SOC 2 to ISO 27001 mapping

Each of the 38 SOC 2 criteria this site maps, with the ISO/IEC 27001:2022 Annex A controls it shares a policy with. The mapping runs through the Policyseed policies: a criterion and a control are paired when one policy addresses both. It is not an official AICPA or ISO crosswalk, and every pair shows the policy that creates it.

Joined this way, the 38 criteria reach 91 of the 93 Annex A controls in 543 criterion-control pairs. 2 controls (7.6, 7.12) are not reached because no policy in the set documents them; they are explained below.

How to read this mapping

The two frameworks are organized differently. SOC 2 is a set of criteria a CPA firm reports against; ISO 27001 is a management system standard with a catalog of 93 reference controls in Annex A. There is no single correct way to line them up, which is why published comparisons quote different overlap figures. This page does not add another figure. It shows one concrete, checkable route between them: the documents you would actually write.

• A pair means a shared policy, not equivalence. If the Access Control Policy addresses CC6.2 and documents Annex A 5.18, the two are paired. The policy text you write for one helps with the other; the controls themselves are still assessed separately.
• Broad policies create broad links. The Information Security Policy touches many criteria and many controls, so it pairs all of them. Links that come only through a broad policy are weaker than links through a narrow one such as the Change Management Policy.
• Neither framework is covered by a document. Policies are where both start. Your auditor or certification body tests the controls and their evidence.

If you need an authoritative mapping, ask your auditor which one they use; the AICPA publishes its own mapping material for the Trust Services Criteria.

SOC 2 criteria to Annex A controls

For each criterion, the policies that address it and, after each policy, the Annex A controls that policy also documents. Criterion ids link to a plain-words explanation of the criterion; policy names link to the full policy text.

Annex A controls to SOC 2 criteria

The same pairs read from the ISO side, by Annex A theme. Use this view when you are building a Statement of Applicability and want to know which SOC 2 evidence you can point at for a control.

Controls the mapping does not reach

• 7.6 Working in secure areas. The policies assume no company-operated secure areas (no server rooms or data centers); the secure areas that hold production systems are the hosting provider's. If you operate one, add rules for working in it; otherwise record it as not applicable in your Statement of Applicability.
• 7.12 Cabling security. Not covered. For a cloud-hosted company, cabling that carries production traffic belongs to the hosting provider, and office cabling usually to the landlord; record it as such in your Statement of Applicability, or add a line if you run your own office network cabling.

What the mapping leaves out

Annex A is only part of ISO 27001. Clauses 4 to 10 of the standard describe the management system: the scope of the ISMS, how risks are assessed and treated, the Statement of Applicability, objectives, internal audit, management review and continual improvement. A SOC 2 program produces some of the raw material, such as a risk assessment and a review cycle, but not those records in the form a certification auditor expects. The ISO 27001 policy templates page lists what to add.

On the SOC 2 side, the report also needs a system description written by management, which ISO 27001 does not ask for. See the free SOC 2 system description template. For the policies behind every row above, see the SOC 2 policies list; for the controls between policy and evidence, the SOC 2 controls list.

ISO and ISO/IEC 27001 are standards published by the International Organization for Standardization and the International Electrotechnical Commission; the Trust Services Criteria are published by the AICPA. Policyseed is not affiliated with any of them. Control and criterion names are cited for reference; the mapping is our own.

Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.