Comparison
SOC 2 vs ISO 27001: which do public buyers want?
The difference between a SOC 2 report and ISO 27001 certification, which public sector buyers prefer in which countries, and how to choose the right one for your firm.
Both show buyers that you take security seriously and have it independently checked. They're built differently, though, and buyers in different places prefer different ones.
Side by side
| ISO 27001 | SOC 2 | |
|---|---|---|
| What it is | Certification of an information security management system | Attestation report on controls, by a CPA firm |
| Who sets it | International Organization for Standardization (ISO) and IEC | American Institute of CPAs (AICPA) |
| What you get | A certificate, plus a Statement of Applicability | A detailed report, shared under NDA |
| Focus | Managing security risk across the organization | Controls against Trust Services Criteria: security, plus optionally availability, confidentiality, processing integrity and privacy |
| Types | One certification | Type I (design at a point in time) or Type II (operating over a period, often 6 to 12 months) |
| Validity | Three years, with yearly surveillance audits | Usually renewed every year |
| Most popular in | Canada, UK, EU, Australia, Asia, international tenders | United States, SaaS buyers worldwide |
What public buyers ask for
- Canada, UK, EU, Australia and New Zealand: public tenders most often name ISO 27001, sometimes "or equivalent". National schemes like Cyber Essentials or IRAP may be required too.
- United States: federal cloud buying needs FedRAMP. State and local buyers often accept SOC 2 Type II, ISO 27001, or GovRAMP.
- Universities and hospitals often send their own security questionnaires and accept either.
Which first?
- Selling mainly outside the US, especially to government? ISO 27001.
- Selling SaaS mainly to US companies and some public buyers? SOC 2 Type II.
- Both? Many firms do both eventually. The controls overlap heavily, so the second one is much less work than the first.
Common questions
Is SOC 2 a certification?
Not technically. It's an attestation report from an independent CPA firm, though people often call it a certification.
Will a government buyer accept SOC 2 instead of ISO 27001?
Sometimes, if the tender says "or equivalent". Ask a clarification question if it isn't clear.
What's the difference between SOC 2 Type I and Type II?
Type I checks that controls are designed properly at one point in time. Type II checks that they actually worked over a period, and is what most buyers want.