ISO 27001 vs SOC 2: Key Differences, Benefits, and Which One You Need

ISO 27001 and SOC 2 are both information security frameworks, but they do very different things. ISO 27001 is a globally recognised certification; it tells clients and partners that your organisation manages information security through a proper, documented system called an ISMS (Information Security Management System). SOC 2 works differently. It is an attestation report, not a certificate, and was developed specifically for the US market by the American Institute of Certified Public Accountants (AICPA) to demonstrate that your security controls meet its Trust Services Criteria.

In simple terms, if your customers are based in New Zealand or anywhere outside North America, ISO 27001 is usually what they expect. If you are selling to US businesses, SOC 2 is what they ask for in their vendor questionnaires. Whether you need one or both really comes down to who your customers are and where they are based.

What Is ISO 27001?

ISO 27001 is an international standard for information security published jointly by the International Organisation for Standardisation and the International Electrotechnical Commission. It sets out what an organisation must do to establish, operate, and continuously improve an Information Security Management System (ISMS), a documented, risk-based approach to protecting sensitive data across people, processes, and technology.

The current version, ISO/IEC 27001:2022, reorganised the control set from 114 controls across 14 domains into 93 controls across four themes: Organisational, People, Physical, and Technological. Eleven new controls were added, covering areas like threat intelligence, cloud security, and secure coding practices.

ISO 27001 certification is granted by an accredited certification body, an independent third party recognised by organisations such as UKAS in the UK or JAS-ANZ covering Australia and New Zealand. The certification is valid for three years, with annual surveillance audits in years one and two and a full recertification audit in year three.

For New Zealand enterprises, government agencies, and businesses operating across the Asia-Pacific region, ISO 27001 compliance is frequently a contractual requirement before a vendor is onboarded. It also directly supports compliance with the NZ Privacy Act 2020, which requires organisations to take reasonable steps to protect the personal information they hold.

What Is SOC 2?

SOC 2, which stands for System and Organization Controls 2, is a compliance framework developed by the American Institute of Certified Public Accountants (AICPA). The framework specifies how organisations should protect customer data from unauthorised access, cybersecurity incidents, and other vulnerabilities. A SOC 2 report attests to the operating effectiveness of an organisation’s security protocols and helps establish trust with your customers.

SOC 2 is built around five Trust Service Criteria:

• Security: the only mandatory criterion; protects systems from unauthorised access
• Availability: systems are available for operation as agreed
• Processing Integrity: processing is complete, accurate, and authorised
• Confidentiality: confidential information is protected as committed
• Privacy:  personal information is collected, used, and retained appropriately

There are two types of SOC 2 audit:

SOC 2 Type 1 evaluates whether your security controls are properly designed at a single point in time. It answers the question: Are the right controls in place?

SOC 2 Type 2 (also written SOC 2 Type II) assesses whether those controls operated effectively over a review period, typically six to twelve months. It answers: Did those controls actually work as intended, consistently?

Most enterprise buyers in the United States require a SOC 2 Type 2 report, not Type 1, because it demonstrates consistent performance rather than a snapshot. The output is a detailed attestation report, typically 60 to 150 pages, that is usually shared under a non-disclosure agreement because it contains detailed information about your internal systems and any exceptions the auditor found.

For NZ SaaS companies, cloud providers, and IT service organisations selling to US-headquartered clients, SOC 2 compliance is increasingly a non-negotiable requirement to win and keep those contracts.

ISO 27001 vs SOC 2: Key Differences and Similarities

Understanding the difference between ISO 27001 and SOC 2 comes down to six practical areas. Here is a straightforward breakdown:

1. Scope

ISO 27001 covers your entire ISMS. It takes an organisation-wide view, assessing how your business manages information security across all departments, systems, and processes. This makes it more thorough but also more demanding to implement.

SOC 2 is scoped to a specific system, product, or service. A SaaS company can limit its SOC 2 audit to a single platform, which is why early-stage businesses often choose it first; the scope is manageable before a full ISMS is built out.

2. Certification vs Attestation

ISO 27001 produces a certificate, a one or two-page document confirming your ISMS meets the standard. It is binary: you pass, or you don’t. You can display it publicly on your website and in marketing materials.

