# ISO 27001 vs SOC 2: What Companies Hold **URL:** https://theauditrail.com/frameworks/iso-27001/vs-soc-2/ **Published:** 2026-11-12 **Modified:** 2026-11-13 **Author:** The Audit Trail editorial desk > 104 of 132 cloud company trust centers name both ISO 27001 and SOC 2. 16 name SOC 2 only and 5 name ISO 27001 only. --- [ISO 27001 guide](https://theauditrail.com/frameworks/iso-27001/) # ISO 27001 vs SOC 2: Which One Do Cloud Companies Hold? 104 of 132 cloud company trust centers name both ISO 27001 and SOC 2. 16 name only SOC 2 and 5 only ISO 27001. How the two differ in issuer, proof and cost. The Audit Trail editorial desk Updated Nov 13, 2026 · First published Nov 12, 2026 [Some vendors pay us to be assessed or listed. Payment never changes a score, a rank or a verdict.](https://theauditrail.com/how-we-make-money/) In brief - Most cloud companies hold both: 104 of 132 trust centers name ISO 27001 and SOC 2 (2 October 2026). - 16 name only SOC 2 and 5 name only ISO 27001. - ISO 27001 ends in a certificate from an accredited certification body. SOC 2 ends in a report from a CPA firm. - Of the 114 trust centers that say how to get the SOC 2 report, 5 let anyone download it. - All seven platforms rated here cover both, so one evidence base can feed both. Most cloud companies hold both. Of 132 cloud company trust centers, 104 name ISO 27001 and SOC 2 together, 16 name SOC 2 alone and 5 name ISO 27001 alone, as of 2 October 2026. Seven name neither. The two answer the same buyer question, whether the company runs a real security program, and they prove it differently: ISO 27001 ends in a certificate from an accredited certification body, SOC 2 in a report from a CPA firm. SOC 2 leads where a company holds only one. Among the 21 trust centers that name just one of the two, 16 name SOC 2. The choice usually follows the buyer. ISO 27001 appears as a procurement requirement in European markets, in regulated sectors and in enterprise sales across Asia, and the security questionnaire in a deal names the proof the buyer wants. ## What cloud companies hold The count comes from the trust centers of 161 cloud companies: 97 companies from the 2025 Forbes Cloud 100 plus the 64 other companies in the BVP Nasdaq Emerging Cloud Index, which leaves out three Cloud 100 AI labs. 132 of the 161 run a trust center. The [trust center study](https://theauditrail.com/research/trust-centers/) has the full sample and the other counts. What the trust center names Trust centers Share of 132 Both ISO 27001 and SOC 2 104 79% SOC 2 only 16 12% ISO 27001 only 5 4% Neither 7 5% SOC 2 in any form appears on 120 of the 132 trust centers, 91%. ISO 27001 appears on 109, 83%. Private and public companies look alike: 62 of the 79 Cloud 100 trust centers name both, and so do 42 of the 53 in the public index. The five that hold ISO 27001 without SOC 2 are AppsFlyer, Automation Anywhere, Axonius, Grafana Labs and Personio. ## Who issues each one The two split on who does the audit and what the company gets at the end. ISO 27001 SOC 2 Issued by An accredited certification body A CPA firm What the company gets A certificate A report with the CPA firm’s opinion Standard behind it ISO/IEC 27001:2022, which defines the requirements an information security management system must meet The AICPA Trust Services Criteria Validity Three years, with a surveillance audit each year A Type 1 report covers one date and a Type 2 report covers a period What the company picks The risks, the Annex A controls it applies and the scope of the ISMS Security is required, and the company picks which of the other four criteria to add ISO itself does not certify anyone. [Accredited certification bodies](https://theauditrail.com/frameworks/iso-27001/) do, and the accreditation comes from a member of the International Accreditation Forum, such as UKAS in the UK or ANAB in the US. A SOC 2 report is the product of a licensed CPA firm, covered in the guide to [who may sign a SOC 2 report](https://theauditrail.com/frameworks/soc-2/who-performs-a-soc-2-audit/). The AICPA describes SOC as a suite of services that CPAs may provide, and it issued exposure drafts of 2027 SOC 2 criteria on 26 October 2026. ISO 27001 adds two requirements that SOC 2 does not have. The standard requires an internal audit before the certification audit, in Clause 9.2, and a Statement of Applicability that lists which Annex A controls apply and why. SOC 2 has no Statement of Applicability. The [ISMS software ranking](https://theauditrail.com/best/isms-software/) scores how well each platform drafts one. ## What buyers can see A SOC 2 report is the document companies usually hand over under a non-disclosure agreement, and the trust center data shows how rarely it is open. Of the 114 trust centers that say how to get it, 5 let anyone download it. A buyer asking for the SOC 2 report almost always has to ask. 86 of the trust centers use a request form for it, and the full breakdown is in the study. The [trust center software ranking](https://theauditrail.com/best/trust-center-software/) covers the platforms that host these pages. ## What each one costs The quotes overlap, and neither standard is clearly cheaper. The