Choosing an order
One framework to start: SOC 2, or ISO 27001?
Most growing companies end up with both. The real decision is the order, and it should follow evidence you already have: who is asking, in which market, and what your team can sustain. Answer six questions below and the first framework usually picks itself.
Back to SOC 2 services01 · Six questions
Six questions, in order
Stop at the first question that gives a clear answer.
- Is a signed deal blocked on one of them by name? If a contract or security review names one framework, do that one first. Nothing else outranks a written requirement.
- Where are your next ten target customers? A pipeline weighted to US buyers leans SOC 2; one weighted to Europe, the UK, the Middle East or Asia leans ISO/IEC 27001.
- Do buyers send you questionnaires or tender forms? Questionnaires that ask for an auditor's report lean SOC 2; public-sector or procurement tenders that ask for an accredited certificate lean ISO 27001.
- What do you want the result to prove? SOC 2 proves specific controls operated across a period. ISO 27001 proves you run a management system that finds and treats risk.
- What already exists? A working risk register, policy set and internal audit habit make ISO 27001 lighter. Strong ticketing, logged approvals and access reviews make SOC 2 lighter.
- Who will carry it? A very small team often finds one period of disciplined evidence easier to start than a full management system, but neither is optional work.
The side-by-side comparison of the two frameworks lives on the SOC 2 vs ISO 27001 page. This page only helps you choose an order.
02 · Decision table
A decision table for common situations
Illustrative profiles, not rules.
| Illustrative situation | Lean toward first | Why |
|---|---|---|
| Seed-stage SaaS selling to US mid-market tech firms | SOC 2 | Buyers ask for the report by name in security reviews. |
| B2B platform selling to European banks and insurers | ISO 27001 | Procurement usually lists an accredited certificate. |
| Services firm answering government tenders in India or the Gulf | ISO 27001 | Tender forms commonly ask for the certificate number and scope. |
| US healthtech handling patient data for clinics | SOC 2 | Buyers want control-level detail alongside HIPAA questions. |
| Company with half its pipeline in each region | Either, on one control set | Build mapped controls once; pick the audit whose deal closes first. |
| Team with no policies, no risk register, no logging | Readiness first | Neither audit will go well until the basics exist. |
03 · What each proves
What each result tells a buyer
Different questions, both useful.
SOC 2 Type 2 answers
- Did these controls operate across this period?
- Which tests failed, and how often?
- What must the customer do (CUECs)?
- Which vendors were carved out?
ISO 27001 answers
- Does the company run a risk-based management system?
- Is the scope certified by an accredited body?
- Is the system reviewed and improved each year?
- Which Annex A controls apply, per the Statement of Applicability?
04 · Carry-over
How the first carries into the second
Controls transfer well. Artefacts and audit style need new work.
- SOC 2 first, then ISO 27001Your controls and evidence habits are ready. Add the ISMS scope, a formal risk assessment and treatment method, the Statement of Applicability, an internal audit and a management review.
- ISO 27001 first, then SOC 2Your risk process and policies are ready. Add a system description to DC 200, a choice of categories, CUECs and CSOCs, and evidence that each control ran every time across a period.
- Either wayKeep one control library mapped to both: one access review, one change process, one vendor review, tagged to each framework.
Plan the second framework when you plan the first. Writing each control once, with both references attached, costs little at the start and avoids a second rewrite of policies later.
05 · Pitfalls
Ordering mistakes
The order goes wrong when it follows habit rather than buyers.
- Choosing by what a competitor has. Their buyers may not be yours. Ask your own pipeline.
- Starting both audits at once. Two audit calendars on a small team usually means two weak results.
- Treating the second as a fresh project. Rewriting policies from scratch for the second framework doubles the work.
- Picking ISO because a certificate sounds stronger. US security reviewers often still ask for SOC 2 after seeing a certificate.
Sources: AICPA Trust Services Criteria TSP section 100; AICPA description criteria DC section 200; AICPA Guide, SOC 2 Reporting on an Examination of Controls at a Service Organization; ISO/IEC 27001:2022 clauses 4 to 10 and Annex A; ISO/IEC 17021-1.
Questions about ordering the two
We have customers in both regions. Is there a sensible default?
Follow the deal that closes first.
Build one mapped control set, then choose the audit tied to the largest near-term deal. The second framework reuses most of the control work.
Does ISO 27001 certification satisfy a buyer who asked for SOC 2?
Sometimes, not reliably.
Some reviewers accept it with a mapping; others need the SOC 2 report specifically because it shows period testing and exceptions. Ask the buyer before assuming.
Can a Type 1 SOC 2 buy time while we build ISO 27001?
It can open a door, not hold it.
A Type 1 shows design at a date. Many buyers accept it once, then expect a Type 2. Plan the Type 2 period alongside the ISO work.
Which one is easier to keep up afterwards?
Neither is light.
SOC 2 needs evidence for every period; ISO 27001 needs surveillance audits and a living management system. Both reward running controls as routine, not as projects.
Choose the order once, build the controls once.
We map one control library to both frameworks so the second audit reuses the first.