Already ISO 27001 Certified? Get the SOC 2 Report Your US Buyers Ask For

Why a US Buyer Asks for SOC 2 When You Already Hold ISO 27001

US enterprise buyers ask for SOC 2 by name, and contract addenda often specify a Type II. ISO 27001 is what European and multinational enterprises ask for in the same way, so US-first companies usually do SOC 2 first and add ISO 27001 later for European deals; companies based outside the United States often arrive in the opposite order.

An ISO 27001 certificate does not substitute for a SOC 2 report in that review: the buyer wants a different document — an independent auditor's opinion on your controls against the AICPA's Trust Services Criteria, with a system description and test results. The certificate does give you a head start, because much of what the auditor needs already exists.

Certification vs Attestation: What Actually Changes

A certification such as ISO 27001 is issued by an accredited certification body that audits your ISMS against the standard and declares that you meet it. The outcome is pass or fail; the deliverable is a certificate, typically valid for three years with annual surveillance audits, that buyers can verify in a public registry.

A SOC 2 report is an attestation that only a licensed CPA firm can issue, under the AICPA's attestation standards (SSAE 18). It contains the auditor's opinion, management's assertion, a description of your system, the controls in scope and the result of every test. The opinion is unqualified, qualified or adverse; the report is confidential, shared under NDA and renewed annually. "SOC 2 certified" is therefore a misnomer: your customer receives a SOC 2 Type I or Type II report.

What Carries Over From Your ISO 27001 Program

A certified ISMS has already produced much of what a SOC 2 auditor asks for. Documentation and evidence you maintain for ISO 27001 can be reused wherever it addresses a Trust Services Criterion — the objectives listed in full in our SOC 2 controls list. Four groups carry over most often:

• Policies and governance records — policy set, roles and responsibilities, management review minutes and training records (CC1, CC2, CC5).
• Risk assessments — methodology, risk register and treatment plan (CC3); supplier reviews for vendor risk (CC9).
• Access reviews — provisioning approvals, periodic access reviews and deprovisioning records (CC6).
• Change management records — change tickets, approvals, test evidence and release records (CC8).

We map the overlap at scoping, walking through your Statement of Applicability and evidence against the Security Trust Services Criteria to agree what we can accept as it stands, what needs a SOC 2-specific form (for example, evidence dated inside a Type II observation period) and what SOC 2 requires that ISO 27001 does not, starting with the system description. We do not quote a percentage of reuse in advance.

Price and Timeline

We publish our standard fees. Scoped to the Security Trust Services Category, a SOC 2 Type I costs $3,000 to $10,000, a Type II $5,000 to $15,000 and a combined Type I + Type II engagement $7,000 to $20,000, by headcount from 1 to 999 employees; larger organizations receive a custom quote. The full schedule is on our SOC 2 pricing page. The fee is the same on any GRC platform or none, and holding ISO 27001 neither raises nor lowers it.

These are base prices for standard engagements: fees may be higher for complex products or system descriptions, multi-cloud environments or on-premise infrastructure, each engagement may be priced higher or lower at scoping, and your fee is confirmed in the engagement letter.

A SOC 2 Type I takes about 4–8 weeks of fieldwork and reporting, roughly 3–6 months in total including readiness. A Type II takes roughly 6–15 months in total, including a 3–12 month observation period during which your controls must operate and produce dated evidence. An existing ISO 27001 program changes the readiness and remediation stretch, not the observation period: Type II evidence cannot be created retroactively. See our SOC 2 timeline guide for each phase.

How to Start

Book a 30-minute scoping call. We confirm scope, headcount tier and whether you need a Type I, a Type II or both, and take a first look at your ISO 27001 documentation. Every engagement requires individual approval and confirmation of auditor independence before an engagement letter is issued. The engagement then runs in four phases:

• Discovery — we map your systems and in-scope services and define the Trust Services Categories for your report.
• Readiness — gap analysis against every applicable criterion, with the ISO 27001 evidence mapping agreed before fieldwork.
• Fieldwork — remote or on-site evidence collection, walkthroughs and control testing with a senior auditor from day one.
• Delivery — the final SOC 2 report and management letter.

Engagements run in English, German, French or Italian for European teams and in English, Spanish or Portuguese in Latin America; see also our page on SOC 2 audits for international companies.