SOC 2 vs ISO 27001: which first?

Start with the one your customers ask for. SOC 2 is the report most often requested by US buyers, and ISO 27001 is the certification more often requested outside the US. If a deal or a contract names one of them, that settles it. If neither is named yet, look at where your next ten prospects are, and ask two or three of them what their security team expects. A lot of the policy and control work is the same either way, so the first choice does not waste the second.

Is SOC 2 a certification?

No. A SOC 2 report is an attestation report written by a licensed CPA firm, with the firm's opinion on your controls. ISO 27001 is different: an accredited certification body assesses your information security management system and issues a certificate after a successful audit. Use "report" for SOC 2 and "certification" or "certificate" only for ISO 27001.

How much do SOC 2 and ISO 27001 overlap?

A lot, but published figures are single percentages and they differ: HiComply and Comp AI each say roughly 80 percent, and TCSA says 70 percent. Treat them as rough. This site counts instead of estimating, at the level of policies: the 22 Policyseed policies document most Annex A controls, and the mapping guide shows which policy links each SOC 2 criterion to each control. Overlap in documents does not mean one audit covers the other.

Do we need both SOC 2 and ISO 27001?

Only if your customers ask for both, for example when you sell both in the US and abroad. You can deliver one first and add the second when sales call for it. Running both from one policy set and one evidence routine keeps the added cost to the parts that are unique to each: the CPA firm's system description for SOC 2, and the management system records for ISO 27001.

How long does each last?

A SOC 2 Type II report covers an observation period, which Comp AI gives as typically 3 to 12 months, and it is usually renewed annually. An ISO 27001 certificate is valid for three years, with surveillance audits in between, according to Comp AI and TCSA. Customers tend to want a current SOC 2 report and a valid ISO certificate, so plan the renewals either way.

Can the same policies serve both frameworks?

Largely, yes. The same access, change, incident, vendor and encryption policies are what both a CPA firm and an ISO certification body read first. ISO 27001 additionally asks for management system records that SOC 2 does not: a scope statement, a Statement of Applicability, a risk treatment plan, internal audit and management review. Your auditor or certification body decides what satisfies them.

Does using Policyseed get us a SOC 2 report or an ISO 27001 certificate?

No. Policyseed produces policy drafts and audit-prep documents. A CPA firm issues a SOC 2 report, and an accredited certification body issues an ISO 27001 certificate. Management still reviews, edits and approves every document, and operating the controls is your work.

SOC 2 vs ISO 27001 for startups: which one first?

Updated 25 October 2026

Pick the one your customers ask for. SOC 2 is an attestation report written by a licensed CPA firm, and it is the one US buyers request most. ISO/IEC 27001 is a certification: an accredited certification body audits your information security management system and issues a certificate, and it is requested more often outside the US. Much of the policy and control work is the same for both, so choosing one first does not waste the other. This guide compares them side by side, shows what overlaps by counting at the policy level, and lists what ISO 27001 asks for that SOC 2 does not.

The difference in one table

	SOC 2	ISO/IEC 27001
Who issues it	SOC 2A licensed CPA firm, working to the AICPA's attestation standards.	ISO/IEC 27001A certification body accredited by a national accreditation body, auditing against ISO/IEC 27001.
What you receive	SOC 2An attestation report with the firm's opinion. Type I covers the design of controls on one date; Type II covers whether they operated over a period. Usually shared with customers under an NDA.	ISO/IEC 27001A certificate that your information security management system was assessed against the standard. The audit runs in two stages.
What is examined	SOC 2Your controls against the Trust Services Criteria you put in scope (Security is the base), described in a system description written by management.	ISO/IEC 27001The management system as a whole (clauses 4 to 10) and the Annex A controls your Statement of Applicability selects.
How long it lasts	SOC 2A period. Comp AI gives a Type II period as typically 3 to 12 months, usually renewed annually.	ISO/IEC 27001A certificate valid for three years, with surveillance audits in between (Comp AI, TCSA).
Who asks for it most	SOC 2US buyers, especially enterprise security reviews.	ISO/IEC 27001Buyers outside the US, and international procurement.

The recurring period and certificate term above come from Comp AI's comparison (source); confirm both with the CPA firm or certification body you engage, because the exact terms depend on the engagement. The audience row follows the sources in the next section.

Let your customers decide

The sources agree on the rule and differ only in emphasis. TCSA says to let the standard your customers ask for drive the decision, with SOC 2 first for a company selling mainly to US enterprise customers and ISO 27001 first for European, Indian or global customers (source). HiComply says SOC 2 is often expected by US enterprise buyers, and that ISO 27001 usually carries more weight with international clients (source). Comp AI adds that many US companies accept ISO 27001 and many non-US companies accept SOC 2, so the market alone does not decide it (source). These are the publishers' views, and each of them sells compliance software or services.

To find your own answer, do this before you spend anything:

Read the asks you already have. Look through the security questionnaires, contracts and procurement emails of the last year for the words "SOC 2" and "ISO 27001".
Ask the next three prospects. Which report or certificate does their security team need, and will a completed questionnaire do while you work on it? The customer-request guide has the questions to ask and a status note that does not overclaim.
Check where the revenue is going. If the pipeline is mostly US mid-market and enterprise, SOC 2 is the likelier ask. If it is mostly outside the US, expect ISO 27001.

What overlaps, counted at the policy level

Published comparisons give the overlap as one number: HiComply says roughly 80 percent (source), Comp AI says roughly 80 percent (source), and TCSA says 70 percent (source). None of them is a measurement you can check, and the right figure depends on how you line two different documents up.

