SOC 2 vs. ISO 27001: Which Certification Should an IT Company Serving the EU and US Choose (2026)

A Ukrainian outsourcing team of 40 developers gets a security questionnaire from a new client in San Francisco. Question #7: "Provide your current SOC 2 Type II report." A week later, a different client, this one in Munich, sends its own requirements list, and an ISO/IEC 27001 certificate sits right at the top. Both requests are real, both come from paying clients, and neither accepts "we take security seriously" as a substitute for paperwork.

That's the question we hear at almost every consultation: SOC 2 or ISO 27001, and whether you can get away with just one. The short answer depends on where your clients sit and what they're willing to accept as proof. The long answer means understanding what actually separates these two documents, not just their names.

We've already covered the ISO/IEC 27001 standard itself in detail in our complete certification guide. This piece is narrower: a direct comparison with SOC 2, and a clear answer to "which one first" — a question most consultants dodge with "it depends."

SOC 2 (System and Organization Controls 2) is an independent auditor's report on how well a company's controls meet the Trust Services Criteria: the mandatory security criterion (Common Criteria), plus whichever of the remaining four (availability, processing integrity, confidentiality, and privacy) the company has selected for its scope. The American Institute of Certified Public Accountants (AICPA) wrote the criteria, and it's a licensed CPA firm, not a separate accreditation body, that performs the review and signs the report.

The report comes in two flavors. Type I confirms that controls were properly designed as of a specific date. Type II is the heavier document: it confirms the controls actually operated effectively over an observation period, typically 6-12 months. Most American clients asking for "SOC 2" mean Type II specifically. They treat Type I as an interim step, not a final answer to a security questionnaire.

Here's where even experienced managers trip up: SOC 2 isn't certified. There's no accreditation body that issues a "SOC 2 certificate" the way Bureau Veritas issues an ISO/IEC 27001 certificate. AICPA sets the criteria; the auditor gives a professional opinion in a report, not a pass/fail stamp. Companies that write "SOC 2 certified" on their website are using a convenient but technically inaccurate phrase, and a client's legal team usually knows it.

The report itself is confidential, too. It isn't published in a public registry. It's shared under NDA with the specific clients or partners who requested it.

ISO/IEC 27001 runs on different logic. It's an international standard for an information security management system (ISMS): a company runs a risk management process, selects applicable controls from a set of 93 grouped into four Annex A themes, and documents its choices in a Statement of Applicability. An accredited certification body, Bureau Veritas for instance, whose partner Ekontrol has been in Ukraine since 2014, audits in two stages (Stage 1 and Stage 2) and, if everything checks out, issues a certificate valid for three years with a mandatory annual surveillance audit.

The core difference from SOC 2 is what actually gets evaluated. SOC 2 examines selected controls for one specific product or service. ISO/IEC 27001 certification covers the management system for the whole organization, or a clearly defined scope, including processes rather than just technical settings. It's a longer conversation with the auditor, but the payoff is a certificate you can verify publicly, not a document locked behind an NDA.

Put the two documents side by side and the differences become obvious within minutes. Here are the seven criteria we walk through with clients during diagnostics, before recommending a specific standard.

None of these rows makes one standard "better" than the other. They answer different questions from different buyers. The trouble starts only when a company picks one at random instead of matching it to its buyer profile.

A client's procurement or security team isn't reading a standard for its own sake. They're answering one specific risk question: could our data leak through this vendor. IT companies going through their first vendor assessment are often surprised by how detailed these questionnaires get: encryption key rotation, access logs, incident response plans, even the offboarding process for employees who had production access.

ISO/IEC 27001 addresses this systemically: the auditor checked not just technical settings but the process itself, whether the company can actually spot risks and respond to them, not just perform for the audit. For a client, that's a signal of process maturity that will still hold up a year or three years from now.

SOC 2 Type II proves something narrower, but often more convincing to a specific buyer: the controls didn't just exist on paper, they actually worked, month after month, and the auditor documented it with concrete testing examples. American due diligence teams frequently ask "show us your SOC 2 Type II," not "tell us about your security program" — it's a ready-made format their legal department can read in five minutes.

Here's the direct answer, no "it depends on many factors": if most of your clients or prospective contracts are in the European Union, start with ISO/IEC 27001. If your primary market is American SaaS, enterprise B2B, or startups raising rounds in the US, start with SOC 2 Type II. It isn't a law of physics, but in Ekontrol's experience this rule holds in nine cases out of ten.

The reason is straightforward. European procurement teams are used to certificates they can verify in a public registry, ones that plug neatly into other requirements: tender documentation, GDPR-style questionnaires, requirements from a parent company headquartered in Germany or France. For them, ISO/IEC 27001 is table stakes, not a bonus. They understand SOC 2 too, but treat it as an "American format" that needs extra explanation during negotiations.

