In brief
SOC 2 or ISO 27001 first? Start with the one your buyers ask for: SOC 2 for US enterprise deals, ISO 27001 for EU, UK, Japan and wider Asia-Pacific buyers.
Whether to do SOC 2 or ISO 27001 first depends on who is asking. Start with SOC 2 when most of your pipeline is US enterprise buyers who request a SOC 2 report; start with ISO 27001 when your buyers are in the EU, UK, Japan or wider Asia-Pacific and ask for a certificate. Both cover much of the same security work, so the second one reuses most of the first.
What is the difference between SOC 2 and ISO 27001?
SOC 2 is an attestation report issued by an independent CPA firm under AICPA standards, assessed against the Trust Services Criteria. ISO/IEC 27001 is an international standard for an information security management system (ISMS); an accredited certification body audits it and issues a certificate valid for three years with surveillance audits in between. SOC 2 describes how your controls performed; ISO 27001 certifies that your management system meets the standard.
| Dimension | SOC 2 | ISO 27001 |
|---|---|---|
| Issued by | Licensed CPA firm, under AICPA standards | Accredited certification body |
| Output | Attestation report (Type 1 or Type 2), shared under NDA | Certificate, publicly verifiable, plus an internal audit report |
| Where buyers ask for it most | United States and Canada | EU, UK, Japan and wider Asia-Pacific |
| Structure | Trust Services Criteria: Security always in scope, four optional categories | ISMS clauses 4 to 10 plus 93 Annex A controls in four themes (2022 edition) |
| Time to first result | Type 1: readiness, then a point-in-time report. Type 2 adds an observation period of typically 3 to 12 months (the AICPA sets no minimum) | Readiness, internal audit and management review, then Stage 1 and Stage 2 audits; duration depends on scope |
| Ongoing cycle | No official expiry; customers usually expect a report whose period ended within the last 12 months | Surveillance audits at least yearly, recertification every three years |
The full comparison, including cost and audit differences, is on the ISO 27001 vs SOC 2 comparison page.
Which one do your customers actually ask for?
The most reliable signal is your own pipeline. Pull every security questionnaire, vendor assessment and lost-deal note from the last 12 months and count how many ask for a SOC 2 report versus an ISO 27001 certificate. In general:
- SOC 2 comes up when you sell to US enterprises, especially in finance, SaaS and technology, or when questionnaires reference the Trust Services Criteria.
- ISO 27001 comes up when you sell to European, UK or Japanese companies, to regulated industries outside the US, or when reviews mention an "ISMS" or "Annex A".
- Both come up when you sell globally from the start, sell to large enterprises with global procurement, or work in financial services.
For Vietnamese outsourcing and SaaS teams, Japanese clients usually ask about ISO 27001 first; see why Japanese clients still drop vendors that hold ISO 27001.
How do you decide which to pursue first?
Answer five questions in order; the first one that gives a clear answer decides it.
- Where are most of your prospects? Mostly North America points to SOC 2; mostly Europe or Asia-Pacific points to ISO 27001.
- What did your lost deals ask for? Count the explicit requests, and check whether a finance team asked for SOC 1 rather than SOC 2 (see SOC 1 vs SOC 2 vs SOC 3). The data usually settles a split pipeline.
- How much time pressure is there? A SOC 2 Type 1 report is often the quickest first document because it tests design at one date. ISO 27001 needs a running ISMS, an internal audit and a management review before Stage 1 and Stage 2, so it usually takes longer. Both depend on scope and on what you already have.
- Will you expand internationally within a year? ISO 27001's management-system structure gives a broader base for regional requirements such as GDPR.
- What does your industry expect? HealthTech selling in the US often needs SOC 2 plus HIPAA; FinTech often needs both; AI companies may pair ISO 27001 with ISO 42001.
What carries over when you add the second framework?
Most operational security controls serve both frameworks, so the second one is mostly new documentation and a new audit, not a new security program.
| Area | Reused from the first framework | New work for the second |
|---|---|---|
| Risk assessment | Method, register and treatment decisions | ISO 27001: ISMS-format risk treatment plan and Statement of Applicability. SOC 2: mapping to CC3 |
| Access, change, incident, vendor, training controls | Policies, owners and evidence | Mapping to the other framework's criteria or Annex A controls |
| Management system | Leadership involvement, security objectives | ISO 27001: ISMS scope, internal audit, management review, corrective actions |
| Evidence over time | Recurring evidence tasks | SOC 2 Type 2: evidence for every sampled point in the observation period |
| Audit | Nothing | A separate auditor: a CPA firm for SOC 2, a certification body for ISO 27001 |
How much extra effort this takes depends on scope and on how well the first program is documented, so treat any fixed estimate with caution. Multi-framework compliance management covers how to run both from one control set.
What mistakes should you avoid?
- Choosing on audit fee alone. SOC 2 Type 2 is usually repeated every year, while ISO 27001 has yearly surveillance and a three-year recertification. Compare the full multi-year cost, including internal time, with quotes from the auditors you would actually use.
- Waiting until a prospect demands the second framework. Neither result can be produced in days; start planning the second one while the first program is still fresh.
- Running both as separate projects. If you know you need both, design one control set with evidence that serves both from the start.
- Ignoring the audit relationship. Your SOC 2 auditor and your ISO 27001 certification body are different organizations; ask each how they handle shared evidence.
How does pTrackly handle SOC 2 and ISO 27001 together?
pTrackly shares controls across frameworks: if you add ISO 27001 on top of SOC 2, overlapping controls, policies and evidence tasks are reused rather than duplicated, and publishing one policy or finishing one task counts toward every framework it supports. Each framework has its own score based on published policies and completed evidence, and audits can be set up as SOC 2 Type I, SOC 2 Type II, ISO 27001 Stage 1, Stage 2 or Surveillance. pTrackly does not decide which framework you need and does not issue reports or certificates; that stays with your team, your CPA firm and your certification body. See SOC 2 on pTrackly and ISO 27001 on pTrackly.
Frequently asked questions
Should a US-focused SaaS startup do SOC 2 or ISO 27001 first?
Usually SOC 2, because US enterprise buyers ask for a SOC 2 report in vendor reviews. Add ISO 27001 when European or Asian buyers start asking for a certificate.
Is ISO 27001 accepted instead of SOC 2 in the US?
Some US buyers accept an ISO 27001 certificate, especially for smaller deals, but many enterprise procurement teams specifically ask for a SOC 2 Type 2 report. Ask the buyer before assuming one substitutes for the other.
How long after the first framework can we have the second?
It depends on scope and how much evidence already exists. A SOC 2 Type 2 report also needs its own observation period, typically 3 to 12 months, so plan it early if buyers need it.
Does SOC 2 have to be renewed every year?
There is no official expiry, but customers usually expect a report whose period ended within the last 12 months, so most companies run a Type 2 examination each year.
Next steps
- Count how many prospects in your pipeline ask for SOC 2 versus ISO 27001.
- Identify which framework would have saved your most recent lost deal.
- Map where you will sell in the next 18 months.
- Run a gap assessment against both frameworks before committing; see how long SOC 2 takes and how long ISO 27001 certification takes for the phases.