SOC 2 produces an attestation report. Your auditor (a licensed CPA) gives a professional opinion on your controls, including any exceptions. Because the report contains detailed system descriptions and test results, it is typically shared under NDA rather than published openly.

3. Who Performs the Audit

For an ISO 27001 certification audit, the auditor must be accredited by a certification body. The Stage 1 audit reviews your documentation; the Stage 2 audit assesses actual implementation across your organisation.

For SOC 2 attestation, the auditor must be a licensed Certified Public Accountant (CPA) firm. In New Zealand and the UK, equivalent accounting bodies can perform this role.

4. Validity and Renewal

ISO 27001 certificates last three years. Annual surveillance audits check that you are maintaining your ISMS, and a full recertification happens every three years.

SOC 2 reports cover a specific period and are typically renewed annually. Most buyers expect to see a report issued within the last twelve months.

5. Market Applicability

This is the most important practical difference. ISO 27001 is the dominant standard across New Zealand, Australia, Europe, the Middle East, and most international markets. SOC 2 is the standard most commonly requested in the United States and Canada, and is gaining recognition in Australia among companies that serve US-based multinationals.

6. Control Overlap

Despite their different structures, ISO 27001 and SOC 2 share approximately 70–80% of underlying control requirements. Both frameworks require risk assessment, access control, incident response, change management, vendor risk management, encryption, and security awareness training. This overlap is significant, it means achieving one framework gives you a strong head start on the other.

ISO 27001 vs SOC 2 at a Glance

ISO 27001 vs SOC 2: Structure, Cost and Best Fit

Beyond the basics, here is how the two frameworks compare on structure, audit process, cost, and who each one suits best

Which Framework Is Right for New Zealand Businesses?

The right answer depends on who your customers are and what they ask for. Here is a practical way to think through it.

Choose ISO 27001 if:

• Your customers are based in New Zealand, Australia, Asia-Pacific, Europe, or the Middle East
• You are selling to NZ government agencies or large enterprises
• You want a publicly visible credential that builds broad market trust
• You operate in a regulated sector, such as finance, healthcare, or critical infrastructure, where an ISMS is expected
• You want a structured, long-term security programme, not just a compliance checkbox

Choose SOC 2 if:

• Your customers are primarily US-based enterprise businesses
• You are an NZ SaaS company, cloud provider, or IT services business with US contracts
• You need to demonstrate compliance within a shorter timeframe, a SOC 2 Type 1 can be completed in as little as two to four months
• Your buyers want a detailed report showing exactly what controls you have and how they were tested

Consider both if:

• You serve a mix of US and international enterprise clients
• You are in a competitive market where security maturity is a differentiator
• You handle sensitive customer data across multiple jurisdictions

A large and growing number of New Zealand technology companies are pursuing both. The good news is that the significant overlap between the two frameworks means getting the second certification is substantially cheaper and faster once the first is in place.

If your business also handles personal health information or works with US healthcare organisations, it is worth knowing that compliance frameworks like HIPAA have their own cybersecurity requirements that sit alongside, and sometimes overlap with, what ISO 27001 and SOC 2 require.

Certification Process and Project Timeline

Certification Process and Project Timeline

The path to either certification follows a similar pattern, though the timelines differ.

Step 1 

Gap analysis. Review your existing security controls against the framework requirements. This identifies where you are already compliant and where you need to make improvements. For ISO 27001, this includes defining the scope of your ISMS and understanding which of the 93 Annex A controls apply to your organisation.

Step 2 

Implement security controls and document everything. Put the required controls in place and create the documentation your auditor will review. For ISO 27001, this includes a formal risk assessment (mandatory under Clause 6.1.2), a Statement of Applicability, and evidence of management involvement. For SOC 2, you will document your controls against the relevant Trust Service Criteria and build the evidence your auditor will need.

Step 3

Pre-audit review. Before the formal audit, most organisations conduct an internal review or work with a compliance partner to identify and fix any remaining gaps. This stage prevents surprises during the actual audit.

Step 4 

External audit. For ISO 27001, this involves a Stage 1 documentation review followed by a Stage 2 on-site implementation audit. For SOC 2 Type 2, your auditor tests your controls across the observation period, typically six to twelve months, then issues their attestation report.

