The short answer: ISO 27001 is a certificate; SOC 2 is a report. International and EU buyers, tenders and regulators ask for ISO 27001. US enterprise buyers - especially SaaS procurement - ask for SOC 2. Many growing companies eventually need both, and the good news is that the control overlap is large enough that most of the evidence carries from one to the other.
If you are trying to decide which to do first, decide it the way your customers do: do the one your next big deal is asking for.
The core difference
| ISO 27001 | SOC 2 | |
|---|---|---|
| What it is | An international certification of an information security management system | A US attestation report on your controls |
| Who issues it | An accredited certification body (Stage 1 + Stage 2 audit) | A licensed CPA firm (an examination) |
| What you get | A certificate you can publish | A report you share under NDA |
| Who asks for it | International / EU buyers, tenders, regulators | US enterprise buyers, SaaS procurement |
| Cadence | 3-year cycle with annual surveillance | Type II typically renewed every 12 months |
The single most common misconception is calling SOC 2 a "certification". It is not. There is no SOC 2 certificate and no accreditation body. A CPA firm examines your controls against the AICPA Trust Services Criteria and writes a report, which you then hand to customers - usually behind an NDA - to answer their security due diligence.
SOC 2 in one paragraph
SOC 2 covers up to five Trust Services Criteria. Security (the Common Criteria) is always in scope. Availability, Confidentiality, Processing Integrity and Privacy are added only where your customers ask for them - and scoping them in when nobody is asking is the most common way teams overspend. A Type I report covers whether your controls are suitably designed at a point in time; a Type II covers whether they operated effectively over a period, commonly three to twelve months. Most enterprise buyers eventually want Type II.
When you need which
- You sell mostly to US companies: start with SOC 2. It is what their procurement teams recognise, and a Type I gives you something to show while the Type II observation window runs.
- You sell to EU, UK or international buyers, or bid for tenders: start with ISO 27001. It is the credential those buyers and frameworks name, and DORA/NIS2-adjacent conversations lean on it.
- You sell to both: you will likely need both. Do not treat that as two separate programmes.
Timelines: what actually takes the time
Both are dominated by the same work: building controls and operating them long enough to produce evidence. They differ at the edges.
- SOC 2 Type II needs an observation period. Even with controls ready, the report takes months because the CPA firm must see the controls operate over time. A Type I is faster but carries less weight with sophisticated buyers, so many companies treat it as a stepping stone.
- ISO 27001 needs the management system running before the two-stage certification audit: scope, risk assessment, Statement of Applicability, internal audit and management review all completed. The timeline is set by how long it takes to stand the ISMS up and show it operates.
In both cases the real constraint is operational maturity, not paperwork. A company with disciplined access management, real change control and a working incident process moves through either quickly; one without them struggles with both.
How to choose, in order
- Follow the pipeline. Which framework is named in the requests that are blocking revenue? Weight recent, large and strategic deals most.
- Follow the geography. A US growth market usually points to SOC 2 first; Europe, the UK and international tenders usually point to ISO 27001.
- Consider buyer sophistication. Enterprise security teams often want the detail of a Type II report; many procurement gates are satisfied by a verifiable certificate and scope statement.
- Plan for the second. Build the control environment so the other framework is a short follow-on, not a fresh start. Starting both from zero at the same time usually slows both.
The part that saves you money: the overlap
ISO 27001 Annex A and the SOC 2 Trust Services Criteria are describing much of the same security reality - access control, change management, logging and monitoring, incident response, vendor risk, backup and recovery. If you already run an ISO 27001 ISMS, a large share of your evidence maps straight onto the Common Criteria. The reverse is also true.
The mistake is building two parallel evidence bases with two different vocabularies. The right move is one control-and-evidence base, mapped to whichever framework a given buyer is asking about. That is exactly how we approach a second framework: build it on top of the first, not beside it.
What it costs
Both are two bills, not one. For ISO 27001 you pay for readiness work (internal or advisory), then the certification body for the Stage 1 and Stage 2 audit. For SOC 2 you pay for readiness, then a CPA firm for the examination. Certification body and CPA fees are always separate from any consultant's fee. Evidence reuse between the two frameworks is where the real saving is. How we price engagements.
Where Kellwick fits
Kellwick is not a certification body and not a CPA firm. We prepare organisations for either or both: scope the controls, build and map the evidence, close the gaps, and run an independent internal audit before the external one. If you already hold one, we build the second on your existing evidence. See SOC 2 readiness and ISO 27001 services.
Sources
Working on ISO 27001?
From gap assessment and implementation to internal audit and ongoing ISMS support - scoped to where your system actually is.