SOC 2 and ISMS: How the Two Frameworks Fit Together

Share with

Contents

SOC 2 and ISMS often land on the same desk in the same quarter. A large customer asks for a SOC 2 report, a European prospect asks for an ISO 27001 certificate, and the security lead has to work out whether that means one project or two.

The short answer: SOC 2 and ISMS solve different problems with heavily overlapping evidence. An ISMS is the management system you run every day. SOC 2 is an audit report about how well your controls worked over a set period. One is the engine, the other is a statement about the engine.

Treating SOC 2 and ISMS as separate programmes is the expensive route. Teams end up with two control lists, two evidence folders and two sets of interviews for the same access reviews. Built together on a single information security management system, most of the work is shared and only the reporting differs.

What SOC 2 and ISMS Each Mean

SOC 2 in Short

SOC 2 is an attestation report issued by a licensed CPA firm under the AICPA framework. It examines controls against the Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality and Privacy.

Security is the common criteria and is always included. The other four are optional and chosen based on what you promise customers, which is also the main line between SOC 1 and SOC 2 work. A SOC report is not a certificate and there is no pass mark. The auditor gives an opinion and lists any exceptions, and the reader decides whether that is acceptable.

ISMS in Short

An ISMS is the set of policies, roles, risk decisions and controls an organisation uses to protect information. When it is built to ISO 27001, an accredited body can audit and certify it.

Certification runs on a three-year cycle with annual surveillance audits. The system centres on a documented risk assessment, a risk treatment plan and a Statement of Applicability that justifies each of the 93 Annex A controls you apply or exclude.

SOC 2 Type 1 and Type 2

Type 1 looks at whether controls are suitably designed at a single date. It is quick to reach and useful when a deal needs something now.

Type 2 looks at whether those controls actually operated over a review period, usually three to twelve months. It carries far more weight with buyers because it tests behaviour, not intent.

Most companies start with Type 1 and follow with Type 2 covering the months after. If your ISMS is already running, you can often go straight to Type 2, since the evidence trail already exists.

Key Differences Between SOC 2 and ISMS

Point	SOC 2	ISO 27001 ISMS
Output	Auditor's report with opinion	Certificate
Issued by	Licensed CPA firm	Accredited certification body
Basis	Trust Services Criteria	Risk assessment plus Annex A
Scope	A defined system or service	The organisation or a defined boundary
Sharing	Usually shared under NDA	Certificate is public
Cycle	Report per period	Three-year cycle with surveillance
Recognition	Strongest in North America	Recognised worldwide

One difference matters more than the rest. SOC 2 reports what you did. ISO 27001 asks why you chose to do it, through documented risk decisions. That is why an ISMS makes a good foundation for SOC 2, while a SOC 2 report alone does not build a management system.

Where SOC 2 and ISMS Overlap

Most control areas serve both audits with the same evidence.

Access provisioning, review and removal
Change management and release approvals
Third party and vendor security reviews and contracts
Information security incident management records and response timelines
Business continuity and backup testing
Security awareness training records and onboarding checks
Vulnerability management, logging and monitoring
Risk assessment and treatment decisions

In practice the same access review spreadsheet, ticket history and training register are pulled twice. Collect them once, tag them to both frameworks, and the second audit becomes a mapping exercise rather than a fresh project.

Want to see one control set serving two audits? Try Effivity for Free and set up your control register in an afternoon.

Free Trial →

What Does Not Carry Across

Overlap is high, but it is not complete, and assuming otherwise causes late surprises.

SOC 2 asks you to describe the system, publish commitments to customers, and stand behind service levels such as availability targets. That description and the management assertion have no direct equivalent in ISO 27001.

ISO 27001 asks for things SOC 2 never requests: a Statement of Applicability, formal internal audit programmes, management review meetings with defined inputs, and documented improvement actions with owners and dates.

Privacy also splits. The SOC 2 privacy criteria cover notice, choice and disclosure. Statutory duties like GDPR compliance sit outside both frameworks and need their own controls.

Which Comes First

There is no universal order, but the pattern across implementations is consistent.

Start with ISO 27001 when you sell internationally, when several standards or customer questionnaires are already in play, or when you want a repeatable system rather than an annual scramble. The management system then feeds SOC 2 with almost no rework.

Start with SOC 2 when a specific North American deal depends on it and the timeline is short. A Type 1 can be reached faster. Just design the controls so the ISMS structure can be layered on later instead of rebuilding.

Doing both from the beginning suits mid-sized SaaS teams with a global customer base. The extra cost over a single framework is modest once the evidence is shared.

Running SOC 2 and ISMS as One Programme

Define the scope once, covering the systems, teams and locations in both audits.
Build one control register, with each control mapped to Annex A references and Trust Services Criteria.
Assign one owner per control, not per framework.
Automate evidence collection so records carry dates, approvals and version history.
Run internal audit and management review on the ISMS cycle, and use those findings as SOC 2 readiness checks.
Track corrective actions in a single log so nothing is fixed twice or missed once.

The most common failure we see is control drift between audits. Access reviews run monthly for three months before the SOC 2 window, then slow down. Type 2 testing samples the whole period, so a gap in month seven shows up as an exception. Steady rhythm beats a pre-audit sprint every time.

Managing the Evidence in One Place

Shared drives make this harder than it needs to be. Auditors ask who approved a change, when a policy version took effect and whether every new joiner completed training, and those answers should take minutes.

Effivity's information security management software holds the ISO 27001 structure that both audits draw on: an information asset register, risk management, Statement of Applicability controls, incident handling, supplier management, training records, audit management and document control with full version history. All 93 Annex A controls are available out of the box, and every record carries a timestamped audit trail suitable for Type 2 sampling.

Get a Free Personalized Demo to see how one control set can support both reports.

Free Demo →

Frequently Asked Questions

No. An ISMS is the management system you operate, while SOC 2 is an independent report on how your controls performed over a period.

Not automatically, but it covers a large share of the Security criteria. You still need the system description, management assertion and a CPA audit.

Neither is better. SOC 2 carries most weight with North American buyers, while ISO 27001 is the globally recognised certification.

Usually three to twelve months, with six or twelve months being most common. Shorter windows give buyers less assurance.

Yes. Map each control to both Annex A and the Trust Services Criteria, then collect the evidence once with clear dates and owners.

No. It is an attestation report with an auditor's opinion, shared with customers, usually under a non-disclosure agreement.

Share with