---
title: "ISO 27001 vs SOC 2: Which Do Your Customers Need?"
description: "ISO 27001 or SOC 2? Certificate versus attestation report, who asks for which, how much the controls overlap, and how UK organisations should sequence them."
canonical: https://www.isosecurity.co.uk/resources/iso-27001-vs-soc-2
updated: 2026-11-10
---

# ISO 27001 vs SOC 2: which do your customers need?

ISO 27001 gives you an internationally recognised certificate issued by an accredited body; SOC 2 gives you a US-style attestation report from a CPA firm. The controls overlap heavily, so decide by which of your customers is asking and what their vendor policy names.

## How do ISO 27001 and SOC 2 compare?

|               | ISO/IEC 27001:2022                                 | SOC 2                                                         |
| ------------- | -------------------------------------------------- | ------------------------------------------------------------- |
| Nature        | Certification of a management system               | Attestation report on controls                                |
| Issued by     | Accredited certification body (UKAS in the UK)     | Licensed CPA firm                                             |
| You receive   | A certificate, valid three years with surveillance | A report: Type I (a point in time) or Type II (over a period) |
| Criteria      | Clauses 4–10 plus your justified Annex A controls  | AICPA Trust Services Criteria, security plus any you add      |
| Recognised by | Buyers worldwide; the default in the UK and Europe | US buyers and US-style procurement                            |
| Effort shape  | Build, evidence period, two-stage audit            | Readiness, then observation period for Type II                |

## How should UK organisations decide between ISO 27001 and SOC 2?

- **Your demanding customers are UK, European or regulated:** ISO 27001 first, because it is the credential their frameworks recognise. Start with [what the standard involves](/resources/what-is-iso-27001).
- **A US customer names SOC 2:** ask whether a current ISO 27001 certificate satisfies their policy. If yes, you may save a second programme; if no, scope SOC 2 against your existing controls.
- **You sell on both sides of the Atlantic:** build the ISMS once, map controls to both frameworks, and sequence the audits by revenue at stake. Running two separate projects means paying twice for the same controls.

Neither is legally required in the UK, and both become real through contracts. Where a nearer baseline is being asked for first, my comparison of [ISO 27001 and Cyber Essentials](/resources/iso-27001-vs-cyber-essentials) covers the UK end of the ladder.

ISO Security's practice is ISO 27001 implementation and ongoing ISMS ownership. Where SOC 2 is genuinely required I will say so, and help you sequence it against this work.

## ISO 27001 or SOC 2?

### What is the difference between ISO 27001 and SOC 2?

ISO 27001 is an international standard: you build an Information Security Management System and an accredited certification body certifies it for a three-year cycle. SOC 2 is a United States attestation in which a licensed CPA firm examines your controls against the AICPA Trust Services Criteria and issues a report (Type I at a point in time, Type II over a period) that US buyers are accustomed to reading.

### Will US customers accept ISO 27001 instead of SOC 2?

Some will, some will not, and the only reliable answer comes from the customer, so ask directly, in writing, before commissioning either. Enterprise US procurement teams with SOC 2 written into vendor policy may insist on it, while many others accept a current ISO 27001 certificate with a short mapping or supplementary evidence.

### Can we use our ISO 27001 system toward SOC 2?

Largely, yes: the control substance overlaps heavily (access control, change, logging, suppliers, incidents, risk), so an existing ISMS gives you the governance, the evidence discipline and most controls. The SOC 2 work is then scoping the criteria, filling US-specific expectations and running the observation period for Type II, and you should sequence by which market is asking first.

## Contact

A customer is naming a framework and you are not sure it fits? Arrange a readiness discussion: [contact ISO Security](/contact) or email info@isosecurity.co.uk.