{"id":8107,"date":"2022-07-28T09:06:43","date_gmt":"2022-07-28T09:06:43","guid":{"rendered":"https:\/\/outofsite.biz\/cynance\/?p=8107"},"modified":"2022-07-28T09:06:45","modified_gmt":"2022-07-28T09:06:45","slug":"iso-27001-vs-soc-2-which-is-better","status":"publish","type":"post","link":"https:\/\/outofsite.biz\/cynance\/iso-27001-vs-soc-2-which-is-better\/","title":{"rendered":"ISO 27001 vs SOC 2 &#8211; Which is better for your organisation?"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"8107\" class=\"elementor elementor-8107\">\n\t\t\t\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-45e0897e elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"45e0897e\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-2a13f229\" data-id=\"2a13f229\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-264884f6 elementor-widget elementor-widget-text-editor\" data-id=\"264884f6\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.11.5 - 14-03-2023 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#818a91;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#818a91;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<p><span style=\"font-weight: 400;\">\u201cDo you have ISO 27001 certification?\u201d, \u201cWe only do business with organisations who have SOC2 accreditation\u201d. As a startup you may be asked questions just like this frequently by customers, auditors, regulators, the board, and many others.<\/span><\/p><p><span style=\"font-weight: 400;\">But, if there is a choice of ISO 27001 vs SOC 2, which one should you be pursuing? Or should you aspire to achieve both? In this article we provide an introduction to both as a starting point to making a decision about ISO 27001 vs SOC 2 for your startup.<\/span><\/p><h2><span style=\"font-weight: 400;\">ISO 27001 vs SOC 2: What are the differences?<\/span><\/h2><p><span style=\"font-weight: 400;\">Both ISO 27001 and SOC 2 are information security standards designed to allow organisations to demonstrate their commitment to information security. They have many elements in common, but they also differ slightly in their scope, requirements and audit processes.<\/span><\/p><h3><span style=\"font-weight: 400;\">What is ISO 27001?<\/span><\/h3><p><span style=\"font-weight: 400;\">The <\/span><a href=\"https:\/\/www.iso.org\/isoiec-27001-information-security.html\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">ISO\/ IEC 27001<\/span><\/a><span style=\"font-weight: 400;\"> certification is an internationally recognised standard for information security management. ISO 27001 has a strong emphasis on the ISMS or Information Security Management System, which requires organisations to take a risk management approach towards the information security threats facing their organisation.<\/span><\/p><p><span style=\"font-weight: 400;\">ISO 27001 is jointly managed by the <\/span><a href=\"https:\/\/www.iso.org\/about-us.html\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">International Organization for Standardization<\/span><\/a><span style=\"font-weight: 400;\"> and the <\/span><a href=\"https:\/\/www.iec.ch\/homepage\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">International Electrotechnical Commission<\/span><\/a><span style=\"font-weight: 400;\">.\u00a0<\/span><\/p><h3><span style=\"font-weight: 400;\">What is SOC 2?<\/span><\/h3><p><a href=\"https:\/\/soc2.co.uk\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">SOC 2<\/span><\/a><span style=\"font-weight: 400;\"> is an attestation rather than a certification, that states that an organisation has developed a programme for protecting customer information. In order for an organisation to obtain SOC 2, an external auditor must issue a report or attestation that they approve the programme.<\/span><\/p><p><span style=\"font-weight: 400;\">There are two types of SOC 2 reports issued by auditors:<\/span><\/p><p><span style=\"font-weight: 400;\">SOC 2 Type I reports confirms that a vendor has an information security programme or control design suitable to meet the relevant <\/span><a href=\"https:\/\/soc2.co.uk\/soc-2\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Trust Services Criteria<\/span><\/a><span style=\"font-weight: 400;\">.<\/span><\/p><p><span style=\"font-weight: 400;\">SOC 2 Type II reports verify that the specific testing procedures on the operating effectiveness of the controls have been met.<\/span><\/p><p><span style=\"font-weight: 400;\">In addition to SOC 2, there are also SOC 1 reports which are issued for financial controls (and are therefore not relevant for most companies), and <\/span><a href=\"https:\/\/us.aicpa.org\/interestareas\/frc\/assuranceadvisoryservices\/aicpasoc3report.html\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">SOC 3<\/span><\/a><span style=\"font-weight: 400;\"> reports. SOC 3 reports use the same audit criteria as SOC 2 reports, but the report is less technical, and more general, suitable for publication.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">SOC 2 was created by AICPA (<\/span><a href=\"https:\/\/www.aicpa.org\/interestareas\/frc\/assuranceadvisoryservices\/aicpasoc2report.html\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">American Institute of CPAs<\/span><\/a><span style=\"font-weight: 400;\">).