Security glossary

SOC 2 vs ISO 27001

Both show that you take information security seriously, and customers often ask for one or the other. But they come from different worlds (a US accounting framework and an international standard) and are proven in different ways. No consultancy can simply hand you either of them.

SOC 2: an attestation report

SOC 2 is an examination against the AICPA Trust Services Criteria: Security (the mandatory Common Criteria) plus optional Availability, Processing Integrity, Confidentiality and Privacy. The result is a report, prepared and issued by an independent licensed CPA firm. A Type I report assesses the design of controls at a point in time; a Type II report assesses how well they operate over a period (usually 3-12 months). SaaS vendors are widely expected to have one, especially in the US.

ISO 27001: a certifiable standard

ISO/IEC 27001:2022 is an international standard for an Information Security Management System (ISMS). You build a management system (clauses 4-10) and select controls from Annex A (93 controls across four themes). An accredited certification body then audits it in two stages and, if you pass, issues a certificate valid for three years, with surveillance audits in between. It is recognised worldwide and often preferred outside the US.

How they differ

SOC 2 produces a detailed report that a customer reads under NDA; ISO 27001 produces a certificate plus a Statement of Applicability. SOC 2 is attested by a CPA firm against the Trust Services Criteria; ISO 27001 is certified by an accredited body against the standard. The underlying controls overlap heavily, so many organisations pursue both and reuse evidence. The two ways of proving it, though, are separate and independent.

Where a consultancy fits (and doesn't)

This is the important part. A consultancy can get you ready with a gap assessment, controls, policies, internal audit and the penetration testing that evidences technical controls. It cannot issue the SOC 2 report or the ISO 27001 certificate. Those must come from an independent CPA firm and an accredited certification body respectively. Vexaro provides readiness and the supporting pentest; the attestation always comes from the independent assessor.

Frequently asked questions

SOC 2 is an examination against the AICPA Trust Services Criteria, with the output a report issued by an independent licensed CPA firm. ISO/IEC 27001:2022 is an international standard for an Information Security Management System, certified by an accredited body that issues a certificate valid for three years with surveillance audits.

No. A consultancy can get you ready with a gap assessment, controls, policies, internal audit and the penetration testing that evidences technical controls, but it cannot issue the SOC 2 report or the ISO 27001 certificate. Those must come from an independent CPA firm and an accredited certification body respectively.

A Type I report assesses the design of controls at a single point in time; a Type II report assesses how well they operate over a period, usually 3-12 months.

Talk to a real practitioner.

Got a question these pages didn't answer? Tell us what you're trying to protect and we'll point you to the right engagement. The first consultation is free.