SOC 2 vs ISO 27001: Which One Do Your Customers Actually Want?

Your procurement team gets a new vendor questionnaire on a Thursday. Section three asks for your SOC 2 Type 2 report. Section four asks for your ISO 27001 certificate. You have neither SOC 2 vs ISO 27001. The deal is paused while your team scrambles to explain the difference between two frameworks they have been meaning to tackle for eighteen months.

This is not a hypothetical. It is the situation dozens of European SaaS companies hit every year, somewhere between their first enterprise deal and their Series B. The certification question is not new. What changes is the cost of not having an answer.

SOC 2 and ISO 27001 are not the same thing. They are not alternatives. They serve different buyers, produce different outputs, and follow different processes. Their control sets overlap between 60 and 80 percent depending on scope, which means pursuing both is far less than twice the work if you build them together. The decision is not which one to get. It is which one to get first, and why.

The audit fee is also not the real cost. Practitioner consensus puts the formal audit at roughly 30 to 40 percent of the true total spend. The internal time, the readiness work, the tooling, and the three-year maintenance tail is the rest of the iceberg. This guide covers the comparison, the geography of demand, the process, the cost structure, and how to run both without building two programmes from scratch.

For how certifications connect to your customers' due diligence workflows and what buyers look for when they review your vendor profile, see our vendor assessment guide .

1. What Each Framework Actually Produces

The difference matters more than it sounds. When a German enterprise buyer asks for ISO 27001, they want a certificate number they can verify against the International Accreditation Forum's CertSearch database. When a US buyer asks for SOC 2, they want the report itself: they will read the description of tests performed, the exceptions listed, and management's response. One is a credential; the other is a disclosure document.

The underlying philosophies also differ. SOC 2 asks: do your controls work? ISO 27001 asks: do you run a living management system that governs those controls over time? A Stage 2 ISO 27001 audit does not just confirm that controls exist. It confirms that your ISMS, the policies, the risk register, the management reviews, the internal audits, operates as a functioning programme. That management-system layer is why ISO 27001 is harder to build but, once built, makes almost every subsequent audit significantly easier. The control infrastructure is already there.

2. Which One Do Your Customers Actually Ask For?

I advise technology companies across European and US markets, and the pattern is consistent. German, Dutch, French, and Nordic procurement teams treat ISO 27001 as a filter, not a differentiator. Not having it removes you from shortlists before any conversation starts. US buyers treat SOC 2 Type 2 the same way. Both groups know what they are asking for and why.

Two dynamics are accelerating this in Europe. First, NIS2 has created a cascade effect: companies operating in sectors designated as essential or important under the directive are pushing ISO 27001 requirements down their supply chains. If your customers are in financial services, healthcare, digital infrastructure, or energy, their NIS2 obligations are becoming your procurement requirements. Zunic Law's analysis of Serbia's new Law on Information Security , which aligns domestic legislation with NIS2, shows how this pressure is reaching even pre-accession jurisdictions outside the EU.

Second, GDPR creates a structural preference for ISO 27001 among EU buyers that goes beyond procurement checklists. Article 32 of GDPR requires technical and organisational security measures. ISO 27001's Annex A documents exactly those measures, independently audited. EU buyers treat ISO 27001 as partial evidence of GDPR compliance posture in ways that SOC 2 alone does not satisfy. For the intersection of vendor security requirements and data protection obligations, see our guide to GDPR vendor management .

The case for ISO first, then SOC 2: ISO 27001 requires building an ISMS. That management system, the risk register, the control set, the documentation, provides almost everything a SOC 2 audit needs. Going SOC 2 first, then ISO, typically requires rework because you built controls without the management-system layer ISO requires. The second framework becomes an incremental addition, not a parallel project, when you start with ISO.

3. SOC 2 Type 1 vs Type 2: What Enterprise Buyers Accept

The practical problem with treating Type 1 as a stop-gap: it works once. Type 1 can be completed in a few months with no observation period required. Type 2 needs controls to operate continuously across the chosen window and evidence to prove it. The first time you present Type 1, buyers may accept it. The second time, especially if you are re-entering the same account or competing against vendors who have Type 2, it is not enough.

