How to Leverage ISO 27001 to Obtain a SOC 2 Report

Originally published by BARR Advisory.

Written by Kyle Cohlmia.

If your organization has scaled to work with clients in and outside of the U.S., you might be curious about the benefits of a compliance framework that meets both national and international requirements. Two compliance standards to consider are ISO 27001 and SOC 2, which both help your organization meet compliance requirements and keep your customer data safe.

Let’s take a look at some of the differences between an ISO 27001 certification and a SOC 2 report and the benefits of obtaining both.

ISO 27001 vs. SOC 2

While the two frameworks cover similar topics, one big difference between ISO 27001 and SOC 2 engagements is that specific standards can be certified under the ISO 27001 series. SOC 2 audits result in an attestation report rather than certification.

As an internationally accepted standard, ISO 27001 is also great for organizations serving clients abroad. SOC 2 uses the U.S.-based AICPA Trust Services Criteria to meet the needs of a broad range of users that require detailed information and assurance about the controls of service organizations.

When choosing the right framework—or both—to best support your organization, you’ll want to consider available resources, organization complexity, location, and how much time you have to go through the audit process.

Achieving Both ISO 27001 and SOC 2—How it Works

So, how does it work to audit against two frameworks through one engagement? While ISO 27001 might seem like a complex process, the framework is relatively flexible. While certifying toward ISO 27001 takes a certain amount of initial planning, its flexibility means most requirements will map over seamlessly with SOC 2 controls.

Let’s explore the details of the process.

Timeframes

Certification to ISO 27001 consists of two stages, both including walkthroughs, a review of nonconformities, and a remediation plan. Following preparation for the two-stage ISO audit, stage one generally takes two to three days to complete. Stage two can be achieved for most organizations within one to two weeks.

The duration for SOC 2 reporting depends on the type you acquire. If your organization has previously documented your controls through an automation partner, Type 1 reports may be performed immediately. Type 1 reports offer a point-in-time service, testing your design on a specific date. Type 2 reports are generally audited throughout a three to 12-month period.

Benefits

Having ISO 27001 certification and a SOC 2 report under your belt increases consumer trust, and you’ll stand out as an organization that takes security seriously while instilling the most confidence in your clients.

Benefits of obtaining both ISO 27001 and SOC 2:

• Save time and resources to achieve security and compliance
• Increase your customer trust
• Enhance organizational brand value
• Avoid fines and penalties
• Remain transparent with stakeholders
• Assure that controls are operating effectively
• Keep up-to-date with regular requirements