<\/span><\/p><h2><span style=\"font-weight: 400;\">ISO 27001 vs SOC 2 main comparisons<\/span><\/h2><table><tbody><tr><td>\u00a0<\/td><td><p><b>ISO 27001<\/b><\/p><\/td><td><p><b>SOC 2<\/b><\/p><\/td><\/tr><tr><td><p><b>Geographical scope<\/b><\/p><\/td><td><p><span style=\"font-weight: 400;\">International<\/span><\/p><\/td><td><p><span style=\"font-weight: 400;\">Mostly North America<\/span><\/p><\/td><\/tr><tr><td><p><b>Output<\/b><\/p><\/td><td><p><span style=\"font-weight: 400;\">Certification<\/span><\/p><\/td><td><p><span style=\"font-weight: 400;\">Report\/ Attestation<\/span><\/p><\/td><\/tr><tr><td><p><b>Aimed at<\/b><\/p><\/td><td><p><span style=\"font-weight: 400;\">All organisations in any industry<\/span><\/p><\/td><td><p><span style=\"font-weight: 400;\">Service organisations in any industry<\/span><\/p><\/td><\/tr><tr><td><p><b>Auditing bodies<\/b><\/p><\/td><td><p><span style=\"font-weight: 400;\">Accredited certified bodies<\/span><\/p><\/td><td><p><span style=\"font-weight: 400;\">Any CPA<\/span><\/p><\/td><\/tr><tr><td><p><b>Certification validity<\/b><\/p><\/td><td><p><span style=\"font-weight: 400;\">Three year certification. Interim audits in years 2 and 3<\/span><\/p><\/td><td><p><span style=\"font-weight: 400;\">Annual audit<\/span><\/p><\/td><\/tr><tr><td><p><b>Prescriptive Controls\/ Criteria<\/b><\/p><\/td><td><p><span style=\"font-weight: 400;\">Information Security Management System<\/span><\/p><p><span style=\"font-weight: 400;\">114 controls in 14 areas, plus another 10 management system clauses<\/span><\/p><\/td><td><p><span style=\"font-weight: 400;\">Trust Services Criteria<\/span><\/p><p><span style=\"font-weight: 400;\">5 criteria areas, only Security is mandatory<\/span><\/p><\/td><\/tr><tr><td><p><b>Time to complete<\/b><\/p><\/td><td><p><span style=\"font-weight: 400;\">At least 6 months<\/span><\/p><\/td><td><p><span style=\"font-weight: 400;\">2 to 3 months<\/span><\/p><\/td><\/tr><\/tbody><\/table><p><span style=\"font-weight: 400;\">The above table sets out the key elements of each accreditation.<\/span><\/p><h3><span style=\"font-weight: 400;\">Who should get ISO 27001 and SOC 2 accreditation?<\/span><\/h3><p><b>ISO 27001<\/b><span style=\"font-weight: 400;\"> provides a framework of policies and processes around which organisations of any size, in any industry, can protect their information security.<\/span><\/p><p><span style=\"font-weight: 400;\">By contrast, <\/span><b>SOC 2<\/b><span style=\"font-weight: 400;\"> is aimed at organisations that provide services and systems to client organisations.<\/span><\/p><h3><span style=\"font-weight: 400;\">Scope of ISO 27001 vs SOC 2<\/span><\/h3><p><span style=\"font-weight: 400;\">The scope of ISO 27001 is more extensive than that of SOC 2. ISO 27001 encompasses the entire organisation, their processes and documentation, while SOC 2 is about the service in scope only, the rest of the organisation is not considered in the SOC 2 audit.<\/span><\/p><p><span style=\"font-weight: 400;\">A further difference is the way in which they are maintained.<\/span><\/p><p><b>ISO 27001<\/b><span style=\"font-weight: 400;\"> requires proof of an ongoing information security management programme. ISO 27001 certification is valid for three years, with interim audits in years two and three of the cycle aimed at verifying that the organisation has a full information security management system in place that is regularly reviewed and updated based on changing risk.<\/span><\/p><p><span style=\"font-weight: 400;\">ISO 27001 is designed around the <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/youre-going-for-iso-27001-certification-now-what\/\"><span style=\"font-weight: 400;\">Information Security Management System<\/span><\/a><span style=\"font-weight: 400;\"> (ISMS) which must address the 10 clauses and 114 controls (Annex A) contained in the ISO 27001 standard. Organisations may exclude selected controls based on a legitimate justification.<\/span><\/p><p><span style=\"font-weight: 400;\">The clauses and controls are designed to touch every area of information security, including organisational commitment to information security, risk identification and management, and specific areas of information security including access control, human resources security, secure development practices, physical security, business continuity, incident response, and more.<\/span><\/p><p><b>SOC 2<\/b><span style=\"font-weight: 400;\"> is an attestation that is renewed each year with an annual audit. Every year, the organisation must prove that a relevant information security programme has been designed (Type I), and that the security controls to protect customer data are in place (Type II).<\/span><\/p><p><span style=\"font-weight: 400;\">SOC 2 is more flexible than ISO 27001. In order to receive a SOC 2 report, organisations must demonstrate that they have met the requirements set out in the <\/span><a href=\"https:\/\/soc2.co.uk\/soc-2\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Trust Service Criteria<\/span><\/a><span style=\"font-weight: 400;\"> relevant to their business. SOC 2 defines five trust service principles, security, availability, processing integrity, confidentiality, and privacy.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">Out of these five trust service criteria, only the Security principle is mandatory, and organisations can select other criteria based on their unique circumstances. Each of the criteria has defined requirements (but not controls) that must be met in order to achieve the criteria.