What makes Type 2 hard is not the audit itself. It is the sustained discipline of collecting evidence throughout the observation period. Access review records, change management logs, monitoring alerts, policy acknowledgments, all of it must be captured continuously, not assembled in a rush the week before the auditor arrives. Trying to reconstruct months of control operation history at the end is, in the words of practitioners who have been through it, exactly as painful as it sounds.

Type 1 has a clear use case: you are in a deal that needs something in hand now, and you are already committed to a Type 2 programme that is already running. Treat it as a milestone on the path, not a destination.

4. The Certification Process: What Actually Happens

ISO 27001: the path

The ISMS scope decision is the most consequential one in the programme. Scope too broadly and you multiply the audit work. Scope too narrowly and customers question whether the certificate covers your actual product environment. The scope should reflect what your customers actually care about: the systems that handle their data, the people who access it, the locations where it is processed.

Stage 1 is a documentation audit. The certification body reviews your ISMS policies, your risk register, and your Statement of Applicability. Stage 2 tests whether those controls actually operate. Stage 2 is billed regardless of outcome. Entering under-prepared is expensive. Internal audits before Stage 2 are not bureaucratic formality: they tell you whether you are ready.

After certification: annual surveillance audits in years two and three, then a full recertification at year three. The surveillance audits run at roughly 30 to 40 percent of the initial Stage 2 fee. Budget the three-year cycle from day one, not just year one. For the complete ISO 27001 process, our ISO 27001 guidebook covers every stage in full.

SOC 2: the path

Readiness assessment first. Find and fix gaps before the auditor arrives. Companies that move straight from 'we should get SOC 2' to fieldwork without a serious gap analysis spend significantly more time and money in the audit itself fixing things that could have been addressed for a fraction of the cost beforehand. This is the most-cited mistake across every source on the SOC 2 process.

The observation window: for Type 2, controls must demonstrably operate across the chosen period. Someone must be collecting evidence continuously throughout. It is not passive. Trying to assemble that evidence retrospectively at the end is what practitioners mean when they describe evidence collection as the hardest part. It is not hard because the controls are complex. It is hard because it requires sustained process discipline across a long period, usually while the rest of the company is busy building a product.

Audit fieldwork runs two to six weeks. The auditor issues an Information Request List. Your team responds. Exceptions found during fieldwork go into the report with your management response. Enterprise buyers read those management responses. Write them carefully.

For the full SOC 2 process, see our SOC 2 guidebook .

5. Choosing a Certification Body: What to Verify Before You Sign

The lowest quote is not the right thing to optimise for here. The relevant question is whether the certificate, once issued, will be accepted by your actual customers. A non-accredited certificate can be worse than no certificate: it creates the appearance of compliance without the substance, and when a customer checks the accreditation chain and finds it missing, the trust damage is significant.

Verify any ISO 27001 certificate against the IAF CertSearch database (iaf.nu). It lists certificates from bodies accredited by IAF members. A certificate not in the database, or from a body not accredited by an IAF member, will not be recognised by most enterprise procurement processes or EU regulatory frameworks. UK buyers can also check the UKAS directory ; US buyers, ANAB .

ISO 27006 (ISO/IEC 27006) sets the minimum audit days a certification body must spend, based on your employee count. A quote that undercuts the market significantly often signals the body plans to spend fewer days than the standard requires. Ask for the audit plan and check the day count against the ISO 27006 table for your headcount before you sign anything.

One thing practitioners mention repeatedly about auditor selection: the process runs materially smoother when you can have a direct technical conversation with your auditor about your actual architecture. An auditor who defaults to generic checklists without understanding your environment produces findings that are less useful and harder to act on. Ask for auditor CVs. Ask for a reference from a company similar to yours in size and tech stack.

For SOC 2, the equivalent question is choosing the right CPA firm. This is widely described as the single most consequential decision on the SOC 2 path. A firm that understands modern cloud architectures produces a more useful report. For how auditor selection connects to your vendor due diligence process, see our supplier due diligence checklist .

6. What the Certification Actually Costs: The Full Picture

The framing that changes everything: both frameworks are ongoing programmes, not one-time projects. The certification fee is the smallest item on the multi-year ledger. The real cost is internal time, and practitioner consensus on first-cycle programmes is 200 to 500 hours of internal work for ISO 27001 and 150 to 400 hours for SOC 2 Type 2. That is time from your engineering and security team. It reduces their capacity for product work and does not fall significantly in subsequent years.

