report.

After a Type 2, customers often ask for a bridge letter covering the months since the period ended. That letter is not a new report and not a certificate. Ask the firm what they will provide between reports. The ISO calendar is surveillance and recertification, in surveillance and recertification and how long ISO certification takes. Do not copy one calendar onto the other.

If you already hold a 27001 certificate, name the issuing body, the edition, the scope, and the expiry. Say whether you want a SOC 2 report on that same boundary. The certificate can make the description easier to support. It does not convert the ISMS audit into an attestation. If you already hold a SOC 2 report, name the firm, the type, the categories, the system, and the period end. That report can make Annex A evidence easier to show. It does not remove Stage 1 from a first 27001 certification.

5. One firm for both, or two firms

Some organizations can propose both products. The honest version of that offer names two permissions.

One organization, two permissions. The certificate still has to come from a legal entity accredited for ISO/IEC 27001. The report still has to come from a licensed CPA firm. Those names may match, or they may be related companies in one group. Match each name to its own directory in the quarter you would book. A group page that says "ISO and SOC" is a brochure. The verify guide is the path for the certification body. The state board, and CPAverify where that board participates, is the path for the CPA firm. A non-US brand that intends to have a US CPA firm in its network sign the report must name that firm. The local trading name is not the signer until the license says so.

Two firms, on purpose. An accredited certification body for 27001 and a separate CPA firm for SOC 2 is a normal design. You own the coordination: one boundary, one product description, one list of subprocessors, and no contradiction between the Statement of Applicability and the system description. Two firms who never see the same site list will produce artifacts a customer cannot reconcile.

A same-week visit is a schedule. Shared evidence (access reviews, change tickets, incident records, vendor reviews) is the reason to run the work close together. The sampling, the opinion, and the output stay separate. A proposal can put both in one document. It still has to show who signs which output, which permission they used, and what you will hand the customer. Decline a line that says the ISO audit covers SOC 2, or the reverse.

This site's directory is an editorial shortlist of certification bodies for the ISO standards it tags. It is not a list of licensed CPA firms, and it is not a SOC 2 marketplace. A 27001 tag does not mean the organization issues attestation reports. A firm that is absent from the directory can still be the right CPA firm. Do not ask a quality registrar with no CPA practice to add SOC 2. Do not ask a CPA firm with no accredited 27001 schedule to issue the certificate.

Independence sits on both sides. The implementer who wrote the policies, the Statement of Applicability, or the system description should not be the certification body and should not be the firm that signs the report. Disclose them on the request. How that split works for ISO is consultant vs certification body.

6. How the RFQ differs

One narrative, so the facts do not drift. Two recipient lists, when both artifacts are this cycle. The ISO half uses the scope pack. The SOC 2 half uses the same legal entity, sites, and headcount bands, plus the rows below. If only one artifact is this cycle, send one list.

Fact	If ISO/IEC 27001 is this cycle	If SOC 2 is this cycle
What you are buying	An accredited certificate for the edition you will claim	An attestation report, Type 1 or Type 2, against named Trust Services Criteria
Who may issue it	A certification-body legal entity accredited for that standard	A CPA firm licensed to perform the examination
How you check them	IAF CertSearch and the accreditation-body directory (ANAB, UKAS, or the body named on the schedule)	The state board of accountancy, and CPAverify where that board participates
Boundary	Information, activities, legal entity, and what sits outside	The system (product or service) the customer is buying, and what sits outside
Control decision	A Statement of Applicability you can defend	The categories the customer named. Security is the baseline. Privacy is not Confidentiality
Time	Stage 1 and Stage 2 for a first certificate. Ask for days by stage. Do not copy a number from this page	The point in time (Type 1) or the period (Type 2). Ask the firm. Do not copy a number from this page
Sites and suppliers	Where the information is handled, including remote work and cloud if that is true	Locations in the description, and each material subservice organization, with carve-out or inclusive stated
Owner	Named ISMS or security owner	Named owner who can walk the system description
The other artifact	Later add, or not this cycle	Later add, or not this cycle
Where the customer looks	The certificate and the accreditation path	The report itself, shared with that customer

