The short answer
Pick by where your buyers are. UK, European and most international buyers ask for ISO 27001; US buyers usually ask for a SOC 2 report. The two overlap a lot, so prepare once and audit for the one your next deal needs. Qorelo, a German AI startup, got ISO 27001 in about six weeks with zero non-conformities, then completed a SOC 2 Type I examination.
The other difference matters in sales conversations: ISO 27001 ends in a certificate from an accredited certification body. SOC 2 ends in a report and an opinion from a CPA firm. SOC 2 has no certificate.
Talk to a founder about your ISO route · Read the Qorelo case study
ISO 27001 and SOC 2 side by side
| ISO 27001 | SOC 2 | |
|---|---|---|
| What it is | An international standard for an information security management system (ISMS) | An examination of your controls against the AICPA Trust Services Criteria |
| What you get | A certificate | A report with the auditor's opinion |
| Who issues it | An accredited certification body (in the UK, accredited by UKAS) | A licensed CPA firm |
| Who asks for it | UK, European and most international buyers | US buyers, and US-owned companies elsewhere |
| What it covers | Your ISMS, plus the Annex A controls you choose in your Statement of Applicability (93 in the 2022 version) | Security always; availability, processing integrity, confidentiality and privacy if you add them |
| How long it lasts | Three years, with surveillance audits in years two and three | A report covers one point in time (Type I) or one period (Type II); buyers ask for a new one every year |
| How buyers check it | The certificate itself, often also on public registers such as UKAS CertCheck and IAF CertSearch | You share the report, usually under NDA |
Which one to do first
Start with the markets you sell to now and the ones you plan to sell to in the next year or so.
- Selling to the UK and Europe: ISO 27001. It's what procurement teams name in their questionnaires and contracts.
- Selling to the US, or planning to: SOC 2. It's the report US security teams know.
- Selling almost anywhere else, such as Asia or Latin America: ISO 27001, because it's international.
- Selling to both: prepare for both at the same time, audit for one now and do the second when a customer actually needs it.
Two of our customers made this call. Centinel Analytica, a German bot-detection startup, had customers asking for ISO 27001 and SOC 2, and chose ISO 27001: certified in under two months, with 15-20 hours of the team's time. Qorelo, a German AI platform for SAP operations, did ISO 27001 first, then a SOC 2 Type I examination. Its CTO says the result gave it a stronger trust foundation for enterprise conversations, including with Mercedes-Benz.
If a buyer asks for "ISO 27001 or SOC 2", ask which one they prefer, by when, and whether a letter saying you're in progress is enough for now. In our experience, it often is.
Where they overlap, and where they don't
Most of the work is the same. Both ask you to:
- assess your risks and choose controls for them;
- control who has access to what, with MFA and regular reviews;
- manage changes to code and infrastructure;
- check your vendors and keep a list of them;
- plan for incidents and back up your data;
- train your team and get policies acknowledged;
- prove all of it with evidence, not just policies.
The AICPA publishes a mapping between the Trust Services Criteria and ISO 27001's requirements, which shows how much carries over from one to the other.
What's different:
- ISO 27001 audits the management system, not just controls: your scope, risk method, internal audit and management review. Stage 1 checks your documents; Stage 2 checks that you follow them.
- SOC 2 starts with a system description: a written account of your services, infrastructure, people, data and the controls around them. The CPA firm checks that the description is accurate and that your controls meet the Trust Services Criteria.
- SOC 2 Type II tests a period. The auditor samples evidence across the whole window, so controls have to run all through the period, not just the week of the audit.
SOC 2 Type I or Type II
- Type I: are your controls designed properly, at one point in time? You can get it soon after you're ready, without an observation period. Qorelo's Type I covered the Security category, with an unmodified opinion in the final report.
- Type II: did your controls actually work over a period, usually 3 to 12 months? It's what many large US buyers want in the end.
A common route for startups is Type I first, to unblock the deal in front of you, then Type II once the controls have been running for a while.
How to do both without doing the work twice
- Write policies once, in a way that answers both. Most ISO 27001 policies already cover what a SOC 2 auditor asks for.
- Collect evidence once. Access reviews, onboarding and offboarding, change approvals, vendor reviews and incident records serve both audits.
- Audit for the one your next deal needs. For most UK and European startups, that's ISO 27001.
- Map the second one onto what you have. In our experience, much of what a CPA firm asks for, such as policy acknowledgements, change samples, MFA evidence and vendor lists, has already been collected for ISO 27001.
- Write the SOC 2 system description from your ISO 27001 scope and asset list.
- Show both in one place. A Trust Center with your certificate, your SOC 2 status and your policies answers many questions before buyers send a questionnaire. Qorelo's Trust Center shows its ISO 27001 certification and SOC 2 Type I side by side, and buyers request the certificate and reports there, which Qorelo reviews.
What it costs
For ISO 27001, UK market ranges for a team of up to 10 people add up to about £11,300 to £31,500 in year one, ex VAT: the audit, software or a consultant, and a pen test. The ISO 27001 cost guide breaks down each line with sources.
SOC 2 has a different price structure. The CPA firm's fee depends on the Type, the criteria you include and the size of your system, and a Type II usually costs more than a Type I. If you prepare for both at once, most of the preparation cost is shared.
Where Kantis fits
Kantis combines the software with hands-on support for both: the gap assessment, policies that work for ISO 27001 and SOC 2, evidence collection, the internal audit, the SOC 2 system description, coordination with your certification body or CPA firm, and a Trust Center for your buyers. The certification body issues the ISO 27001 certificate, and the CPA firm issues the SOC 2 report.
For the full ISO 27001 process from scope to certificate, read our ISO 27001 for startups guide. For a team-time example, read the Centinel Analytica case study.
Talk to a founder about your ISO route and you'll leave knowing which one your buyers need first and the fastest credible route to it. Calls are in English.