SOC 2 vs ISO 27001

Choose SOC 2 when customers or partner banks ask for a certified public accountant (CPA) firm's attestation report against the Trust Services Criteria of the American Institute of CPAs (AICPA). Choose ISO/IEC 27001:2022 when buyers ask for a certification body's certificate for your information security management system. Test evidence for access, change, and vulnerability controls supports both.

SOC 2 and ISO 27001 compared

The table uses the AICPA SOC 2 guide, October 2022 edition, the 2017 Trust Services Criteria with revised points of focus (2022), the ISO/IEC 27001:2022 page, IAF MD 26:2023, and ISO/IEC 17021-1:2015, all checked on 2026-09-22.

Factor	SOC 2	ISO/IEC 27001:2022
Deliverable	SOC 2 report with the service auditor's opinion	Certificate of conformity for a stated scope
Who issues it	A certified public accountant (CPA) firm in public practice	A certification body; ISO states that a certificate from an accredited body may add confidence
Criteria	AICPA 2017 Trust Services Criteria with revised points of focus (2022)	ISO/IEC 27001:2022 clauses 4 to 10 and the Annex A reference set of 93 controls
Scope choice	Security (common criteria CC1 to CC9), plus optional availability, processing integrity, confidentiality, and privacy	Information security management system (ISMS) scope, with a Statement of Applicability that justifies each Annex A control
Report or audit types	SOC 2 type 1 covers control design; SOC 2 type 2 adds operating effectiveness throughout a specified period	ISO/IEC 27001 initial certification audit runs in two stages, stage 1 and stage 2
What the reader sees	SOC 2 type 2 report includes the auditor's tests of controls and the results	ISO/IEC 27001 certificate states the scope that the certification covers
Ongoing cycle	Each SOC 2 type 2 report covers one specified period, and the next report needs a new examination	ISO/IEC 27001 certification runs a three-year cycle with surveillance audits at least once a calendar year, except in recertification years
Version status	2022 revision of the Trust Services Criteria changed the points of focus only	ISO/IEC 27001:2013 certificates expired or were withdrawn at the end of the transition on 31 October 2025
Test evidence used	Penetration test reports, vulnerability scans, and change test records for criteria CC4.1, CC7.1, and CC8.1	Penetration test reports, security test results, and change test records for Annex A controls 8.8, 8.29, and 8.32

The criterion-by-criterion test scope is on the SOC 2 testing requirements page, and the Annex A test scope is on the ISO 27001 testing requirements page.

When to choose SOC 2

A customer contract or security questionnaire names a SOC 2 report. The AICPA SOC 2 guide states that customers and business partners often request a SOC 2 report. An ISO/IEC 27001 certificate is a different deliverable, so it does not answer that request.
Buyers want to see how each control was tested. The AICPA illustrative SOC 2 type 2 report includes the service auditor's tests of controls and the results. A certificate carries no test results.
Payout, invoicing, or ledger accuracy is part of what you sell. The processing integrity criteria PI1.2 to PI1.5 cover complete, accurate, and timely inputs, processing, outputs, and storage, so the service auditor tests payout and invoice flows when processing integrity is in scope.
You need a first report before an operating period has passed. A SOC 2 type 1 report covers design without an examination period, and a SOC 2 type 2 report can follow once evidence covers a full period.
Other readers need a public summary. The AICPA describes SOC 3 reports as general use reports that can be freely distributed, while the SOC 2 report goes to the customers and partners that request it.

The bank vendor due diligence scenario sets out the sequence when a partner bank asks for a SOC 2 report.

When to choose ISO 27001

A tender or buyer policy names ISO/IEC 27001 certification. Only a certification body issues the certificate, and ISO states that certification should be referred to with the full reference, such as "certified to ISO/IEC 27001:2022".
You want risk assessment built into the operating rhythm. Clauses 6.1.2 and 8.2 require risk assessment at planned intervals and when significant changes are proposed or occur. In our reading, a new payment rail or a new banking partner is a significant change.
You want a fixed external audit calendar. Under ISO/IEC 17021-1:2015, the first surveillance audit shall take place no more than 12 months after the certification decision, and a recertification audit in the third year renews the certificate before expiry.
Your current certificate names the 2013 edition. IAF MD 26:2023 states that all certifications based on ISO/IEC 27001:2013 shall expire or be withdrawn at the end of the transition period, 31 October 2025, so a buyer who checks the edition sees a lapsed certificate.
Scope must follow selected products or locations. The organisation sets the ISMS scope, and the certificate covers only that scope, so a new product outside the scope needs a scope extension.

Cost and timeline factors

These are the factors that drive effort and lead time. We give no prices, because the auditor or certification body sets its own fees.

SOC 2 factors:

Report type. A SOC 2 type 2 report needs evidence for the whole period that it covers, while a type 1 report needs design evidence only.
Categories in scope. Each category added to security brings its own criteria series: A for availability, PI for processing integrity, C for confidentiality, and P for privacy.
Systems in the system description. The penetration test scope must match every application and API that the description lists, or the CC4.1 evidence has gaps.
Evidence retention. CI logs and change tickets must survive for the whole examination period, because the auditor samples changes from that period under CC8.1.

ISO 27001 factors:

ISMS scope. The products, locations, and people in scope set the size of stage 1, stage 2, and each surveillance audit.
Three-year cycle. Budget covers the initial two-stage audit, surveillance audits in years one and two, and a recertification audit in year three (ISO/IEC 17021-1:2015, clauses 9.1.3.2 and 9.1.3.3).
Certification body rules. ISO/IEC 27006-1:2024 (checked on 2026-09-22) adds ISMS-specific requirements for certification bodies to ISO/IEC 17021-1.
Statement of Applicability. Each Annex A control marked as implemented needs evidence, such as security test results for control 8.29.

Factors for both: our practice is one requirement-to-test traceability matrix that maps each test to a Trust Services Criterion and an Annex A control, so one test run produces evidence for both audits. The audit evidence testing service delivers that matrix, a test evidence pack per audit scope, a gap report, and retest evidence. The security testing service delivers the penetration test report that both audits request. Card payment teams that also report under PCI DSS can read the PCI DSS and SOC 2 comparison.

Questions

Is SOC 2 a certification?

SOC 2 is an attestation examination, and no certificate is issued. A certified public accountant (CPA) firm in public practice examines the service organisation's controls against the AICPA 2017 Trust Services Criteria and issues a SOC 2 report with its opinion. ISO/IEC 27001:2022 leads to certification instead: a certification body issues a certificate for a stated scope.

Is SOC 2 better than ISO 27001?

Neither SOC 2 nor ISO/IEC 27001:2022 ranks above the other, because they produce different deliverables. A SOC 2 type 2 report gives a certified public accountant (CPA) firm's opinion on controls over a period, with tests and results. An ISO/IEC 27001 certificate confirms that a management system conforms to the standard. Choose the one your customers and partner banks request.

How long is ISO 27001 certification valid?

ISO/IEC 17021-1:2015 sets a three-year certification cycle for ISO/IEC 27001 certificates, unless a certification scheme specifies a different cycle. The cycle begins with the certification decision. Surveillance audits shall be conducted at least once a calendar year, except in recertification years, and a recertification audit before expiry renews the ISO/IEC 27001 certificate.

Scope your SOC 2 and ISO 27001 test evidence

Send the criteria and Annex A controls in scope, and we return a requirement-to-test traceability matrix and a test plan.

Scope your testing