The transition from ISO/IEC 27001:2013 to the 2022 edition had a hard deadline of 31 October 2025, according to a certification body's explanation of the International Accreditation Forum's rules. Certification today is against the 2022 edition. Its Annex A is aligned to ISO/IEC 27002:2022, which has 93 controls, replacing the older set of 114.
If customers ask you for both SOC 2 and ISO 27001, the order you do them in matters. This post gives a sequencing view by company stage. The stage advice is my judgment from the sources, not a rule.
What's affected
The two are different things. A CPA firm's guide (14 October 2026) says ISO 27001 is an international certification of your information security management system issued by an accredited certification body, while SOC 2 is a US attestation report issued by a CPA firm with detailed test results. It adds that many controls overlap, so companies often pursue both and reuse evidence, and that companies already audited against something like ISO 27001 move faster.
Another difference from the same guide: SOC 2 has no "thou shalt" list. The AICPA provides criteria and you design controls. ISO 27001 asks for a management system with a risk assessment, a statement of applicability, internal audit and management review, and the transition guidance mentions updating the statement of applicability as a core transition item.
How to check if you're exposed
Ask each customer what they actually need. Write down for each deal: SOC 2 report, ISO certificate, either, or a questionnaire. The CPA firm's guide says most enterprise clients, and nearly all financial institutions, want a Type 2. Look at your pipeline, not at a generic ranking.
What to do now
| Stage | Typical situation | Suggested order |
|---|---|---|
| Seed, under 20 people | One enterprise deal asking for a report | Controls first. SOC 2 Type 1 or a short Type 2 if the buyer accepts it. Ask them. Defer ISO unless a named customer requires it |
| Series A, 20 to 60 people | Several buyers asking, some outside the US | SOC 2 Type 2 first, then extend your risk assessment, policies and internal audit toward ISO 27001 |
| 100 to 200 people | Multiple regions, procurement teams, regulated customers | Run both on one control set with a shared evidence calendar, certification body and CPA firm scheduled to avoid overlap |
Practical steps for any stage:
- Build one control library with columns for SOC 2 criteria and ISO 27001 clauses or Annex A controls. Map each control once.
- Write one risk assessment that satisfies both. SOC 2 expects a documented assessment annually, and ISO 27001 builds around risk treatment.
- Keep one policy set. Policies that match practice satisfy both.
- Add ISO management system items when you decide to pursue it: scope statement, statement of applicability, internal audit, management review.
- Agree audit windows so the evidence period and the certification audit do not collide with a busy release cycle.
- Use the same evidence calendar for both. One access review should satisfy both auditors if it contains the information each needs.
How to avoid this trap
- Do not start ISO 27001 only because a blog said it is more valuable. Start it because a customer or market needs it.
- Do not build two risk registers.
- Do not treat the SOC 2 report as an ISO certificate. They are not interchangeable, and sales material must describe each correctly.
- Do not use the 2013 control numbering in your mappings. It is retired.
- Do not promise customers a date until both audit firms have confirmed scheduling.
Why it matters
Customers rarely care which framework you hold. They care that a qualified third party has tested your controls. A single control set with a shared calendar lets you answer either request without doubling the work.
Try it yourself
Take ten of your controls and write the SOC 2 criteria group and the ISO 27001 Annex A theme next to each. Gaps where a control only fits one are your real extra work.
Click through it at your own pace, or open it full screen.
Quick check
Who issues a SOC 2 report and who issues an ISO 27001 certificate?
A CPA firm issues a SOC 2 report. An accredited certification body issues an ISO 27001 certificate.
How many controls does the 2022 Annex A set contain?
93, replacing the 114 controls in the 2013 set.
