The short answer
ISO 27001 is a certification; SOC 2 is an attestation report. Ask your buyer which one they want before you spend a dollar on either. The actual contract, tender or security questionnaire determines the requirement. Confirm uncertain acceptance conditions in writing; location alone does not decide.
The two can share controls and evidence, but the degree of reuse depends on the agreed boundaries and criteria. Their assurance structures remain distinct. ISO 27001 requires a documented ISMS with a risk assessment, a Statement of Applicability, an internal audit and a management review. SOC 2 uses its own description criteria and Trust Services Criteria; Type I and Type II address different evidence periods.
If you need both, choose the sequence from the buyer deadline, current controls, available evidence and independent assessors’ requirements. Shared work can reduce duplication; confirm the actual effort before pricing it.
Certification vs attestation — the difference that matters
This is the distinction most comparisons skip, and it changes what you can actually hand a customer.
ISO 27001 is certified. An accredited certification body with an accredited scope accepted by the buyer — for example through JASANZ or another relevant accreditor such as ANAB or IAS — audits your ISMS in two stages and issues a certificate valid for three years, with surveillance audits in years one and two. The certificate is a short, public document. Buyers can verify it on the certification body’s register.
SOC 2 is attested. A licensed CPA firm examines your controls against the AICPA Trust Services Criteria and issues a report — often 40 to 100 pages, containing the auditor’s opinion, your system description, every control tested, and any exceptions found. There is no certificate and no public register. The report is normally shared under NDA.
Practically: ISO 27001 gives you something short you can publish; SOC 2 gives you something long you send to a buyer’s security team. Neither is stronger — they are different instruments.
Side by side
| ISO/IEC 27001:2022 | SOC 2 | |
|---|---|---|
| What it is | Certifiable international standard | AICPA attestation engagement |
| What you get | A certificate, valid 3 years | A report covering a stated period |
| Who issues it | Certification body with relevant, buyer-accepted accreditation | Licensed CPA firm |
| Publicly verifiable | Yes — on the certification body register | No — shared under NDA |
| Control set | 93 Annex A controls, 4 themes | 5 Trust Services Criteria; Security mandatory |
| Management system required | Yes — ISMS, risk assessment, SoA, internal audit, management review | No |
| Cycle | Stage 1 + 2, then surveillance yrs 1–2, re-cert yr 3 | Annual, to keep the report current |
| Point-in-time vs period | Ongoing certification | Type I = point in time · Type II = period |
| Buyer requirement | Confirm certificate scope and accreditation | Confirm report type, criteria, system and period |
How much overlap is there really?
Map the requirements to the same underlying controls where appropriate, and test whether existing evidence meets both scopes. Reuse does not guarantee a fixed saving.
What genuinely carries across:
- Access control, joiner-mover-leaver, and privileged access
- Change management and secure development
- Logging, monitoring and incident response
- Vendor and third-party risk management
- Backup, recovery and business continuity
- Physical and environmental controls
- Security awareness training and screening
What does not carry across, and catches people out:
- —The ISMS itself — scope, risk assessment method, Statement of Applicability, risk treatment plan
- —Clause 9 obligations — internal audit programme and management review, both mandatory for ISO 27001 and absent from SOC 2
- —The SOC 2 system description — a detailed narrative of your service that ISO 27001 never asks for
- —Trust Services Criteria beyond Security, which you select based on what you promise customers
Which one does your buyer want?
Do not guess this. Read the security questionnaire or the tender schedule. If the required assurance or accepted alternatives are unclear, obtain written buyer clarification.
| Requirement to clarify | Evidence to request | Why |
|---|---|---|
| Named assurance format | Certificate or SOC 2 report | Do not infer it from country or industry |
| Entity and service | Exact scope and system description | Check the service being purchased is covered |
| SOC 2 period and criteria | Required type, criteria and period | A Type I report may not answer a Type II requirement |
| ISO accreditation | Accepted accreditor and current scope | Confirm any equivalence provision with the buyer |
| Other obligations | Applicable contract and regulatory terms | Neither assurance instrument establishes all legal compliance |
| Deadline and gaps | Due date, owner and buyer confirmation | Agree which evidence can be supplied and when |
What each one costs in Australia
Build a scope-specific budget. Readiness is what you pay a consultancy; the audit or examination fee is paid separately to the certification body or CPA firm.
| Cost | ISO 27001 | SOC 2 |
|---|---|---|
| Readiness / implementation | Current scoped ISO 27001 service offer | Current scoped SOC 2 readiness offer |
| Audit or examination | Separate certification-body quote | Separate CPA-firm quote |
| Ongoing | Maintenance and surveillance quoted separately | Control operation and agreed report period |
| Renewal | Recertification under the agreed programme | Next examination to meet buyer requirements |
Compare the complete programme, including internal effort, tools and external fees. The scope-based budgeting approach is explained in the ISO 27001 certification guide for Australia.