Policyseed counts something narrower that you can verify. Of the 93 controls in ISO/IEC 27001:2022 Annex A, 91 are documented by at least one of the 22 Policyseed policies. The 2 that are not (7.6 Working in secure areas; 7.12 Cabling security) are physical controls that a cloud-hosted company usually inherits from its hosting provider or landlord. You still record a decision for each in your Statement of Applicability. The ISO 27001 policy templates page lists every control with the policies behind it and offers the mapping as a free CSV, and the SOC 2 to ISO 27001 mapping pairs each SOC 2 criterion with the Annex A controls it shares a policy with.

This is a count of documents, not of audit outcomes. Having a policy for a control is where both frameworks start. The CPA firm or the certification body tests the control and its evidence, and may draw the lines differently.

What ISO 27001 adds beyond policies

Annex A is an appendix. The certifiable part of ISO 27001 is the management system in clauses 4 to 10, and it asks for records a SOC 2 program does not produce in the same form:

A defined scope for the management system, covering which products, locations and systems it applies to.
A Statement of Applicability that lists every Annex A control, says whether it applies and why, and gives its status.
A risk assessment method and a risk treatment plan, with security objectives.
An internal audit program covering the whole management system.
Management review with recorded inputs and decisions, and corrective actions when something does not work.

SOC 2 asks for something ISO 27001 does not: a system description written by management, which the CPA firm reads against the criteria. See the free system description template. For a starting point on the risk assessment both need, the free risk assessment wizard builds a register from your stack.

Running both from one policy set

If your customers ask for both, keep one set of policies and one evidence routine, and add the pieces that belong to each side:

Shared: the 22 policies, access reviews, change records, incident logs, vendor reviews, training records and policy acknowledgments.
SOC 2 only: the system description, the choice of Trust Services Criteria (see SOC 2 scope), and the observation period.
ISO 27001 only: the scope statement, Statement of Applicability, risk treatment plan, internal audit and management review.

The Audit Kit ($59, one time) includes a crosswalk.xlsx with an ISO 27001 Annex A sheet next to the 22 policies tailored to your stack as Word files. The generator, the readiness assessment and the timeline planner are free. For a dated plan, remember that every duration there is a planning assumption.

A decision checklist

A contract or prospect names SOC 2 or ISO 27001: choose that one.
Most of your pipeline is in the US: lean to SOC 2 first.
Most of your pipeline is in Europe, the UK or Asia: lean to ISO 27001 first.
Both are named by different customers: do the one with the nearest deal first, and reuse the policies.
Nobody has asked yet: write the policies now, and wait for the first real ask before engaging an auditor.
Your team is under ten people: see SOC 2 for small teams.
You need a budget: see what SOC 2 costs for sourced ranges.

Frequently asked questions

SOC 2 vs ISO 27001: which first?: Start with the one your customers ask for. SOC 2 is the report most often requested by US buyers, and ISO 27001 is the certification more often requested outside the US. If a deal or a contract names one of them, that settles it. If neither is named yet, look at where your next ten prospects are, and ask two or three of them what their security team expects. A lot of the policy and control work is the same either way, so the first choice does not waste the second.
Is SOC 2 a certification?: No. A SOC 2 report is an attestation report written by a licensed CPA firm, with the firm's opinion on your controls. ISO 27001 is different: an accredited certification body assesses your information security management system and issues a certificate after a successful audit. Use "report" for SOC 2 and "certification" or "certificate" only for ISO 27001.
How much do SOC 2 and ISO 27001 overlap?: A lot, but published figures are single percentages and they differ: HiComply and Comp AI each say roughly 80 percent, and TCSA says 70 percent. Treat them as rough. This site counts instead of estimating, at the level of policies: the 22 Policyseed policies document most Annex A controls, and the mapping guide shows which policy links each SOC 2 criterion to each control. Overlap in documents does not mean one audit covers the other.
Do we need both SOC 2 and ISO 27001?: Only if your customers ask for both, for example when you sell both in the US and abroad. You can deliver one first and add the second when sales call for it. Running both from one policy set and one evidence routine keeps the added cost to the parts that are unique to each: the CPA firm's system description for SOC 2, and the management system records for ISO 27001.
How long does each last?: A SOC 2 Type II report covers an observation period, which Comp AI gives as typically 3 to 12 months, and it is usually renewed annually. An ISO 27001 certificate is valid for three years, with surveillance audits in between, according to Comp AI and TCSA. Customers tend to want a current SOC 2 report and a valid ISO certificate, so plan the renewals either way.
Can the same policies serve both frameworks?: Largely, yes. The same access, change, incident, vendor and encryption policies are what both a CPA firm and an ISO certification body read first. ISO 27001 additionally asks for management system records that SOC 2 does not: a scope statement, a Statement of Applicability, a risk treatment plan, internal audit and management review. Your auditor or certification body decides what satisfies them.
Does using Policyseed get us a SOC 2 report or an ISO 27001 certificate?: No. Policyseed produces policy drafts and audit-prep documents. A CPA firm issues a SOC 2 report, and an accredited certification body issues an ISO 27001 certificate. Management still reviews, edits and approves every document, and operating the controls is your work.

ISO and ISO/IEC 27001 are standards published by the International Organization for Standardization and the International Electrotechnical Commission; the Trust Services Criteria are published by the AICPA. Policyseed is not affiliated with any of them.

Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.