Standards
SOC 2 or ISO 27001: a CPA's report or an accredited certificate
The one to get is the one your customer asks for. SOC 2 is a report on your controls, written by a licensed, independent CPA under the AICPA's standards. ISO 27001 is a standard for running information security as a management system, and a certificate to it comes from a certification body after its own audits.
By Oscar CobbeCurrent as at 4 minute read9 sources
Side by side
SOC 2 comes from the American Institute of CPAs (AICPA), which sets its rules. ISO 27001 is an international standard, published in Ireland by NSAI, and INAB, the Irish National Accreditation Board, accredits certification bodies. From their own pages:
| SOC 2 | ISO 27001 | |
|---|---|---|
| What it is | An examination of a service organisation's description of its system and of its controls | A standard setting the requirements for an information security management system |
| Who carries it out | A licensed, independent CPA, under the AICPA's attestation standards | A certification body, such as NSAI, which provides accredited certification |
| What the business receives | A report, Type 1 or Type 2 | A certificate, after a stage 1 and a stage 2 audit, followed by surveillance audits |
| Measured against | The AICPA's Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy | The standard's requirements, with the controls from Annex A's 93 that the business's risk treatment selects |
SOC 2: a report on your controls
In the AICPA's words, SOC 2 is an examination performed by a licensed, independent CPA under the AICPA Attestation Standards that evaluates controls relevant to the security, availability, processing integrity, confidentiality or privacy of an organisation's systems. What the business receives is the CPA's report.
The criteria are the AICPA's Trust Services Criteria. The current set is the 2017 Trust Services Criteria, with points of focus revised in 2022, established by the AICPA's Assurance Services Executive Committee for evaluating and reporting on controls over the security, availability, processing integrity, confidentiality or privacy of information and systems.
A SOC 2 report is a Type 1 or a Type 2. The AICPA's illustrative Type 2 report contains management's assertion, the description of the system, the service auditor's report, and the auditor's tests of controls with their results. When a customer asks for a SOC 2 report, ask which type, and which of the five areas it should cover.
A SOC 2 report goes into detail. The AICPA's report for general use is SOC 3, which addresses the same five areas without the same level of detail, and for that reason, the AICPA says, can be freely distributed.
The criteria are changing. In October 2026 the AICPA proposed new Trust Services Criteria for 2027, open for comment until 15 January 2027. If they are approved, they would apply to engagements beginning on or after 31 December 2027, with early adoption allowed.
Check who signs the report. The AICPA's SOC page carries a notice that it is looking into anonymous allegations about a compliance vendor that offers SOC services. It says it will act with respect to its members if the auditors involved are found not to have followed professional standards, not to have been enrolled in peer review, or to be unlicensed, and it asks service organisations to evaluate SOC services thoroughly.
ISO 27001: a certificate from an accredited body
NSAI publishes the standard in Ireland as I.S. EN ISO/IEC 27001:2023, an identical adoption of the international ISO/IEC 27001:2022. It says the standard specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system, and that the requirements apply to any organisation, regardless of size, sector or complexity. Annex A lists 93 controls under four themes, and a business puts in place the ones its documented risk treatment calls for.
Certification is done by certification bodies. INAB accredits certification bodies to ISO/IEC 17021-1, supplemented for ISO 27001 by ISO/IEC 27006, and strongly mandates that the bodies it accredits use its accreditation symbol on their certificates. NSAI, which provides accredited certification to the standard, describes the process as an application and quotation, a stage 1 audit, a stage 2 audit, surveillance audits after that, and recertification at defined intervals.
ISO 27001 in plain words covers what the standard asks of a business, the Statement of Applicability, and why a certificate to the 2013 edition is no longer valid.
Which one to get
The AICPA's description of its SOC 2 guide says customers and business partners often request a SOC 2 report from a service organisation, to identify, assess and address the risks of using it. NSAI gives conformity with contractual requirements, and credibility when tendering for contracts, among the benefits of ISO 27001 certification.
Get the request in writing, and ask the questions that change the work. For SOC 2: which type, and which of the five areas. For ISO 27001: which parts of the business the certificate must cover, and whether a certificate is needed at all. If the customer is covered by NIS2, the questions a NIS2 customer asks its suppliers sets out where its requests come from, and CyFun, ISO 27001 or Cyber Essentials covers the other standards an Irish customer may name.
Two different suppliers
A SOC 2 report comes from a licensed CPA, and an ISO 27001 certificate from a certification body. Settle which one the customer wants, and for what, before engaging either.
Sources
- 1.AICPA Proposes Update of SOC 2 Trust Services Criteria to Enhance the Relevance, Usability and Value of CPAs' Reports · American Institute of CPAs (AICPA)
- 2.ISO/IEC 27001 Information Security Management · NSAI
- 3.Accreditation of Management Systems Certification · Irish National Accreditation Board
- 4.SOC 2 Reporting on an Examination of Controls at a Service Organization (guide, publication page) · American Institute of CPAs (AICPA)
- 5.Illustrative Management Representation Letter: SOC 2 Type 1 · American Institute of CPAs (AICPA)
- 6.Illustrative SOC 2 Report with Illustrative System Description · American Institute of CPAs (AICPA)
- 7.2017 Trust Services Criteria (With Revised Points of Focus, 2022) · American Institute of CPAs (AICPA)
- 8.SOC 3: SOC for Service Organizations, Trust Services Criteria for General Use Report · American Institute of CPAs (AICPA)
- 9.System and Organization Controls: SOC Suite of Services · American Institute of CPAs (AICPA)
When a customer has asked for ISO 27001
ISO 27001 readiness is the work before a certification body's audit: the scope, the risk assessment and the Statement of Applicability, with each of the 93 Annex A controls marked applicable or excluded with a written reason, and the applicable ones scored on the evidence you hold. The certificate itself comes from an accredited certification body, after its own audit.
ISO 27001 readinessWho wrote this
Oscar Cobbe · Founder, FourWinds Digital
Writes and maintains the legal explainers on this site, and does the compliance work behind them. Every date and article number here is checked against the legislation itself before it is published, and each article shows the date it was last checked.
More about how we work →Read next
- StandardsISO 27001 in plain words: what it asks of a business, and what certification means
- Cyber securityA customer wants a security standard. CyFun, ISO 27001 or Cyber Essentials?
- NIS2Your customer is under NIS2. What they will ask you, the supplier
Written on 30 October 2026; it describes the law as FourWinds read it on that date. This is general information about how the rules work, not legal advice on your situation. Where you need a solicitor, we say so. How we check the law.