Cloud Security Alliance's STAR Level 2 comes in two forms: a STAR Attestation built on SOC 2 and a STAR Certification built on ISO/IEC 27001. CSA treats the two as parallel routes to independent assurance, so a buyer who names one may well accept a clear answer about the other.
What's affected
Small companies asked "do you have SOC 2 or ISO 27001?" The two are different things:
| SOC 2 | ISO/IEC 27001 | |
|---|---|---|
| What you get | A report written by a CPA firm | A certificate from an accredited certification body |
| Basis | AICPA Trust Services Criteria | The standard, with your Statement of Applicability |
The AICPA describes SOC as a suite of services CPAs provide to service organizations. SOC 2 is a report, not a certification.
What to do now
- Read the exact wording. "SOC 2 Type 2 report" and "ISO 27001 certificate" are not interchangeable.
- Ask: would a different assurance satisfy you, or a roadmap letter?
- Count requests over a quarter. Pick the one named more often.
- Share the work: both rely on policies, risk assessment, access control, logging and incident handling, so one evidence set serves either.
- Be wary of promises of a very fast report. The AICPA's site carries 2026 material cautioning about quick-turn SOC engagements. Choose your auditor on reputation, not speed.
How to avoid this trap
- Do not call SOC 2 a certification in sales material.
- Do not start two audits at once with a tiny team.
- Do not pick a scope that excludes the product the buyer is buying.
Try it yourself
Tally the last ten security requests you received and mark which standard each named. The result is your answer.
Click through it at your own pace, or open it full screen.
Quick check
Is SOC 2 a certification?
No. It is an attestation report issued by a CPA firm. ISO/IEC 27001 is the one that results in a certificate.