Headcount is a band per location, not the about-page total. A follow-the-sun support desk still counts when it can reach production. More than one office is multi-site certification scope on the ISO side. Name the same locations in the SOC 2 description when they are in the system, plus the cloud and other subprocessors the product depends on. Ask which subservice organizations are carved out and which are included. Two firms that assume different clouds are not examining the same system.

For every certification body, ask the questions in what a quote includes. Days, sites, and travel are what drives cost. A major's effect on the date is closing nonconformities. For every CPA firm, ask the legal name of the signer, the license jurisdiction, the report type, the categories, the period, the subservice method, and what you may hand a customer. This page does not publish a fee or a day count. Unlike scopes produce unlike quotes.

7. How this connects to ISO 42001, then send one request

ISO/IEC 42001 is an AI management system (AIMS), examined by an accredited certification body. A customer who names 42001 wants that certificate. Mentioning a model inside a SOC 2 description, or inside a 27001 scope, keeps those two artifacts honest. It does not create an AIMS certificate.

The bridge, when 42001 is a later cycle, is the ISMS. 42001 uses the same habits: scope, owners, risk, documented information, internal audit, management review. A SOC 2 report can show that certain controls operated over a period. It does not appoint an AIMS owner. When the room is choosing 27001 or 42001, use ISO 27001 vs ISO 42001. The sequence lives on the path guide.

If a model is already part of the product customers buy, say so in the system description and in the ISMS scope. Leave 42001 off this request while the inventory is a list of tools nobody owns. One line and a recheck date are enough. Confirm live accredited AIMS scope in the quarter you would book. A 27001 schedule does not imply it. The scope pack already says not to invent an AIMS on the RFQ.

Make the call in one sitting. The output is a sentence at the top of the request.

1. Write the actual requirement. Portal, contract, security exhibit, marketplace rule. Use their words. If one field says SOC 2 Type 2 and another says ISO/IEC 27001, note which revenue is blocked this cycle. If a field says 42001, a penetration test, SOC 1, or a sector scheme, mark it as a different product.
2. Match it to a system you can show. 27001 needs an ISMS and a used Statement of Applicability. SOC 2 needs a system description and controls that operate for the type and the categories you will claim. If that system does not exist, do not send.
3. Name one primary artifact. Mark the other "later add" or "not this cycle," unless both are real enough to defend.
4. Name the boundary, the owner, and the sites for that artifact. The product the customer buys, or the information the certificate will cover. Say whether a model is inside that boundary.
5. Check the signer before you invite them. For 27001, use how to verify accreditation. For SOC 2, use the state board and CPAverify. How to choose among certification bodies you can actually award is how to choose a registrar. One U.S. name already in the directory for this fork is A-LIGN, a Tampa firm whose public pages cover ISO/IEC 27001 certification and SOC 2 attestation. Read the profile, then run both checks. The profile is not the result of either check.

If the room is still split after step 3, you have two procurements. Run the one that unblocks revenue and park the other until its evidence exists.

When that sentence is true, send it. For a 27001 certificate, send one registrar RFQ / scope pack. The Get quotes form on this site lists the ISO standards on the directory desk. SOC 2 is not one of those checkboxes. In Scope notes, name SOC 2 if it is this cycle, state Type 1 or Type 2, state the Trust Services Criteria categories, and say whether ISO/IEC 27001 is also this cycle or a later add. If the form will not send without a ticked standard, do not let a ticked ISO/IEC 27001 box stand in for a SOC 2 request. The notes sentence is the scope. Put any certificate or prior report you already hold in Existing certificates. Submit the same page once. The artifact on the page has to be the artifact you can staff.