SOC 2 or ISO 27001?

Who asks for what

The question usually arrives from a customer's vendor risk team. North American buyers, especially in technology and finance, tend to ask for a SOC 2 report. Buyers in Europe, and larger multinationals everywhere, often ask whether you hold ISO 27001 certification. Public bodies have their own requirements, such as a security classification for the data and accessibility to WCAG AA.

Before starting either, ask your next few customers what they will actually accept. Some will take a completed questionnaire and your architecture documents for now; others will not sign without a report. That answer decides whether this is a this-quarter project or a next-year one.

SOC 2 in plain terms

A SOC 2 report is an examination of a service organization's controls, carried out by an independent CPA firm under the AICPA's standards ^[1]. It covers security, and optionally availability, processing integrity, confidentiality and privacy. It is an attestation, not a certificate: the auditor reports on your controls, and your customer reads the report.

• A Type I report looks at whether the controls are designed properly at a point in time. It is quicker and often the first step.
• A Type II report looks at whether the controls operated effectively over an observation period. It is what most enterprise customers eventually want.
• The report is shared with customers under a non-disclosure agreement; it is not a public badge.

ISO 27001 in plain terms

ISO/IEC 27001 is an international standard for an information security management system: how a company decides its risks, chooses controls and keeps improving them. Certification is issued by an accredited certification body after an audit, and is maintained with surveillance audits and periodic recertification.

The two overlap heavily in the controls themselves. A company that builds the controls once can usually map them to both, so a second framework costs mostly its difference: the management system and documentation ISO expects, or the reporting SOC 2 expects.

What is not a certification

What the work actually is

1. 01

   Gap assessment

   Compare what you do today with what the framework expects, and list what is missing.

2. 02

   Controls in the product

   Access by role and single sign-on, audit logs, encryption, backups with tested restores, monitoring, vulnerability scanning and change management, built into the system rather than described on paper.

3. 03

   Policies

   A written policy set that matches what the team actually does, because the auditor tests the two against each other.

4. 04

   Evidence

   Collected as the work happens, often in a compliance platform, so the observation period for a Type II report starts on a working system.

5. 05

   Fieldwork and findings

   Support while the auditor tests, and fixes for anything they find.

Answering questionnaires in the meantime

Until there is a report, the security questionnaire is the report. Answer it well: keep one master set of answers, written by the people who run the system, and update it whenever the system changes. Attach what you can show rather than describe: an architecture diagram, the data flow, the backup and restore procedure, the access review, the result of the last penetration test. An honest answer that says a control is planned, with a date, reads better to a vendor risk team than a vague yes.

The same master answers become the starting point of the gap assessment when you do decide to pursue a report, so none of the effort is wasted.

Choosing an auditor

Choose the auditor early, before the readiness work is finished, and ask how they work: how they test, what evidence they expect, whether they accept evidence from your compliance platform, and how long fieldwork and the report take. Ask your customers whether they prefer particular firms. The auditor must be independent of whoever helped you prepare, which is one reason a studio that builds your controls can never be the one that reports on them.

What it costs, worked out now

The three worked examples below are priced by our estimator from the rate card in force when you open this page, for the same web product: readiness for a first SOC 2 Type I report, audit support through a Type II report, and both SOC 2 Type II and ISO 27001 kept up continuously. Our price covers the engineering and audit support; the auditor's fee and any compliance platform are shown by the estimator as indicative ranges on their own, because you pay them directly.

When neither is the right answer yet

If no customer has asked, or the ones who asked will accept a questionnaire, a report can wait. What should not wait is the engineering: single sign-on, audit logs, encryption, backups that restore and change management cost far less to build in from the start than to retrofit before an audit. Build the controls now, and the report becomes a smaller project when a customer finally asks.