SOC 2 vs ISO 27001
SOC 2 vs ISO 27001: Which Comes First
acme.com · 7 min read
Key takeaways
- SOC 2 ends in an attestation report from a CPA firm.
- ISO 27001 ends in a certificate from an accredited body.
- US buyers often ask for SOC 2 first.
What each one is
SOC 2 is an attestation framework from the American Institute of CPAs, and a licensed CPA firm writes the report1. ISO/IEC 27001 is an international standard for an information security management system, and an accredited body certifies it2.
| SOC 2 | ISO 27001 | |
|---|---|---|
| Issued by | CPA firm | Accredited body |
| You get | Attestation report | Certificate |
| Set by | AICPA | ISO and IEC |
Which to start with
US buyers often ask for SOC 2, so a US SaaS team often starts there.