sources below state their own scope. Source Scope Stated cost [Sprinto](https://sprinto.com/blog/iso-27001-certification-cost/) ISO 27001, first year, 50 to 100 people $25,000 to $55,000 [Scrut](https://www.scrut.io/hub/iso-27001/iso-27001-certification-cost) ISO 27001, total, all company sizes $15,000 to $60,000 [Scrut](https://www.scrut.io/hub/soc-2/cost-of-soc-2-audit) SOC 2 Type 2, first audit, 50 to 100 person SaaS company $30,000 to $100,000 [Thoropass](https://www.thoropass.com/blog/soc-2-audit-cost-a-guide) SOC 2 Type 2, auditor fee only $15,000 to $100,000 or more [Sprinto](https://sprinto.com/blog/iso-27001-certification-cost/) ISO 27001, Stage 1 and Stage 2 audit only, 6 to 90 people about $1,000 to $3,000 [Vanta](https://www.vanta.com/collection/iso-27001/iso-27001-certification-cost) ISO 27001, Stage 1 and Stage 2 audit only $14,000 to $16,000 The audit line is where the sources disagree most. Sprinto’s audit partners quote $1,000 to $3,000 for both ISO stages, and Vanta says $14,000 to $16,000. Each line item is broken out in the [ISO 27001 cost guide](https://theauditrail.com/frameworks/iso-27001/cost/), and the SOC 2 side is in the [SOC 2 audit cost guide](https://theauditrail.com/frameworks/soc-2/cost/). ## Which to get first Start with the one the next large buyer names in its security questionnaire. The trust center data points the same way for most cloud companies: SOC 2 first, ISO 27001 added later. Of the 21 trust centers that hold only one, 16 hold SOC 2. A team that already runs SOC 2 controls has done much of the ISO 27001 evidence work. Sprinto says the same Annex A mapping carries across its other frameworks, so a team running ISO 27001 beside SOC 2 does not rebuild controls, and the [compliance automation guide](https://theauditrail.com/blog/grc/compliance-automation/) explains how platforms map one test to several frameworks. What ISO 27001 adds is the management system: the risk assessment method, the Statement of Applicability, the internal audit and continual improvement. What SOC 2 adds is a CPA’s opinion on how the controls ran over a period. All seven platforms rated here cover both. [Sprinto](https://theauditrail.com/vendors/sprinto/) ranks first at 84 and [Vanta](https://theauditrail.com/vendors/vanta/) second at 82 on the same rubric, and the [SOC 2 compliance software ranking](https://theauditrail.com/best/soc-2-compliance-software/) scores the platforms from the SOC 2 side. A startup preparing its first report can follow the [SOC 2 for startups guide](https://theauditrail.com/frameworks/soc-2/for-startups/) and plan the ISO 27001 certificate for the following year. The [SOC 2 hub](https://theauditrail.com/frameworks/soc-2/) collects the rated platforms and the guides for that report. Platforms in this article [![Sprinto logo](https://theauditrail.com/logos/sprinto.png)Sprinto (84/100)](/vendors/sprinto/)[ ![Vanta logo](https://theauditrail.com/logos/vanta.png)Vanta (82/100) ](/vendors/vanta/)[ ![Drata logo](https://theauditrail.com/logos/drata.png)Drata (76/100) ](/vendors/drata/)[ ![Secureframe logo](https://theauditrail.com/logos/secureframe.png)Secureframe (75/100) ](/vendors/secureframe/)[ ![Scrut logo](https://theauditrail.com/logos/scrut.png)Scrut (72/100)](/vendors/scrut/) ## Frequently asked questions - Is ISO 27001 or SOC 2 better? Neither is better. Among the 132 cloud company trust centers in the study, 104 name both, 16 name only SOC 2 and 5 name only ISO 27001. SOC 2 appears on 120 of the 132 and ISO 27001 on 109. They answer the same buyer question with different proof: ISO 27001 gives a certificate from an accredited certification body, SOC 2 gives a report from a CPA firm. - Do I need both ISO 27001 and SOC 2? Most cloud companies that start with one add the other. 104 of 132 trust centers name both. A buyer's security questionnaire decides which one you need first, and a team that already runs SOC 2 controls can reuse much of that evidence for ISO 27001. - Which is cheaper, ISO 27001 or SOC 2? The quotes overlap. Sprinto puts a first-year ISO 27001 build for 50 to 100 people at $25,000 to $55,000. Scrut puts a first SOC 2 Type 2 for a 50 to 100 person SaaS company at $30,000 to $100,000. The certification audit alone is the line that differs most: Sprinto's audit partners quote about $1,000 to $3,000 for ISO 27001, and Thoropass puts SOC 2 Type 2 audit fees at $15,000 to $100,000 or more. - Can I get ISO 27001 and SOC 2 with one audit? No. A certification body issues the ISO 27001 certificate and a CPA firm issues the SOC 2 report, so each needs its own audit. The evidence behind the two overlaps, so a compliance platform can map one set of tests to both. - Is SOC 2 a certification? No. SOC 2 is a report that a CPA firm issues, with its opinion, after testing a company's controls. ISO 27001 is a certification: an accredited certification body audits the company and issues a certificate. - Which one do buyers outside the US ask for? ISO 27001 is the one that appears as a procurement requirement in European markets, regulated sectors and enterprise sales across Asia. SOC 2 is named on 120 of the 132 trust centers in the study, and ISO 27001 on 109.