The logic runs the other way just as consistently. A Silicon Valley client rarely asks for ISO/IEC 27001 in year one. Instead, their legal team's security questionnaire almost always has a line reading "SOC 2 Type II report available upon request," and without it, the deal stalls at vendor review regardless of how good the product is.

The exception we see regularly: a company with clients on both sides of the Atlantic. Then the question isn't "which one" but "which one first," and the answer is the same: follow the geography of your current contracts, not whichever standard sounds more prestigious to the founder.

Any article that names an exact figure, "ISO 27001 costs $X, SOC 2 costs $Y," without a diagnostic first is oversimplifying to the point of being dishonest. We've broken down the ISO/IEC 27001 certification budget in detail in a separate guide; the cost logic here is different, specific to SOC 2 Type II.

SOC 2 Type II costs break down into three parts, and each depends on where the company starts:

• Internal control readiness. Usually the most expensive and time-consuming stage if documented processes don't exist yet.
• The CPA firm's audit fee. Payment for the review itself and the final report, driven by the number of systems and Trust Services Criteria in scope, not headcount.
• Continuous evidence-monitoring tooling. Often left out of the budget, even though it's needed for the entire observation period.

Unlike ISO/IEC 27001, there's no formula here like IAF MD 5 tying auditor person-days to headcount. Costs track more closely with the number of systems inside the report's boundary.

Good news for companies that eventually want both documents: most requirements overlap. Industry estimates from compliance-automation vendors put the overlap at 60-75% of shared controls between SOC 2 and ISO/IEC 27001 — access control, encryption, and incident response get tested in almost the same way under both frameworks. On timeline, SOC 2 Type II almost always takes longer than it looks at first glance. AICPA doesn't mandate a minimum observation period: "expedited" reports built on roughly 3 months of evidence technically exist, but they rarely convince a serious buyer. In practice, 6 months is a realistic floor for a first Type II report that actually holds up, and enterprise buyers or larger due-diligence teams often expect a full 12 months outright. Add a few weeks of prep and the audit itself, and a realistic floor is 7-9 months from decision to finished report.

"Both or just one" is the question we hear right after "where do we start." The answer depends on how geographically diversified the client base already is, not on budget, which is what most people assume.

The most common pattern in Ekontrol's practice: a company starts with one standard for its current anchor client, then adds the second within 6-12 months once the first request from another continent shows up. Since the controls overlap 60-75%, the second rollout is always faster and cheaper than the first. The team already maintains a risk register, access logs, and an incident response procedure, and the auditor just needs to confirm those processes meet one more set of criteria instead of building a system from scratch.

Less common, but it happens: a company knows from day one it'll serve both markets, a fintech product for startups in Germany and California at once, say, and then it makes sense to plan both rollouts in parallel from the start, spreading the team's capacity across a 12-month horizon rather than running them sequentially. It's harder to organize, but it avoids the situation where the first client from a new market is waiting on a document that doesn't exist yet.

We see the same set of missteps over and over in consultations, and none of them come down to budget.

Writing "we're SOC 2 certified" on a website or in an investor deck sounds convincing until a client's lawyer reads it and knows AICPA doesn't certify anyone. The accurate phrasing is "we completed a SOC 2 Type II audit" or "we hold a SOC 2 Type II report." A small detail that either confirms a team's competence or gives away that marketing filled out the security questionnaire.

A CTO who previously worked at an American company defaults to pushing the team toward SOC 2, even if 80% of current contracts are with Germany and Austria. Choosing a standard is a decision about clients, not about one manager's personal background.

A company picks one standard "for good" and then redoes the entire prep cycle from scratch when a client from another market shows up, when it could have planned for a second rollout from the start and leaned on the control overlap.

A sales team promises a client a SOC 2 Type II report "within a quarter," even though AICPA sets no hard minimum for the observation period. In practice, no auditor or serious buyer takes a Type II report seriously with less than 6 months behind it, and that's before adding time for control readiness and the audit itself. A realistic estimate is closer to 7-9 months, and it's better to tell the client that upfront than to explain the delay later.

Most of these mistakes aren't about technology. They're about communication, both with the client and inside a team that sells the outcome before it's ready.

Ekontrol has supported ISO/IEC 27001 preparation as Bureau Veritas's partner in Ukraine since 2014, and choosing between ISO/IEC 27001, SOC 2, or both is the first thing we discuss during a free diagnostic, not after a contract is signed. Within a few days, the team reviews your client geography, the security questionnaires partners have already sent you, and the real state of your internal processes, without dressing up the timeline.

If the diagnostic points to ISO/IEC 27001, Ekontrol's team leads the implementation and the certification body audit directly. If your client profile calls for SOC 2 Type II, we help prepare the controls and documentation to a level ready for a CPA firm's audit, including building the evidence register for the full observation period.

There's no universal answer to "SOC 2 or ISO 27001" — there's an answer for your specific client base. IT companies that have already made this choice with Ekontrol mostly regret one thing: not reaching out a few months earlier, before the first security questionnaire put a deal on hold.