# ISO 27001 or SOC 2: which does your customer want? Check the customer’s request before choosing the certificate or report to work towards. The Assurance Desk. Published 8 October 2026. Last checked 8 October 2026. Part of the guide [What does ISO 27001 certification take, and who can certify you?](https://theassurancedesk.com/guides/iso-27001-certification-and-who-can-certify-you.md). **The short answer.** Ask the customer which document they require. ISO 27001 certification concerns information security management. A SOC 2 report covers an examination of a service provider’s system and controls. Check the request before offering one in place of the other ([UKAS, Accreditation of information security, cybersecurity and privacy protection](https://www.ukas.com/accreditation/sectors/digital/info-sec/), [committee.iso.org, ISO, Certification](https://committee.iso.org/certification.html), [aicpa-cima.com, SOC 2® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy, Publications, AICPA & CIMA](https://www.aicpa-cima.com/cpe-learning/publication/soc-2-reporting-on-an-examination-of-controls-at-a-service-organization-relevant-to-security-availability-processing-integrity-confidentiality-or-privacy) and [NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control), checked 8 October 2026). ## What is the difference between ISO 27001 and SOC 2? ISO 27001 is a standard for managing information security. Certification means an independent body confirms that specified requirements have been met. ISO writes standards, but external certification bodies issue the certificates ([UKAS, Accreditation of information security, cybersecurity and privacy protection](https://www.ukas.com/accreditation/sectors/digital/info-sec/) and [committee.iso.org, ISO, Certification](https://committee.iso.org/certification.html), checked 8 October 2026). SOC 2 examines the service provider’s description of its system and the controls within it. Controls are the measures used to protect or manage the service. The examination can concern security, availability, processing integrity, confidentiality or privacy ([aicpa-cima.com, SOC 2® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy, Publications, AICPA & CIMA](https://www.aicpa-cima.com/cpe-learning/publication/soc-2-reporting-on-an-examination-of-controls-at-a-service-organization-relevant-to-security-availability-processing-integrity-confidentiality-or-privacy), checked 8 October 2026). **Different documents for a customer to assess** | Question | ISO 27001 certification | SOC 2 report | | --- | --- | --- | | What is it? | Certification against an information security management standard. | A report following an examination of a service provider’s system and controls. | | Who does the work? | An external certification body. | An accountant carrying out the SOC 2 examination. | | What should the buyer check? | Whether the certificate covers the service being bought. | Whether the system and controls examined answer the buyer’s questions. | Source: UKAS, Accreditation of information security, cybersecurity and privacy protection, https://www.ukas.com/accreditation/sectors/digital/info-sec/ (checked 8 October 2026); committee.iso.org, ISO, Certification, https://committee.iso.org/certification.html (checked 8 October 2026); aicpa-cima.com, SOC 2® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy, Publications, AICPA & CIMA, https://www.aicpa-cima.com/cpe-learning/publication/soc-2-reporting-on-an-examination-of-controls-at-a-service-organization-relevant-to-security-availability-processing-integrity-confidentiality-or-privacy (checked 8 October 2026); NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control, https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control (checked 8 October 2026); NCSC, Supplier assurance questions, https://www.ncsc.gov.uk/guidance/supplier-assurance-questions (checked 8 October 2026) ## Which document does your customer need? The customer needs to confirm that. Start with the words in the request or contract. If they are unclear, ask what evidence is required and whether the document you have would meet the need ([NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control), checked 8 October 2026). UK National Cyber Security Centre guidance, known as the NCSC, says security requirements should match the risks and be achievable. Suppliers should check that customers are happy with the measures they propose ([NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control), checked 8 October 2026). **Turn the request into a clear requirement** 1. Ask what is required: Name the document the customer wants. 2. Check what it covers: Match the evidence to the service being bought. 3. Confirm what is accepted: Ask the customer to clarify any gaps. 4. Record the requirement: Make sure the contract reflects the agreed security needs. Use the customer’s requirements to guide the work. This sequence does not promise that either document will be accepted. Source: NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control, https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control (checked 8 October 2026); NCSC, Supplier assurance questions, https://www.ncsc.gov.uk/guidance/supplier-assurance-questions (checked 8 October 2026) ## Does the scope cover the service you are buying? Check the scope, meaning the work and systems covered. The NCSC says a certificate should cover the parts of the service you will use and how you will use them ([NCSC, Supplier assurance questions](https://www.ncsc.gov.uk/guidance/supplier-assurance-questions), checked 8 October 2026). For a SOC 2 report, compare the system and controls described with the questions you need answered. The name on the document is only the starting point for that review ([aicpa-cima.com, SOC 2® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy, Publications, AICPA & CIMA](https://www.aicpa-cima.com/cpe-learning/publication/soc-2-reporting-on-an-examination-of-controls-at-a-service-organization-relevant-to-security-availability-processing-integrity-confidentiality-or-privacy) and [NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control), checked 8 October 2026). ## Who can issue an ISO 27001 certificate? An external certification body issues the certificate. UKAS accredits bodies for this work, which means checking their competence. UKAS and the certification body have different roles ([UKAS, Accreditation of information security, cybersecurity and privacy protection](https://www.ukas.com/accreditation/sectors/digital/info-sec/) and [committee.iso.org, ISO, Certification](https://committee.iso.org/certification.html), checked 