How long does it take?

• SOC 2 Type 1: 2-4 months
• SOC 2 Type 2: 6-15 months total, including the observation period
• ISO 27001 certification: 9-18 months from gap assessment to certification

One thing worth knowing: if you need something quickly to unblock a sales deal, a SOC 2 Type 1 is the fastest path to a credible compliance document. If you have six months or more of lead time, going straight to SOC 2 Type 2 avoids spending money on a Type 1 report that you will replace anyway.

Can You Pursue ISO 27001 and SOC 2 Together?

Yes, and for many NZ businesses, it is the most cost-effective approach. Because ISO 27001 and SOC 2 share 70-80% of their control requirements, running them as a combined programme rather than two separate projects typically saves 25-35% of the total cost.

The most practical sequence is to build your ISMS to ISO 27001 requirements first, while simultaneously mapping each control to the relevant SOC 2 Trust Service Criteria. This way, the evidence you gather for your ISO 27001 Stage 2 audit also starts building the record you will need for your SOC 2 Type 2 observation period. A single GRC (governance, risk, and compliance) platform and evidence repository support both frameworks, and your ongoing internal audit programme covers both at once.

The management discipline required by ISO 27001, formal risk assessment, management review, corrective action processes, and continuous improvement, creates a security programme that makes SOC 2 attestation significantly more straightforward. Organisations that build their ISMS first tend to have fewer audit findings and lower annual compliance costs.

Dual certification signals that your security programme is genuinely mature, not just documented. In competitive sales situations, particularly when pitching to enterprise procurement teams in both New Zealand and overseas markets, holding both removes security as an objection entirely.

Compliance frameworks like ISO 27001 and SOC 2 address your policies and processes, but they work best when paired with active technical controls. If you are also reviewing your wider security setup, our guide to protecting your business from cyberattacks covers the practical steps that complement certification work.

Frequently Asked Questions

Is ISO 27001 required in New Zealand?

ISO 27001 is not legally mandatory in New Zealand, but it is widely expected in government procurement, financial services, healthcare, and enterprise vendor assessments. Many NZ organisations treat it as a practical requirement to win contracts rather than a regulatory one.

What is the difference between SOC 2 Type 1 and Type 2?

SOC 2 Type 1 reviews whether your security controls are properly designed at a single point in time. SOC 2 Type 2 assesses whether those controls operated effectively over a period of six to twelve months. Enterprise buyers almost always require Type 2 because it demonstrates consistent performance, not just good design on the day of the audit.

Do NZ companies need SOC 2?

Not all NZ companies need SOC 2, but those selling software, cloud services, or IT services to US enterprise clients increasingly find it mandatory. If your US prospects are asking for it in vendor questionnaires or procurement processes, that is the clearest signal you need it.

Is ISO 27001 equivalent to SOC 2?

No. They are different frameworks produced by different governing bodies for different markets. A prospect that requests ISO 27001 certification will not accept a SOC 2 report in its place, and vice versa. However, the underlying security controls overlap significantly, which is why pursuing both in a combined programme is practical and cost-effective.

How much does ISO 27001 or SOC 2 cost in New Zealand?

Costs vary depending on your organisation’s size and complexity. For smaller NZ businesses, first-time ISO 27001 certification typically ranges from NZD $55,000-$130,000, including consultancy and audit fees. SOC 2 Type 2 for a similar organisation generally runs NZD $45,000-$100,000. Pursuing both as an integrated programme typically costs 25–35% less than running them separately.

Ready to Start Your Compliance Journey?

Whether you are working out where to begin or have already had a customer ask for ISO 27001 or SOC 2 for the first time, the starting point is always the same: understand your current security posture and align it with what your customers actually require.

Compliance work sits alongside your broader security programme, not separate from it. For NZ businesses reviewing both certification and day-to-day security controls, it helps to understand how modern endpoint security solutions fit into your overall setup, since auditors under both frameworks will assess your technical controls alongside your policies and documentation.

If you would like a straight conversation about which certification path makes sense for your business and how long it will realistically take, get in touch with our team to book a free compliance consultation.