Comparison · US and international
SOC 2 vs ISO 27001
The AICPA's SOC 2 attestation report and the ISO/IEC 27001:2022 certification side by side, on the same criteria, with the Trust Services Criteria reference or clause behind every cell. Written for an Indian company that holds one and is being asked for the other, usually by a US customer or an Indian regulator.
Sources: AICPA, System and Organization Controls: SOC suite of services; AICPA, 2017 Trust Services Criteria with revised points of focus (2022); AICPA, SOC 2 Reporting on an Examination of Controls at a Service Organization (guide, Oct 2022); ISO/IEC 27001:2022, Information security management systems: Requirements
Side by side
Thirteen criteria, reviewed 4 Nov 2026. Each cell names its source. Scroll sideways on a phone.
| Criterion | SOC 2 (AICPA) | ISO/IEC 27001:2022 |
|---|---|---|
| What it is | An attestation report, not a certificate. A licensed CPA firm examines a service organisation's description of its system and its controls against the Trust Services Criteria, and gives an opinion on management's assertion.AT-C section 205; TSC 2017 | A certifiable management system standard. An accredited certification body audits the organisation's information security management system (ISMS) against clauses 4 to 10 and issues a certificate for a defined scope.clauses 4 to 10; ISO/IEC 17021-1 |
| Who issues it | A CPA firm licensed in the United States and independent of the service organisation. The AICPA writes the criteria and the attestation standards; it does not issue or register reports.AT-C section 205 | A certification body, normally accredited under ISO/IEC 17021-1 by a national accreditation body (in India, NABCB under the Quality Council of India). ISO itself does not certify anyone.ISO/IEC 17021-1 |
| What you receive | A restricted-use report: the auditor's opinion, management's assertion, the system description and, in a Type 2, the tests performed and their results. Shared with customers under NDA. The general-use summary is a SOC 3.AICPA SOC 2 guide (Oct 2022) | A certificate naming the organisation, the scope, the sites and the edition of the standard, usually verifiable with the certification body. The audit reports behind it stay private.ISO/IEC 17021-1 |
| Types or stages | Type 1: the design of controls at a point in time. Type 2: design and operating effectiveness over a review period that the service organisation chooses.AICPA SOC 2 guide (Oct 2022) | Stage 1 (readiness and documentation) and Stage 2 (implementation) make up the initial audit; then surveillance audits during the cycle and a recertification audit before the certificate expires.ISO/IEC 17021-1, clause 9 |
| Criteria or controls | Trust Services Criteria 2017 with 2022 points of focus. Security (common criteria CC1 to CC9) is always in scope; Availability, Processing Integrity, Confidentiality and Privacy are added by choice.TSC 2017 (2022 points of focus) | 93 reference controls in Annex A, in four themes: organisational (37), people (8), physical (14) and technological (34). You decide which apply and record the reasons for exclusions in the Statement of Applicability.clause 6.1.3; Annex A |
| Risk assessment | A criterion, not a method: specify objectives, identify and analyse risks including fraud risk, and assess changes that could affect controls.TSC CC3.1 to CC3.4 | A documented risk assessment process with acceptance criteria and risk owners, a risk treatment plan, and repetition at planned intervals or on significant change.clauses 6.1.2, 6.1.3, 8.2, 8.3 |
| Access control | Logical and physical access: identify and authenticate users, authorise and restrict access to data and assets, remove access on termination, and protect against external threats.TSC CC6.1 to CC6.8 | Access control policy, identity management, authentication information, access rights, privileged access rights, information access restriction and secure authentication.Annex A 5.15 to 5.18, 8.2 to 8.5 |
| Incident response | Monitor for anomalies, evaluate security events, respond to identified incidents and recover from them.TSC CC7.2 to CC7.5 | Incident management planning and preparation, assessment of events, response, learning from incidents and collection of evidence.Annex A 5.24 to 5.28 |
| Vendors and subprocessors | Vendor and business partner risk is a criterion. Subservice organisations are either included in the report or carved out, with the complementary controls they must operate listed in the description.TSC CC9.2; AICPA SOC 2 guide (Oct 2022) | Supplier relationships, security terms in supplier agreements, the ICT supply chain, monitoring and change of supplier services, and use of cloud services.Annex A 5.19 to 5.23 |
