Compliance
Planning a Combined SOC 2 and ISO 27001 Programme
Plan a combined programme as one control set, one risk assessment and one evidence library, mapped to both ISO/IEC 27001 and the AICPA Trust Services Criteria, then put that work through two separate assessments. An accredited certification body audits the ISMS and issues the ISO 27001 certificate; a licensed CPA firm examines the controls and issues the SOC 2 report. SecureRoot is neither: it builds and evidences the shared programme and supports you through both. The implementation is shared. The management system requirements, the SOC 2 system description and the two audit timetables are not, and the plan has to account for each.
About this guide
Written by SecureRoot Risk Advisory LLP.
Start here
Build one control set, not two programmes
Access control, change management, risk assessment, vendor management, incident response, logging and monitoring, and security awareness appear in both frameworks. They are worded differently and satisfied by the same evidence. Running two projects means two policy libraries, two risk registers and engineers answering the same question twice in two vocabularies.
The alternative is a single control matrix in which each control has one owner, one description of how it runs, and two columns: the ISO/IEC 27001 clause or Annex A control it satisfies, and the Trust Services Criteria it supports. Where the two frameworks ask for different strength on the same control, build to the stricter of the two once.
Mapping
Map the two frameworks before you write a policy
The AICPA publishes a mapping of the 2017 Trust Services Criteria to ISO 27001, an .xlsx file dated 4 May 2018 and reserved for AICPA and CIMA members. Two things follow. If you or your CPA firm can open it, it is a starting point from the criteria owner. And because it is dated 2018, it predates ISO/IEC 27001:2022, whose Annex A was reorganised into 93 controls in four themes, so a mapping built on it has to be checked against the 2022 edition you will be certified to.
- 01
Fix both scopes first
Agree the ISMS scope for ISO 27001 and the system boundary for the SOC 2 description at the same time. They do not have to be identical, but every difference is extra work: a system inside one boundary and outside the other needs controls for one audit only. Choose the Trust Services Criteria too. Security is always in scope; add availability, confidentiality, processing integrity or privacy only where a customer or contract asks.
- 02
Run one risk assessment
ISO 27001 requires a documented risk assessment and treatment that drive which Annex A controls apply, recorded in the Statement of Applicability. The SOC 2 common criteria also ask how you identify and reassess risk. One assessment, done to the ISO method, serves both.
- 03
Map each control to both frameworks
For each control, record the ISO clause or Annex A control and the criteria it supports. Mark the rows that serve only one framework. Those are where the extra effort sits, and they are listed in the section below.
- 04
Write policies once, in neutral language
Policies written in one framework's vocabulary are the usual reason the second requirement feels like starting over. Describe what your company does; let the mapping carry the references.
Order of work
Sequence by the deal that is waiting
There is no fixed order. The sequence follows whichever customer or tender is waiting, and the shared control set means work done for the first assessment is not redone for the second.
- A US customer is waiting: a SOC 2 Type 1 tests design on one date and can unblock the deal, while ISO 27001 and a SOC 2 Type 2 follow on the same controls.
- A global or European tender names ISO 27001: certify first. A running ISMS then produces most of what a SOC 2 Type 2 window needs, which can make a separate Type 1 unnecessary.
- Both are needed within the same year: start the SOC 2 observation window as soon as the shared controls are operating, and run the ISO internal audit and management review inside that window, so the same months evidence both.
Published timelines for each, from SecureRoot's pricing page: ISO 27001 takes four to seven months to a first certificate; a SOC 2 Type 1 takes eight to twelve weeks; a first Type 2 takes six to nine months, assuming a three-month observation window. SecureRoot does not publish a single figure for a combined programme, because the overlap depends on your scope. Dates are committed after the gap assessment.
Evidence
Collect evidence once, file it for two assessors
Most evidence serves both assessments if it is created at the right time and filed where both can follow it. A quarterly access review, a change approval, a vendor review, an incident record or a penetration test report with its retest is one record answering one ISO control and one SOC 2 criterion.
Timing is the constraint. A SOC 2 Type 2 auditor samples across the whole observation period and needs records dated when they happened. An ISO certification body samples whether the ISMS operates in practice at Stage 2 and again at each annual surveillance visit. Evidence that is produced continuously, ideally collected by a compliance platform, satisfies both. Evidence assembled before an audit satisfies neither for long.
Where they differ
Where the two do not overlap
Plan these explicitly. They are the work a mapping spreadsheet makes look smaller than it is.
- ISO 27001 only: the management system in clauses 4 to 10, including context, leadership, a documented risk assessment method, the Statement of Applicability covering all 93 Annex A controls with reasons for any exclusion, an internal audit programme and a recorded management review.
- ISO 27001 only: the Stage 1 documentation review and Stage 2 certification audit, then annual surveillance visits by the certification body.
- SOC 2 only: a system description prepared by management against the AICPA description criteria, and a management assertion that your management signs.
