SOC 2 or ISO 27001: which do your customers expect?

How the certificate and the audit report differ, which markets and buyers ask for which, and how to avoid doing the same security work twice.

In short

ISO 27001 is a certificate for an information security management system, issued by an accredited certification body and recognised worldwide. SOC 2 is an American attestation report by an independent CPA firm on how your controls work. European buyers usually ask for ISO 27001; North American SaaS buyers often ask for SOC 2. Ask your customers before you choose.

Both frameworks answer the same customer question, "can we trust you with our data?", but in different forms. This comparison is written by Devies, a Gothenburg-based product and engineering consultancy, for founders, CTOs and security leads at software and service companies who keep meeting both names in security questionnaires and tenders.

What is the difference between ISO 27001 and SOC 2?

ISO 27001 certifies that you run a management system for information security, while SOC 2 reports an auditor's opinion on how specific controls are designed and, in a Type 2 report, how they operated over a period.

ISO/IEC 27001 is an international standard published by ISO and IEC. An organisation builds an information security management system (ISMS), and an accredited certification body audits it against ISO/IEC 27001:2022. The result is a certificate, valid for three years with annual surveillance audits, that you can show publicly.

SOC 2 is an examination under standards from the American Institute of Certified Public Accountants (AICPA). An independent CPA firm examines your description of a service system and your controls against the AICPA Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. Security is always included; the other four are chosen to fit the service. The result is a report with the auditor's opinion, not a certificate.

SOC 2 comes in two types:

Type 1 covers the design of controls at a single point in time.
Type 2 also tests whether the controls operated effectively over a review period, typically several months. Most buyers who ask for it mean Type 2.

Decision table: ISO 27001 compared with SOC 2

The two differ most in output, geography and what the auditor actually tests.

Criterion

ISO 27001

SOC 2

Type of assurance

ISO 27001

Certification of a management system

SOC 2

Attestation report on controls

Who audits

ISO 27001

Accredited certification body (in Sweden accredited by Swedac)

SOC 2

Independent CPA firm

What you receive

ISO 27001

A certificate, usually public

SOC 2

A detailed report, usually shared under NDA

Scope

ISO 27001

The ISMS scope you define: organisation, sites, systems

SOC 2

A specific service system and the chosen criteria

Time element

ISO 27001

Point-in-time audits, then annual surveillance

SOC 2

Type 2 covers a period of operation

Where buyers expect it

ISO 27001

Europe and internationally, public procurement

SOC 2

North America, especially SaaS and cloud buyers

Level of detail for the reader

ISO 27001

Low: the certificate states scope and standard

SOC 2

High: tests of each control and any exceptions

Renewal

ISO 27001

Three-year cycle with surveillance audits

SOC 2

A new report for each period, often yearly

Choose ISO 27001 when

most customers and partners are in Europe, or you bid in public procurement;
you want a management system that covers the whole organisation, not one service;
you need something you can show publicly, on a website or in a tender;
you also need to organise work for the Swedish Cybersecurity Act or NIS2.

Choose SOC 2 when

your sales pipeline includes North American enterprise customers whose vendor-risk teams ask for it by name;
you sell a cloud or SaaS service and customers want detailed evidence of controls over time;
a key customer contract explicitly requires a SOC 2 Type 2 report.

Why do customers ask for one and not the other?

Customers ask for the framework their own vendor-risk process is built around, which mostly follows geography and industry.

A European procurement team often has a tender requirement written as "ISO 27001 certification or equivalent". A US security team often has a questionnaire that starts with "please provide your latest SOC 2 Type 2 report", because their own auditors and regulators are used to reading SOC reports. Neither is better in absolute terms. The question is which one shortens your sales cycle.

Find out before you choose:

Read your last ten security questionnaires and count how often each framework is requested.
Check active contracts and tenders for explicit requirements, and whether "or equivalent" is accepted.
Ask your largest prospects directly what their vendor-risk team needs to approve you.
Look at your three-year market plan. If you plan to grow in North America, an attestation report may become necessary later even if Europe drives demand today.

Can you do both without doing the work twice?

Yes: the two frameworks overlap heavily in the controls they expect, so one well-designed control set can support both.

Access management, logging, change management, incident response, supplier management, risk assessment and security awareness appear in both ISO 27001 Annex A and the Trust Services Criteria. The AICPA publishes mappings between the Trust Services Criteria and other frameworks for its members. The practical approach is:

build one control set with clear owners and evidence;
run the ISMS cycle that ISO 27001 requires: risk assessment, internal audit and management review;
reuse the same evidence for the review period of a Type 2 report.

The real difference in effort is the audit, not the controls. A Type 2 examination needs evidence that each control worked throughout the period, so automated logging and ticket trails matter more than polished policy documents. A security audit for either framework will expose controls that exist only on paper.

Which order works best?

For a Nordic company, the usual order is ISO 27001 first and the American report second. The ISMS gives you the risk assessment, ownership and review cycle that make later audits predictable, and the certificate answers most European questionnaires on its own. When North American demand grows, the same controls can enter a Type 1 examination quickly and then a Type 2 period. The reverse order also works, but a company that starts with the attestation often discovers that it still lacks the management layer European buyers expect. Whichever you start with, decide the scope carefully: a narrow scope around the product customers actually buy is cheaper to audit and easier to keep honest than a broad one. In Sweden, Swedac accredits the bodies that issue accredited ISO 27001 certificates, so check accreditation before you sign with a certification body.

Devies

Want a second opinion?

Devies, a Gothenburg-based product and engineering consultancy, works on questions like this with Nordic product and IT teams. Tell us where you are and we will suggest a sensible first step.

Talk to Devies

Frequently asked questions

Is SOC 2 recognised in Europe?

Yes, many European companies with American customers have SOC 2 reports, and international buyers understand them. But European procurement teams and public tenders more often ask for ISO 27001 certification, and some accept SOC 2 only as an equivalent on a case-by-case basis. If your customers are mainly in the Nordics or the EU, ISO 27001 is usually the safer first choice.

Is SOC 2 a certification?

No. SOC 2 is an attestation: an independent CPA firm examines your system description and controls and issues a report with its opinion. There is no certificate and no certification body. The report is usually shared with customers and prospects under a non-disclosure agreement, while an ISO 27001 certificate is normally a public document.

What is the difference between SOC 2 Type 1 and Type 2?

A Type 1 report assesses whether controls are suitably designed at a single point in time. A Type 2 report also tests whether those controls operated effectively over a review period, usually several months. Buyers generally prefer Type 2 because it shows sustained operation. Some companies start with Type 1 to get a report sooner, then move to Type 2.

Should a Swedish SaaS company start with ISO 27001 or SOC 2?

Start with the framework your customers ask for. For most Swedish SaaS companies selling mainly in Europe, that is ISO 27001, which also helps structure work under the Swedish Cybersecurity Act. If key prospects are in North America, plan a SOC 2 Type 2 as well, and reuse the same control set and evidence for both.

ISO 27001 or SOC 2: which one do your customers expect?

What is the difference between ISO 27001 and SOC 2?