SOC 2 vs ISO 27001: what they mean for a small vendor

SOC 2 is a report: an independent auditor tests a vendor's security controls against criteria set by the AICPA. ISO 27001 certification is a certificate: an accredited body confirms the vendor runs a security management system that meets an international standard. Both are evidence, not proof of safety.

If you buy software for a small business, these two names show up in security questionnaires, sales pages and procurement checklists. If you sell software, a larger customer will sooner or later ask which one you have. This guide explains what each one is, how they differ, and what a reasonable buyer can ask a small vendor that has neither yet.

SOC 2 and ISO 27001 side by side

	SOC 2	ISO 27001
What it is	An attestation report on controls	A certification of a management system
Who sets the rules	The AICPA (Trust Services Criteria)	ISO and IEC (ISO/IEC 27001:2022)
Who checks	An independent CPA firm	An accredited certification body
What you receive	A detailed report, usually under NDA	A certificate plus a defined scope
How long it lasts	Covers a past period; usually repeated each year	Generally three years, with yearly surveillance audits
Where it is asked for more often	North America	Europe and internationally

The regional pattern is a tendency, not a rule. Many vendors that sell on both sides of the Atlantic end up with both, and the controls behind them overlap heavily.

What a SOC 2 report actually says

SOC 2 was created by the AICPA, the professional body for accountants in the United States. A CPA firm examines how a service organization protects the systems it uses to serve customers, measured against the Trust Services Criteria. There are five categories:

• Security, always in scope, sometimes called the common criteria.
• Availability, for vendors whose customers depend on uptime commitments.
• Processing integrity, for systems where complete and accurate processing is the product.
• Confidentiality, for information the vendor has agreed to keep confidential.
• Privacy, for how personal information is collected, used and disposed of.

The vendor chooses which of the four optional categories to include. A report that covers security alone is common and perfectly valid, but it tells you nothing about the other four.

Type 1 and Type 2

A Type 1 report describes the controls and says whether they were suitably designed on one date. A Type 2 report goes further: the auditor tests whether the controls actually operated over a period, typically between three and twelve months, and lists any exceptions found. Buyers generally treat Type 2 as the stronger evidence, because a control that looks good on paper and a control that worked every week for six months are different things.

A SOC 2 report is a restricted-use document. Vendors usually share it under a non-disclosure agreement. A SOC 3 report is a shorter, general-use summary that can be published, but it leaves out the detail a security reviewer wants.

What ISO 27001 certification covers

ISO/IEC 27001:2022 sets requirements for an information security management system, or ISMS: the policies, risk assessments, responsibilities and reviews an organization uses to manage security over time. The emphasis is on the system. A certificate for an ISMS shows that the organization identifies its risks, picks controls to treat them, measures how they work and improves them.

Annex A of the 2022 edition lists 93 reference controls in four themes: organizational, people, physical and technological. The organization records in its Statement of Applicability which controls it applies and why it excludes any. The transition period for certificates against the older 2013 edition ended in October 2025, so a current certificate should name the 2022 edition.

Certification follows a two-stage audit by an accredited certification body: a review of the documentation, then an audit of how the system works in practice. The certificate is generally valid for three years, with surveillance audits in between, usually once a year.

Scope is where the real answer lives

Both frameworks are scoped. A SOC 2 report describes a specific system; an ISO 27001 certificate names a specific scope, such as one product, one office or one team. A vendor can truthfully say it has a report or a certificate that does not cover the service you are buying.

1. Read the scope statement. Check that the product, the hosting environment and the teams that operate it are inside it.
2. Check the dates. A SOC 2 period that ended a year ago is stale. Ask for a bridge letter that covers the gap to today.
3. Check who issued it. For ISO 27001, the certification body should be accredited. For SOC 2, the report should come from an independent CPA firm.
4. Read the exceptions. In a Type 2 report, exceptions and the vendor's responses say more than the summary opinion.
5. Look at the subservice organizations. Many vendors rely on hosting and other providers; check which ones are carved out and whether they have their own reports.

When a small vendor has neither

Neither SOC 2 nor ISO 27001 is generally a legal requirement. They are usually requested by customers, in contracts and security reviews, and the audit effort can be heavy for a small team. A vendor without either is not unsafe by default; you simply need other evidence. Reasonable questions include:

• How are passwords stored, and is a second factor available at sign-in? The guides to how passwords should be stored and to two-factor authentication and passkeys explain what good answers sound like.
• Is there a record of who changed what, and when? See what an audit trail should capture.
• Where is data stored and processed, and which subprocessors are involved? The guide to questions to ask vendors about where business data is stored covers this.
• How does the vendor handle personal data under the privacy law that applies to you? The guide to GDPR questions to ask a software vendor lists the basics.
• Who can reach production data, how is that access reviewed, and how quickly would you be told about an incident?

Written, specific answers to those questions often tell a small buyer more than a logo on a pricing page.

Frequently asked questions

Is SOC 2 a certification?

Not formally. SOC 2 is an attestation: a CPA firm issues a report with an opinion on the controls. People often speak of SOC 2 certification informally, but there is no SOC 2 certificate, which is why buyers ask to see the report itself.

Which is better for a small SaaS company, SOC 2 or ISO 27001?

It generally depends on who the customers are. Buyers in North America more often ask for SOC 2, and buyers in Europe and elsewhere more often ask for ISO 27001. Many companies start with the one their largest prospects request, then map the same controls to the other.

How long is an ISO 27001 certificate valid?

Generally three years. The certification body runs surveillance audits in between, usually once a year, and a recertification audit before the certificate expires. A certificate is worth checking against the issuing body's records.

Can I ask a vendor for their SOC 2 report?

Yes. Vendors that have one usually share it with prospective customers under a non-disclosure agreement. If the report period ended some months ago, ask for a bridge letter as well.