ISO 27001 or SOC 2: which does your customer want?

Part of the guide What does ISO 27001 certification take, and who can certify you?

What is the difference between ISO 27001 and SOC 2?

ISO 27001 is a standard for managing information security. Certification means an independent body confirms that specified requirements have been met. ISO writes standards, but external certification bodies issue the certificates.

SOC 2 examines the service provider’s description of its system and the controls within it. Controls are the measures used to protect or manage the service. The examination can concern security, availability, processing integrity, confidentiality or privacy.

Which document does your customer need?

The customer needs to confirm that. Start with the words in the request or contract. If they are unclear, ask what evidence is required and whether the document you have would meet the need.

UK National Cyber Security Centre guidance, known as the NCSC, says security requirements should match the risks and be achievable. Suppliers should check that customers are happy with the measures they propose.

Does the scope cover the service you are buying?

Check the scope, meaning the work and systems covered. The NCSC says a certificate should cover the parts of the service you will use and how you will use them.

For a SOC 2 report, compare the system and controls described with the questions you need answered. The name on the document is only the starting point for that review.

Who can issue an ISO 27001 certificate?

An external certification body issues the certificate. UKAS accredits bodies for this work, which means checking their competence. UKAS and the certification body have different roles.

When choosing a body, ISO recommends comparing several and checking whether they are accredited. Check the body as well as the standard named in its offer.

Is preparation included in the final examination?

Check whether preparation includes the final examination or certification. Ask the firm who will do each part.

The Assurance Desk recorded Cyber Defense Group’s website on 5 October 2026. Its services included roadmaps, gap assessments and implementation support for SOC 2 and ISO 27001. This was the firm’s own description of its services.

What if you have neither document?

If you have neither document, ask what evidence the customer needs. Explain your current position, and do not promise a substitute will be accepted. Confirm the requirements you must meet before agreeing the work.

What to do

1. Ask which document the customer requires.
2. Match the evidence to the service and the customer’s questions.
3. Confirm who will do the examination or certification.
4. Record the agreed security requirements in the contract.

Common questions

Can ISO 27001 replace a SOC 2 report?

Ask the customer before making that substitution. They are different forms of evidence, and the customer needs to confirm what meets their requirements.

Does ISO issue ISO 27001 certificates?

No. External certification bodies issue certificates. ISO does not perform certification.

Do we need both documents?

Start with the requirements you have to meet. Ask customers to clarify what evidence they need before committing to either or both.

Where next

• What does ISO 27001 certification take, and who can certify you?
• How do you check an ISO certificate is genuine?
• Customer security questionnaires: what they ask and how to answer
• How do you answer a security questionnaire without a certificate?
• SOC 2: what is it, and who asks for it?

This is an independent editorial guide, not legal advice.