US customers ask for a SOC 2 report; international customers ask for an ISO 27001 certificate. Companies selling in both markets often end up needing both — and the ones that run them as separate projects do roughly twice the work for the same security posture.
Where the frameworks overlap
The substance is largely shared: access control, change management, incident response, vendor management, business continuity, logging and monitoring. A well-implemented control — say, role-based access reviewed quarterly — satisfies SOC 2's CC6 series and ISO 27001's Annex A access controls with the same evidence. Sensible estimates put the overlap at well over half of either framework.
Where they genuinely differ
- ISO 27001 certifies a management system (the ISMS): risk methodology, Statement of Applicability, internal audit, management review.
- SOC 2 is an attestation over time: a Type II report covers how controls operated across an observation window, not just how they were designed.
- ISO ends in a certificate; SOC 2 ends in a detailed report your customers actually read.
How to run a unified program
- Build one control set, mapped to both frameworks from day one — not two lists reconciled later.
- Collect evidence once, tagged for both: the same access review exports serve the auditor and the certification body.
- Align the calendars so the ISO surveillance audit and the SOC 2 observation window share preparation.
- Let the ISMS risk assessment double as the SOC 2 risk assessment — one methodology, one register.
Sequencing matters less than integration: whichever you start with, design the control set for both and the second framework becomes an increment, not a second program.