- SOC 2 only: the optional criteria you select, and for a Type 2 operating evidence across the whole observation window, with exceptions written into a report your customers read in full.
- SOC 2 only: a new report each period. An ISO certificate is sustained through annual surveillance visits; a SOC 2 report covers a period that ends, and customers usually treat it as current for about twelve months after that, so the next window starts as the last one closes.
External parties
Two independent assessors, contracted separately
The certification body and the CPA firm are different organisations with different standards, scopes and timetables. Each must stay independent of whoever designed and implemented the controls, which is why neither can be SecureRoot and why their fees are never part of SecureRoot's quote.
- Accredited certification body: runs Stage 1 and Stage 2, raises minor or major nonconformities, issues the ISO 27001 certificate, and returns for annual surveillance. It invoices you directly; its fee is priced on organisation size and audit days.
- Licensed CPA firm: performs the SOC 2 examination, tests the controls, records exceptions and issues the report. SecureRoot introduces partner CPA firms during scoping and you contract with your chosen firm directly.
- Align the calendars: book both early, and avoid placing Stage 2 fieldwork and SOC 2 fieldwork in the same weeks, because the same control owners will be answering both.
SecureRoot's part
What SecureRoot does in a combined programme
SecureRoot scopes ISO 27001 and SOC 2 together and runs them from one control set and one evidence base, on a single timeline. For ISO 27001 that covers gap assessment, risk assessment and treatment, the Statement of Applicability, control documentation, implementation support, internal audit and management review, and support through both audit stages. For SOC 2 it covers criteria selection, gap assessment, control design, evidence automation, observation-period support and support through fieldwork. Where penetration testing is part of the evidence, the same team can scope it to the systems the auditors will ask about and time it to the audit window.
Published bands, from the pricing page: ISO 27001 is ₹1.5 lakh to ₹8 lakh as a total to certificate, the certification body's audit included; SOC 2 readiness and audit support is ₹1.5 lakh to ₹4.5 lakh, the same band for either report, with the CPA firm's fee separate. A combined programme is quoted as one fixed price after a scoping call.
Scope boundaries
What this does not cover
- SecureRoot is not an accredited certification body and does not issue ISO/IEC 27001 certificates, and it is not a CPA firm and does not issue SOC 2 reports.
- A shared control set reduces duplicated work; it does not guarantee certification, an unqualified SOC 2 opinion or a report without exceptions.
- The certification body's and the CPA firm's fees, timetables and sampling are set by them, not by SecureRoot.
- Your control owners run the controls and produce the operating evidence for both assessments.
- A mapping is an aid to planning. Each assessor applies its own standard and decides whether evidence is sufficient.
Questions
Common questions
Can one audit cover both ISO 27001 and SOC 2?
No. They are two assessments under two sets of rules: a certification audit by an accredited certification body, and an attestation examination by a licensed CPA firm. Shared evidence can be offered to both, but each assessor tests and reports independently.
Is the AICPA mapping enough to build the control matrix?
It is a starting point, not the matrix. It is dated 2018, before ISO/IEC 27001:2022 reorganised Annex A, and it is reserved for AICPA and CIMA members. Your matrix still needs owners, cadences and the rows that serve one framework only.
Which should come first?
Whichever a customer is waiting for. The comparison of the two, and who asks for which, is covered in our ISO 27001 vs SOC 2 guide.
Primary Sources
Where the Figures on This Page Come From
Every deadline, threshold and control count above is taken from the instrument itself. These are links to the primary text, not to a summary of it.
- Mapping: 2017 Trust Services Criteria to ISO 27001 (4 May 2018, members only)
AICPA and CIMA · Link checked 2026-11-12
- 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (with revised points of focus, 2022)
AICPA and CIMA · Link checked 2026-11-12
- 2018 SOC 2 Description Criteria (With Revised Implementation Guidance, 2022)
AICPA and CIMA · Link checked 2026-11-12
- System and Organization Controls: SOC Suite of Services
AICPA and CIMA · Link checked 2026-11-12
Related
Services and help that go with this
- ISO 27001 vs SOC 2
Which one you need, and who asks for each.
- ISO 27001 certification services
SecureRoot's six phases, through Stage 1, Stage 2 and surveillance.
- SOC 2 readiness and audit support
Criteria selection to fieldwork, Type 1 or Type 2.
- ISO 27001 checklist
Clauses, Annex A and the Statement of Applicability.
- SOC 2 compliance checklist
The common criteria and the evidence behind each.
- Requesting a combined security and compliance engagement
What to send so testing and readiness can be scoped together.
- Pricing
The published ISO 27001 and SOC 2 bands, and what sits outside them.
Scope both on one call
Tell SecureRoot which customers are asking for which, and by when. We will propose one control set, a sequence and one fixed price for the shared programme, and say plainly which fees belong to the certification body and the CPA firm.