<\/span><\/p><h3><span style=\"font-weight: 400;\">ISO 27001 vs SOC 2 audit process and outputs<\/span><\/h3><p><a href=\"https:\/\/outofsite.biz\/cynance\/youre-going-for-iso-27001-certification-now-what\/\"><span style=\"font-weight: 400;\">Preparation for both ISO 27001<\/span><\/a><span style=\"font-weight: 400;\"> and SOC 2 is fairly similar. Best practice suggests that organisations should carry out the following preparation activity:<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Carry out a gap analysis exercise against the ISO 27001 Annex A controls, or the SOC 2 trust service criteria<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Identify the organisation\u2019s information security risks and how those risks are addressed<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Identify which controls can be excluded (ISO 27001), or which criteria are relevant (SOC 2)<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Implement any identified actions to close gaps in the information security programme<\/span><\/li><\/ul><p><span style=\"font-weight: 400;\">This preparation typically takes two to three months for SOC 2, and can take six to twelve months for ISO 27001.<\/span><\/p><p><span style=\"font-weight: 400;\">An <\/span><b>ISO 27001<\/b><span style=\"font-weight: 400;\"> certification audit is split into two sections. Stage 1 will examine the organisation\u2019s compliance with the clauses set out in the standard, while the Stage 2 audit will examine compliance with the Annex A controls. The final output of the audit will be a pass or fail and certification.<\/span><\/p><p><span style=\"font-weight: 400;\">The <\/span><b>SOC 2<\/b><span style=\"font-weight: 400;\"> audit will test the controls defined by the organisation in their information security programme. The output of the audit is a detailed, unique SOC 2 Report, which sets out all of the following: An opinion letter, management assertion, detailed description of the system or service, details of the selected trust services categories, tests of controls and results, and any relevant additional information.<\/span><\/p><h2><span style=\"font-weight: 400;\">Which is better: ISO 27001 or SOC 2?<\/span><\/h2><p><span style=\"font-weight: 400;\">ISO 27001 and SOC 2 both aim to achieve the same outcome &#8211; assurance that an organisation has an <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/security-risk-and-compliance\/\"><span style=\"font-weight: 400;\">information security programme<\/span><\/a><span style=\"font-weight: 400;\"> in place. There is significant overlap between the two, and attaining one standard can support attaining the other.<\/span><\/p><p><span style=\"font-weight: 400;\">However, ISO 27001 is an international standard based in Europe, while SOC 2 is more closely associated with North America. Many organisations based in North America, or who aim to provide services to customers in North America will aim to get SOC 2 attestation, but outside of North America, ISO 27001 is much more popular.<\/span><\/p><p><span style=\"font-weight: 400;\">Another consideration is that SOC 2\u00a0 doesn\u2019t contain details about how to implement it. As a result, some organisations may choose to build their SOC 2 compliance programme around the <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/benefits-of-iso-27001-cybersecurity-framework\/\"><span style=\"font-weight: 400;\">ISO 27001 framework<\/span><\/a><span style=\"font-weight: 400;\"> which is more comprehensive and designed to create a more rigorous cybersecurity programme. This may make it possible for an organisation to attain both standards in tandem.<\/span><\/p><p><span style=\"font-weight: 400;\">Ultimately, the decision whether to go for one over the other will be based on what your customers want more. However, if you do have to do both, it is worth considering them both in tandem because of the obvious overlaps between the two.<\/span><\/p><p><span style=\"font-weight: 400;\">Stay safe<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>\u201cDo you have ISO 27001 certification?\u201d, \u201cWe only do business with organisations who have SOC2 accreditation\u201d. As a startup you may be asked questions just like this frequently by customers, auditors, regulators, the board, and many others. But, if there is a choice of ISO 27001 vs SOC 2, which one should you be pursuing?&hellip;<\/p>\n","protected":false},"author":10,"featured_media":8122,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[63,62],"_links":{"self":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/8107"}],"collection":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/comments?post=8107"}],"version-history":[{"count":14,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/8107\/revisions"}],"predecessor-version":[{"id":8121,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/8107\/revisions\/8121"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media\/8122"}],"wp:attachment":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media?parent=8107"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/categories?post=8107"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/tags?post=8107"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}