mediumConceptScenarioMidSeniorStaffLead
What is the difference between SOC 2 and ISO 27001, and what does an auditor accept as evidence?
6 min readUpdated 2026-08-15
Answer
Short answer
ISO 27001 certifies a management system against a fixed standard; SOC 2 is an attestation report whose scope you define and whose chosen controls a CPA firm opines on. Both separate the control from its implementation from the evidence, and only system-generated artefacts spanning the whole period count.
Was this answer helpful?
Likely follow-ups
- A prospect sends you their SOC 2 report. Which sections do you read first and why?
- Which of your existing engineering practices would you present as evidence with no extra work?
- What is a complementary user entity control, and why does it move risk to you?
- How do you avoid the trap of building controls that satisfy an auditor but do not reduce risk?
- What does a qualified opinion or a noted exception actually mean for the relationship?
Related questions
- You were audited a year ago and the product has changed a great deal since. A customer asks whether your newest service is covered. What do you tell them?hardAlso on soc-2 and iso-270016 min
- A customer asks how you meet a control your cloud provider handles. What can you claim from their certification?mediumAlso on iso-270016 min
- An auditor wants proof that a control operated on every day of the review period, not that it exists today. What do you show them?hardAlso on audit-evidence6 min
- You move a service from Java 11 to Java 21 and it fails at startup with InaccessibleObjectException. What changed, and what do you do about it?hardSame kind of round: concept5 min