The audit fee typically represents only 30 to 40 percent of total compliance spend. The other 60 to 70 percent is internal time, readiness work, tooling, and the recurring maintenance tail. Budget all five cost buckets from day one, not just the audit line.

EU pricing varies significantly by geography. Germany, France, the Netherlands, and the UK sit at the upper end of EU certification body rates. Poland, Czech Republic, Romania, and the Baltic states are noticeably cheaper for both auditors and consultants, with certificates carrying identical international validity provided the body is accredited. For companies with EU operations distributed across member states, the choice of certification body jurisdiction is a legitimate cost lever.

NIS2 is making ISO 27001 a cost of doing business in regulated sectors rather than an optional investment. If your enterprise customers operate in energy, financial services, healthcare, or digital infrastructure, their procurement teams are likely already requiring your certificate. The Zunic Law data protection practice overview covers how these security obligations intersect with broader compliance requirements, including where ISO 27001 and GDPR accountability obligations reinforce each other.

The dual-certification efficiency deserves specific emphasis. Pursuing SOC 2 and ISO 27001 through one platform and one implementation effort typically saves 20 to 35 percent versus running them as separate programmes. One control satisfies both frameworks simultaneously. ISO 27001 Annex A control A.8.3 on information access restriction maps directly to SOC 2's CC6.1 on logical access. One evidence artefact, one policy, one audit preparation effort serves both. Build the cross-framework mapping at the start, not as an afterthought when the second audit arrives.

7. What Certification Means for Your Vendor Assessment Workflow

The commercial argument for certification that practitioners under-emphasise: the direct cost is visible and concentrated in time. The indirect cost of not being certified is invisible and distributed across every enterprise deal you slow down or lose. Security questionnaire responses take four to eight hours each, across teams that have other priorities. A SOC 2 report or ISO 27001 certificate closes dozens of individual control questions in one document.

When you are the buyer evaluating vendors, a certified vendor gives you a verified, independently audited baseline that replaces a significant portion of your own assessment work. When you are the vendor, your certificate reduces the burden your customers impose on you. Both sides of the transaction are more efficient when certification is present. Our vendor assessment guide covers how to structure that workflow, including how to handle vendors who present certificates rather than completing questionnaires.

One thing certification does not do: ISO 27001 does not confirm that your controls address the specific risks of a specific customer relationship. It confirms that you have a functioning ISMS that meets the standard. A customer with specific contractual security requirements or particular technical controls will still need to verify those specifics. Certification is the floor, not the ceiling, of vendor security assurance. Our guide to security questionnaire automation explains how to handle the questionnaire volume that remains even after certification.

The GDPR dimension: ISO 27001 certification is one of the strongest signals you can give an EU customer of your readiness to act as a processor under Article 28. It demonstrates that the technical and organisational measures required by Article 32 are in place, documented, and independently verified. For the full intersection of security certification and data protection documentation, see our guide to GDPR audit readiness .

8. Running Both: How to Do It Without Building Two Programmes

The single biggest mistake in dual-framework programmes is treating them as sequential. Companies that complete ISO 27001, close it out, then turn to SOC 2 find themselves reformatting documentation and rebuilding evidence collection for an attestation-report context. The frameworks share enough control infrastructure that the marginal cost of adding the second is low if you plan for it from the start.

What a well-run dual programme looks like: one ISMS scope that is designed to satisfy both frameworks; one risk assessment process feeding both risk registers; one evidence collection system with tagging that maps each artefact to both control sets; one internal audit function testing against both sets of criteria; and two separate third-party engagements at the end. The independent third-party requirement is the one thing you cannot combine. The ISO certification body and the SOC 2 CPA firm must be separate, and neither can be the same party who helped you prepare.

The platform question: GRC automation platforms that support multiple frameworks simultaneously handle the cross-mapping, the continuous evidence collection, and the auditor collaboration portal. They do not remove the need for human owners. Someone still has to fix failed controls, approve policies, make the risk treatment judgments, and work with the auditor. The platform handles the plumbing. You handle the thinking.

For the GDPR audit readiness dimension, including how the same control documentation that feeds your ISO 27001 audit supports GDPR accountability requirements, see our GDPR audit readiness guide .