SOC 2 and ISO 27001: How to Run One Control Set Instead of Two Audit Programs

Can one control set support both SOC 2 and ISO 27001? Yes. SOC 2 and ISO 27001 test many of the same safeguards, so an organization can implement one set of controls, collect one body of evidence and use it for both. The outputs stay separate: a CPA firm issues the SOC 2 report and an accredited certification body issues the ISO 27001 certificate.

Many organizations run SOC 2 and ISO 27001 as two programs with two control lists and two evidence calendars. That is expensive and avoidable. This article addresses how the outcomes differ, where they overlap, and how the Secure Controls Framework (SCF) lets you build once.

How are a SOC 2 report and an ISO 27001 certificate different?

A SOC 2 examination is an attestation performed by a licensed CPA firm under AICPA attestation standards against the Trust Services Criteria. A SOC 2 Type I report assesses the design of controls at a point in time. A SOC 2 Type II report attests that controls were suitably designed and operating effectively over a defined review period. The result is a report, not a certification.

ISO/IEC 27001 is a management system standard. A certification body accredited to certify ISO/IEC 27001 audits your information security management system (ISMS) and, if you conform, issues a certificate.

Different markets ask for different ones, so many organizations need both. In summary of these differences, the solutions are

• A SOC 2 report shows a customer how specific controls performed; and
• An ISO 27001 certificate shows that your ISMS conforms to an international standard.

Where do SOC 2 and ISO 27001 overlap?

Both expect governance, risk assessment, access control, change management, incident response, vendor oversight, monitoring and documented policies. The five Trust Services Criteria categories (security, availability, processing integrity, confidentiality and privacy) cover ground that an ISO 27001 ISMS also has to address. The wording differs, but the safeguards often do not.

If your SOC 2 and ISO teams each write their own access review procedure and collect their own screenshots, you pay twice for one control. For a worked example of how individual requirements line up, see How to Map SOC 2 to ISO 27001 Using the SCF.

How does the SCF turn two programs into one?

The SCF is a free metaframework of cybersecurity and data privacy controls. Its 34 domains contain more than 1,500 controls mapped to over 200 laws, regulations and frameworks, including the SOC 2 Trust Services Criteria and ISO 27001. You implement the SCF control once and the mapping tells you which SOC 2 criteria and ISO 27001 requirements it supports. A practical sequence looks like this:

1. Scope both outcomes together in one boundary of people, processes, technology, data and facilities.
2. Select SCF controls that map to the Trust Services Criteria in scope and to ISO 27001, using the free SCF download in Excel or NIST OSCAL JSON.
3. Assign one owner and one evidence artifact per control, tagged with every requirement it supports.
4. Run one internal assessment against the SCF controls before either external engagement starts.
5. Share the same evidence set with the CPA firm and the certification body, each applying its own standards.

Where does SCR CAP fit?

The SCR Conformity Assessment Program (CAP) certifies conformity against SCF controls. It works in two phases: a First-Party Declaration in which the organization assesses itself, then a third-party assessment by an SCR 3PAO accredited by The Cyber AB using examine, interview and test methods. Certifications are Law, Regulation and Framework (LRF)-specific (one authority, such as NIST CSF 2.0) or Tailored (a custom control set built from your own obligations), so one engagement can cover several requirements.

A further option is an assessment hub. An SCR 3PAO that separately holds the credentials each output requires (a licensed CPA firm for a SOC 2 examination, and a certification body accredited to certify ISO/IEC 27001) could, in principle, deliver an SCR CAP certification, a SOC 2 report and an ISO 27001 certificate from one SCF-based assessment and evidence set. SCR CAP does not issue SOC 2 reports or ISO 27001 certificates; those remain with the CPA firm and the accredited certification body.

Why does this matter more now?

New requirements keep arriving. An IAPP opinion column published on 16 October 2026, "A view from DC: Time is running out to prepare for privacy audits", discusses building controls for California's CCPA cybersecurity audits against existing standards like SOC 2 and ISO 27001, and checking your SOC 2 report's carve-out paragraph for gaps. This is again where the SCR CAP can provide a superior alternative to stand-alone SOC 2, ISO 27001 and CCPA audits.

Frequently Asked Questions (FAQ)

Can I get a SOC 2 report and ISO 27001 certification at the same time?

Yes. Many organizations schedule both in the same period and share one evidence set, while each output still comes from its own qualified issuer.

Is SOC 2 a certification?

No. SOC 2 is an attestation that results in a CPA firm's report. ISO 27001 results in a certificate.

Which should I pursue first, SOC 2 or ISO 27001?

Start with whatever your customers and contracts ask for. If you build on a common control set such as the SCF, the second outcome reuses most of the first one's work.

Does SCR CAP replace SOC 2 or ISO 27001?

SCR CAP is a separate certification against SCF controls. Whether a customer or contract accepts it in place of another attestation is up to that customer or contract, so confirm before relying on it.