Doing both, in the right order
The following is one possible sequence for an organisation that needs both. A buyer deadline or an existing control environment may justify a different order.
- Build the ISMS. Scope, risk assessment, Statement of Applicability, controls, internal audit, management review. Map governance work to the separate SOC 2 criteria where relevant.
- Certify to ISO 27001. Stage 1 and Stage 2 with an accredited body. You now have a publishable certificate.
- Map across to the Trust Services Criteria. Select which criteria beyond Security you commit to, and write the system description.
- Run the SOC 2 observation window and examination. Type II over three to twelve months, performed by a licensed CPA firm.
Confirm the proposed sequence with the buyer and independent assessor. A Type I report should only be treated as an interim step if the buyer accepts it.
The credentials behind each
Frameworks are certified at the organisation level; people are certified separately. If you are the person who will own this work, these are the individual pathways.
- PECB ISO 27001 Lead Implementer — Self-Study: A$578 + GST. Builds and runs the ISMS. The right credential for whoever owns the programme internally.
- PECB ISO 27001 Lead Auditor — Self-Study: A$578 + GST. Covers planning and leading ISMS audits.
- PECB Lead SOC 2 Manager — Self-Study: A$578 + GST. Prepares a service organisation for a SOC 2 examination against the Trust Services Criteria.
Check each course page for the selected format, exam inclusion, retake conditions and credential requirements. An exam pass is separate from an individual credential award. For the organisation-level work, see ISO 27001 readiness and SOC 2 readiness. Aegentra does not issue SOC 2 reports or ISO 27001 certificates — those come from a licensed CPA firm and an accredited certification body respectively.
FAQs
Is SOC 2 the same as ISO 27001?
No. ISO/IEC 27001 is a certifiable international standard — an accredited certification body audits your Information Security Management System and issues a certificate valid for three years. SOC 2 is an attestation: a licensed CPA firm examines your controls against the AICPA Trust Services Criteria and issues a report, not a certificate. ISO 27001 tells a buyer you run a governed security programme; SOC 2 gives them an auditor’s opinion with the detailed evidence attached.
Which is better for an Australian company, SOC 2 or ISO 27001?
Read the actual customer contract, tender or questionnaire. Confirm the required assurance format, scope, reporting period, accreditation and acceptance criteria. Geography can prompt questions but does not establish the requirement, and selling across regions does not automatically mean you need both.
How much do ISO 27001 and SOC 2 overlap?
Some controls and evidence can be reused, including access, change management, incident response and supplier oversight. The amount depends on the ISMS scope, SOC 2 system boundary, selected criteria and evidence periods. Map each requirement and gap explicitly; no universal percentage or saving is established.
What is the difference between SOC 2 Type I and Type II?
Type I addresses design at a specified date; Type II also addresses operating effectiveness over a specified period. Confirm the required type and period with the buyer and CPA firm. A Type I report should not be assumed to satisfy a Type II requirement.
Can Aegentra issue a SOC 2 report?
No, and neither can any consultancy. Only a licensed CPA firm can perform a SOC 2 examination and issue the report. Aegentra does SOC 2 readiness — scoping the Trust Services Criteria, building and evidencing the controls inside your Microsoft 365 tenant, and preparing you for the examination — then works alongside the CPA firm that performs it. The same separation applies to ISO 27001: certification audits are performed by accredited certification bodies, not by Aegentra.
Does SOC 2 expire?
A SOC 2 report covers a specified date or period. Its acceptance and freshness depend on the buyer’s requirements. Confirm the next reporting period and any bridging information with the CPA firm. ISO certification follows its own surveillance and recertification programme; compare the full ongoing obligations.
Which is cheaper?
Compare written quotes for the same scope, evidence period and responsibilities. Separate readiness consulting, internal effort, remediation, tools and the independent certification or examination fee. Aegentra’s current service pages state its scoped offers; external providers quote their own work. Neither framework is universally cheaper.