The short answer
| ISO/IEC 27001 | SOC 2 | |
|---|---|---|
| What it is | International standard for an information security management system (ISMS) | AICPA attestation examination of a service organization’s controls |
| Outcome | Certificate from a certification body | CPA’s report with an opinion |
| Basis | ISO/IEC 27001:2022 requirements and Annex A controls (93 controls, down from 114 in the 2013 edition, per SGS) | AICPA Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy |
| Focus | Whether the management system is established, maintained and improved | Whether controls are suitably designed (Type 1) and, over a period, operating effectively (Type 2) |
| Audience | Global, especially Europe and Asia | Mostly North American customers |
| Shareability | Certificate can be shown publicly | Report is generally shared with customers under NDA |
Many companies end up with both. AICPA publishes a mapping between the Trust Services Criteria and ISO 27001, which helps reuse controls and evidence.
For a clause-by-clause ISO 27001 gap analysis, see ISO 27001 Gap Analysis: Checklist and Software Guide for 2026. For how to review a SOC 2 report you receive from a vendor, see How to Review a Vendor SOC 2 Report: A 10-Point Checklist for 2026.
What an ISO 27001 assessment involves
- Scope the ISMS: organization units, locations, systems.
- Risk assessment and treatment to decide which controls apply.
- Statement of Applicability listing Annex A controls and justifying inclusions and exclusions.
- Implement policies, controls and records.
- Internal audit and management review.
- Certification audit by an accredited certification body, followed by ongoing surveillance.
Timing note: the transition period for the 2013 edition ended October 31, 2025. After that date, all ISO/IEC 27001:2013 certificates expired or should have been withdrawn, according to SGS. ISO has also issued Amendment 1:2024, “Climate action changes.” If a vendor still shows a 2013 certificate, ask why.
What a SOC 2 assessment involves
- Choose criteria: security is always included; add availability, processing integrity, confidentiality or privacy as customers need.
- Define the system and its boundaries, including subservice organizations.
- Readiness assessment to find gaps before the audit.
- Type 1 (design at a point in time) or Type 2 (design and operating effectiveness over a period, typically 6 to 12 months, per PYA).
- CPA examination and report, including any exceptions and complementary user entity controls.
Where FedRAMP fits
For cloud services sold to US federal agencies, FedRAMP authorization is the requirement; SOC 2 and ISO 27001 do not replace it. FedRAMP is changing. Its 20x initiative replaces much of the document-heavy process with Key Security Indicators and automated validation. The Phase 2 Moderate pilot ran from November 18, 2025 to the end of March 2026; the first cohort received pilot authorizations on March 6, 2026, and six more providers had by April 27, 2026. FedRAMP’s lessons include the value of machine-readable submissions and clear context for evidence.
Preparing evidence once for several frameworks
| Control area | One piece of evidence can serve |
|---|---|
| Access reviews | ISO Annex A access control; SOC 2 security criteria; NIST 800-171 access control |
| Risk assessment | ISO clause 6 risk assessment; SOC 2 risk assessment criteria; FedRAMP risk documentation |
| Incident response tests | ISO incident management; SOC 2 incident criteria; NIST incident response |
| Vendor management | ISO supplier relationships; SOC 2 vendor criteria |
| Change management | ISO change management; SOC 2 change criteria |
Build a common control set, map it to each framework, and keep evidence dated and linked to controls.
Common weaknesses
- Choosing a framework before asking what customers actually require
- SOC 2 scope that excludes the systems customers care about
- ISO Statements of Applicability with weak justifications for exclusions
- Evidence collected in a rush before each audit
- Separate evidence sets for each framework
Security compliance assessment checklist
- Customer and market requirements identified (ISO, SOC 2, FedRAMP, others)
- Scope defined and matched to what customers use
- Common control set mapped to each framework
- Risk assessment and treatment documented
- Evidence dated, owned and linked to controls
- Readiness review completed before the audit
- ISO certificate on the 2022 edition
- SOC 2 exceptions and CUECs explained to customers
Get audit-ready with AskDona
Auditors read your evidence against criteria; AskDona does the same before they arrive. It reads policies, procedures, records and screenshots against ISO 27001, SOC 2 or your own control set, flags missing, stale or contradictory evidence, and links each finding to its source page. Run a sample audit readiness review on one control area. AskDona shows the evidence; your compliance team decides.
FAQ
What is an ISO 27001 assessment? An audit by an accredited certification body of whether your information security management system meets ISO/IEC 27001, leading to certification.
What is a SOC 2 assessment? A CPA examination of a service organization’s controls against the AICPA Trust Services Criteria, producing a Type 1 or Type 2 report.
Is ISO 27001 or SOC 2 better? Neither in general. Choose based on customers: SOC 2 is common in North America, ISO 27001 internationally. Many companies need both.
Are ISO 27001:2013 certificates still valid? No. The transition period ended October 31, 2025.
Does SOC 2 replace FedRAMP? No. Cloud services for US federal agencies need FedRAMP authorization.
References
All pages opened and checked by October 14, 2026.
| Source | Type | Used for |
|---|---|---|
| ISO/IEC 27001:2022 | International standard | Standard, certification, Amendment 1 |
| SGS, ISO/IEC 27001 transition (May 2024) | Certification body | Transition deadline, control counts |
| AICPA, SOC 2 reporting guide | Professional body | Trust Services categories |
| AICPA, Mapping TSC to ISO 27001 | Professional body | Framework mapping |
| PYA, How to Review a SOC Report (July 2026) | CPA firm guide | Type 1 vs Type 2 |
| FedRAMP 20x Phase 2 recap | US government program | 20x pilot |