8 October 2026). When choosing a body, ISO recommends comparing several and checking whether they are accredited. Check the body as well as the standard named in its offer ([committee.iso.org, ISO, Certification](https://committee.iso.org/certification.html), checked 8 October 2026). > "Accreditation provides independent confirmation of competence." > ISO, Certification guidance > committee.iso.org, ISO, Certification, https://committee.iso.org/certification.html (checked 8 October 2026) ## Is preparation included in the final examination? Check whether preparation includes the final examination or certification. Ask the firm who will do each part ([committee.iso.org, ISO, Certification](https://committee.iso.org/certification.html), [aicpa-cima.com, SOC 2® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy, Publications, AICPA & CIMA](https://www.aicpa-cima.com/cpe-learning/publication/soc-2-reporting-on-an-examination-of-controls-at-a-service-organization-relevant-to-security-availability-processing-integrity-confidentiality-or-privacy) and [The Assurance Desk, Cyber Defense Group profile](https://theassurancedesk.com/advisers/cyber-defense-group), checked 8 October 2026). The Assurance Desk recorded Cyber Defense Group’s website on 5 October 2026. Its services included roadmaps, gap assessments and implementation support for SOC 2 and ISO 27001. This was the firm’s own description of its services ([The Assurance Desk, Cyber Defense Group profile](https://theassurancedesk.com/advisers/cyber-defense-group), checked 8 October 2026). ## What if you have neither document? If you have neither document, ask what evidence the customer needs. Explain your current position, and do not promise a substitute will be accepted. Confirm the requirements you must meet before agreeing the work ([NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control), checked 8 October 2026). ## What to do 1. Ask which document the customer requires ([NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control), checked 8 October 2026). 2. Match the evidence to the service and the customer’s questions ([aicpa-cima.com, SOC 2® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy, Publications, AICPA & CIMA](https://www.aicpa-cima.com/cpe-learning/publication/soc-2-reporting-on-an-examination-of-controls-at-a-service-organization-relevant-to-security-availability-processing-integrity-confidentiality-or-privacy), [NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control) and [NCSC, Supplier assurance questions](https://www.ncsc.gov.uk/guidance/supplier-assurance-questions), checked 8 October 2026). 3. Confirm who will do the examination or certification ([committee.iso.org, ISO, Certification](https://committee.iso.org/certification.html) and [aicpa-cima.com, SOC 2® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy, Publications, AICPA & CIMA](https://www.aicpa-cima.com/cpe-learning/publication/soc-2-reporting-on-an-examination-of-controls-at-a-service-organization-relevant-to-security-availability-processing-integrity-confidentiality-or-privacy), checked 8 October 2026). 4. Record the agreed security requirements in the contract ([NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control), checked 8 October 2026). ## Common questions ### Can ISO 27001 replace a SOC 2 report? Ask the customer before making that substitution. They are different forms of evidence, and the customer needs to confirm what meets their requirements ([UKAS, Accreditation of information security, cybersecurity and privacy protection](https://www.ukas.com/accreditation/sectors/digital/info-sec/), [committee.iso.org, ISO, Certification](https://committee.iso.org/certification.html), [aicpa-cima.com, SOC 2® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy, Publications, AICPA & CIMA](https://www.aicpa-cima.com/cpe-learning/publication/soc-2-reporting-on-an-examination-of-controls-at-a-service-organization-relevant-to-security-availability-processing-integrity-confidentiality-or-privacy) and [NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control), checked 8 October 2026). ### Does ISO issue ISO 27001 certificates? No. External certification bodies issue certificates. ISO does not perform certification ([UKAS, Accreditation of information security, cybersecurity and privacy protection](https://www.ukas.com/accreditation/sectors/digital/info-sec/) and [committee.iso.org, ISO, Certification](https://committee.iso.org/certification.html), checked 8 October 2026). ### Do we need both documents? Start with the requirements you have to meet. Ask customers to clarify what evidence they need before committing to either or both ([NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control), checked 8 October 2026). ## Where next - [What does ISO 27001 certification take, and who can certify you?](https://theassurancedesk.com/guides/iso-27001-certification-and-who-can-certify-you.md) - [How do you check an ISO certificate is genuine?](https://theassurancedesk.com/guides/check-iso-certificate-is-genuine.md) - [Customer security questionnaires: what they ask and how to answer](https://theassurancedesk.com/guides/customer-security-questionnaires-what-they-ask-and-how-to-answer.md) - [How do you answer a security questionnaire without a certificate?](https://theassurancedesk.com/guides/security-questionnaire-without-certification.md) - [SOC 2: what is it, and who asks for it?](https://theassurancedesk.com/guides/soc-2-what-it-is-and-who-asks-for-it.md) ## Sources - UKAS, Accreditation of information security, cybersecurity and privacy protection: https://www.ukas.com/accreditation/sectors/digital/info-sec/ (checked 8 October 2026) - committee.iso.org, ISO, Certification: https://committee.iso.org/certification.html (checked 8 October 2026) - aicpa-cima.com, SOC 2® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy, Publications, AICPA & CIMA: https://www.aicpa-cima.com/cpe-learning/publication/soc-2-reporting-on-an-examination-of-controls-at-a-service-organization-relevant-to-security-availability-processing-integrity-confidentiality-or-privacy (checked 8 October 2026) - NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control: https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control (checked 8 October 2026) - NCSC, Supplier assurance questions: https://www.ncsc.gov.uk/guidance/supplier-assurance-questions (checked 8 October 2026) - The Assurance Desk, Cyber Defense Group profile: https://theassurancedesk.com/advisers/cyber-defense-group (checked 8 October 2026) --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.