| How long it holds | The opinion speaks to the review period only. There is no expiry date and no renewal; customers ask for a fresh report each cycle.AT-C section 205 | The certificate runs for a fixed cycle and is kept valid by surveillance audits, then renewed by recertification; a missed surveillance audit can suspend it.ISO/IEC 17021-1, clause 9.6 |
| Who asks for it | Customers and business partners of a service organisation who want to understand its controls, and their auditors. In practice US enterprise and SaaS procurement.AICPA SOC suite of services | Buyers in any market, public tenders and Indian regulators that name it. SEBI's Cybersecurity and Cyber Resilience Framework requires ISO 27001 certification for market infrastructure institutions and qualified regulated entities.SEBI circular CIR/2024/113 (CSCRF), 20 Aug 2024 |
| Public claim you can make | There is no certificate, so there is no 'SOC 2 certified'. You can say you hold a SOC 2 Type 1 or Type 2 report for a stated period and share it under NDA.AT-C section 205 | You can say you are certified to ISO/IEC 27001:2022 for the stated scope, and show the certificate and the certification body's accreditation mark.ISO/IEC 17021-1 |
| Edition and dates | TSC 2017, points of focus revised in 2022; the SOC 2 guide was updated to 15 Oct 2022 for SSAE 20 and 21. The AICPA has exposure drafts out for revised criteria proposed for 2027.AICPA SOC suite of services; TSC 2017 (2022) | Third edition published 25 Oct 2022; Amd 1:2024 added climate change wording. The transition from the 2013 edition ended on 31 Oct 2025, so 2013 certificates are no longer valid.ISO/IEC 27001:2022; Amd 1:2024 |
The differences that matter
A report versus a certificate
SOC 2 ends in an opinion from a CPA firm on how your controls were designed and, for a Type 2, how they operated over a period. ISO 27001 ends in a certificate that says your management system meets the standard for a scope. One is evidence a customer reads; the other is a credential you display. Indian buyers and regulators ask for the certificate; US buyers ask for the report.
Criteria you meet versus controls you choose
The Trust Services Criteria are outcomes: every criterion in scope must be met, and the auditor tests whatever controls you point to. ISO 27001 asks you to run a risk assessment, pick controls (Annex A is the checklist, not the mandate) and justify every exclusion in a Statement of Applicability. The paperwork of clauses 4 to 10 (policy, roles, objectives, internal audit, management review, corrective action) has no SOC 2 equivalent.
The management system is the extra work
A company with a clean SOC 2 Type 2 usually has most Annex A controls in place already. What it lacks is the ISMS: documented scope, risk methodology, measurable objectives, an internal audit programme under clause 9.2 and management reviews under clause 9.3. Going the other way, an ISO-certified company adds the system description, management's assertion and a period of evidence an auditor can sample.
Public verification
An ISO certificate is public and can be checked with the certification body and its accreditation body. A SOC 2 report is restricted-use: it travels under NDA and there is no register. If a vendor tells you it is 'SOC 2 certified', ask for the report and the auditor's name instead.
Questions
We have a SOC 2 Type 2. Do we still need ISO 27001 for India?
Only if a buyer or regulator names it. SEBI's CSCRF requires ISO 27001 certification for market infrastructure institutions and qualified regulated entities, and many Indian enterprise and government tenders list it. Neither the DPDP Act nor the CERT-In Directions require any certification; DPDP asks for reasonable security safeguards under s. 8(5) and Rule 6, which either framework can evidence.
Can one audit cover both?
Partly. The AICPA allows a SOC 2 report with additional subject matter (often called SOC 2+) that reports on criteria from another framework alongside the TSC. The ISO certificate still needs an accredited certification body's own Stage 1, Stage 2 and surveillance audits; a CPA firm's SOC 2 opinion cannot substitute for them.
Does ISO 27001 cover privacy?
Not on its own. ISO 27001 is information security. Privacy controls are in ISO/IEC 27701, the privacy information management extension to 27001 and 27002. SOC 2 has an optional Privacy category (P1 to P8) that can be added to the Security criteria.
Which one should an Indian SaaS startup do first?
Follow the customer. If the pipeline is US enterprise, SOC 2 Type 1 then Type 2. If it is Indian BFSI, government or EU and Middle East tenders, ISO 27001. The controls overlap heavily, so the second one is mostly documentation and an extra audit rather than new engineering.
Read next
This page explains the law in plain English. It is not legal advice.
Weekly · Watching 6 regulators