ISO 27001
One control set, two audits, and the seams between them.
You have decided to hold both. The question now is operational: how to run one programme so the certification body and the CPA firm each get what they need without your team doing the work twice. This page covers the mapping, the shared calendar and the places where reuse quietly breaks.
Back to ISO 27001 services01 · Control mapping
Start from one control register, not two
Write each control once, then tag it to both frameworks.
The difference in kind between a certificate and an attestation is covered in our SOC 2 vs ISO 27001 comparison. Here the concern is mechanics. The cleanest approach is a single register of your own controls, each written in your own words, with two columns of references: the Annex A control it supports and the Trust Services Criteria point it addresses.
- List the controls you actually run, in plain language, with one owner each.
- Tag each one to Annex A for the SoA and to the criteria for the SOC 2 control matrix.
- Mark gaps on each side: Annex A controls with no SOC 2 counterpart, and criteria with no Annex A counterpart.
- Write one evidence instruction per control that satisfies the stricter of the two audits.
- Review the register at the management review so both frameworks change together.
03 · Timing models
Point-in-time stages against an observation period
The two audits look at time differently, and your calendar has to respect both.
ISO 27001
Stage audits on dates
- Stage 1 reviews readiness and documents
- Stage 2 tests that the ISMS operates
- Surveillance audits in each following year
- Recertification in the third year
SOC 2 Type 2
A window of operation
- An observation period agreed in advance
- Every occurrence inside it can be sampled
- A report issued after the period ends
- A new period usually starts straight after
An ISO audit asks whether the system works now and has been working. A Type 2 asks whether each control worked throughout a defined window.
04 · Audit calendar
A calendar that lets one quarter feed both
Align the SOC 2 period end with the ISO audit month and most evidence is pulled once.
- Anchor month
- Pick a month for the ISO surveillance or recertification audit. Let the SOC 2 period end shortly before it, so the same quarter's evidence serves both.
- Recurring controls
- Access reviews, backup tests and training run on fixed dates set once for both audits.
- Internal audit
- Schedule it before the ISO audit and cover the SOC 2 controls too; the findings help both.
- Management review
- Hold it after the internal audit, with SOC 2 exceptions on the agenda as an input.
- Penetration test
- Place it inside the SOC 2 period and early enough that fixes close before the ISO audit.
05 · Reuse traps
Where evidence reuse goes wrong
Most problems come from assuming one auditor's acceptance carries to the other.
- Evidence outside the period. A screenshot that satisfied the ISO auditor may predate the SOC 2 window and count for nothing there.
- Scope mismatch. A system inside the SOC 2 boundary but outside the ISMS scope still needs ISO-grade controls if customers assume it is covered.
- One sample treated as a population. ISO auditors often sample lightly; SOC 2 sampling across a period can find the gaps ISO did not.
- Copying the SoA into the system description. The two documents serve different readers; a description written like an SoA will not meet the description criteria.
- Two trackers for one finding. Keep one nonconformity and exception log, tagged to both, or the follow-up drifts apart.
Sources: ISO/IEC 27001:2022 clause titles (4 to 10) and Annex A names; ISO/IEC 17021-1 on initial certification and surveillance audits; AICPA Trust Services Criteria (TSP section 100) and Description Criteria (DC section 200), named at a general level.
Questions about running both
Should the ISMS scope and the SOC 2 boundary be the same?
Not necessarily, but differences must be deliberate.
Aligning them makes evidence reuse simple. Some companies certify a wider ISMS and report on one product under SOC 2. That works if you can explain the difference to a buyer who holds both documents side by side.
Can the same firm do both audits?
Only if it holds both roles independently.
An accredited certification body issues the ISO certificate; a licensed CPA firm issues the SOC 2 report. Some groups have both arms. Either way, the firm that helped you build controls should not audit them.
Does an ISO certificate reduce SOC 2 testing?
Not formally. It helps readiness, not sample sizes.
The CPA firm forms its own opinion from its own testing. A working ISMS makes that testing smoother because evidence already exists, but the examiner does not rely on the certification body's conclusions.
Which comes first if we start from nothing?
Follow your buyers. Our decision page covers it.
The order depends on where your customers are and what they ask for by name. Our page on choosing your first framework walks through that decision; this page assumes you already plan to hold both.
Build the register once.
An ISO 27001 gap analysis from Auditify can include a SOC 2 mapping, so one control register and one calendar serve both audits.