ISO 27001 vs SOC 2: which one do you need, and what do devices prove?

Last updated: 2026-10-15

ISO 27001 vs SOC 2 comes down to output and market. ISO 27001 is an international certification of your information security management system; SOC 2 is a US attestation report on how your controls work over time. European buyers usually expect ISO 27001, North American buyers SOC 2. Both audits end up checking the same thing on laptops: proof of IT fleet security.

The reference scenario here is a 50 to 500-person company selling software or services to larger customers, with a distributed team working on Mac and Windows laptops.

Quick verdict

• Choose ISO 27001 if most of your customers are in Europe, Asia or the public sector, or if you want a certificate you can show on a security questionnaire in one line.

• Choose SOC 2 if you sell SaaS to North American companies whose procurement teams ask for "your latest SOC 2 Type II report".

• Plan for both if you sell on both sides of the Atlantic: the controls overlap heavily, and the device evidence can be collected once and reused.

Frameworks and audit practices checked in October 2026.

How we compared ISO 27001 and SOC 2

The comparison uses six criteria that decide the choice for a growing B2B company: what each one proves, who audits and how, which customers ask for it, what it requires on endpoint devices, the ongoing effort, and how far one covers the other. Sources are the ISO/IEC 27001:2022 control list, the AICPA Trust Services Criteria, and the published guidance of accredited auditors. No prices are given because audit fees depend on scope and auditor.

Endpoint devices get their own section because they are where most audits stall: a policy says laptops are encrypted, and the auditor asks for the list of laptops and the proof, device by device.

What is ISO 27001?

ISO/IEC 27001 is the international standard for building, running and improving an information security management system. Certification shows that a company has identified its information security risks, chosen controls to treat them, and runs a cycle of internal audits, management reviews and corrective actions. It applies to any sector and any size of company.

The standard has two parts. Clauses 4 to 10 describe the management system itself: scope, risk assessment, policy, objectives, internal audit and continual improvement. Annex A lists 93 reference controls grouped into organisational, people, physical and technological themes. The company documents which controls apply in a Statement of Applicability (SoA) and justifies any exclusion. Certificates issued against the 2013 version had to move to the 2022 version by 31 October 2025, so any certificate a supplier shows today should reference ISO/IEC 27001:2022.

How the management system works day to day is covered in our guide to the ISMS and how to implement it.

What is SOC 2?

SOC 2 (System and Organization Controls 2) is an attestation report issued by a licensed CPA firm on a service organisation's controls, measured against the AICPA Trust Services Criteria. A Type I report assesses whether controls are well designed on a given date. A Type II report also tests whether they operated effectively throughout an observation period.

Only the security criterion, also called the Common Criteria (CC1 to CC9), is mandatory. Availability, processing integrity, confidentiality and privacy are added when customers need them. SOC 2 is not a certification: there is no pass or fail mark and no certificate, but an opinion from the auditor and a description of any exceptions found. Buyers read the report, check the exceptions and the complementary controls they must run on their side, and file it in their vendor risk register.

What does each one actually prove to a customer?

ISO 27001 proves that a management system exists and is maintained: risks are assessed, controls chosen, and the system is audited every year. SOC 2 Type II proves that specific controls worked during a defined period, with test results and exceptions. One answers "is security governed?", the other "did the controls run as described?".

In practice, a certificate is easier to share. It fits on a website or a tender response, and anyone can check it with the certification body. A SOC 2 report is a long document that the buyer's security team reads in detail, which gives them more information but also exposes every exception the auditor recorded.

Advantage: tie (ISO 27001 for public proof, SOC 2 for depth of evidence).

Who audits, and how long does each process take?

An ISO 27001 certification audit is run by a certification body accredited by a national accreditation body, in two stages: a documentation review, then an audit of how the ISMS operates. A SOC 2 audit is run by a CPA firm. A Type II report cannot be issued before the observation period ends, usually 3 to 12 months after controls are in place.

For a first audit, the critical path is rarely the auditor. It is the time needed to produce evidence that controls are running: access reviews, onboarding and offboarding records, patching history, and the endpoint inventory. A company starting from scratch should expect several months of preparation for either framework before the audit itself.

Advantage: ISO 27001 for speed to a first result (no mandatory observation period), SOC 2 Type I if a US prospect accepts a point-in-time report as a first step.

Which customers and markets ask for which?

European, UK and Asian buyers, and most public tenders, ask for ISO 27001. North American buyers, especially in SaaS procurement, ask for a SOC 2 Type II report. Regulations such as DORA for financial entities in the EU and NIS2 for essential and important entities do not require either one by name, but ISO 27001 is widely used to structure compliance with them.

The practical test is the security questionnaire. If the first question from your largest prospects is "Are you ISO 27001 certified?", the choice is made. If it is "Please share your SOC 2 Type II report", it is made the other way. Companies growing from Europe into the US often start with ISO 27001, then add SOC 2 once US revenue justifies it.

Advantage: depends on where your customers are.

What do ISO 27001 and SOC 2 require on laptops and phones?

Both frameworks expect the same core device controls: a complete inventory of devices and their owners, encryption, protection against malware, patch and configuration management, secure authentication, and verified data deletion when a device is reassigned or retired. ISO 27001 names them in Annex A; SOC 2 places them under the Common Criteria for logical and physical access.

On the ISO 27001 side, asset management starts with control 5.9 (inventory of information and other associated assets) and continues with 5.10 (acceptable use), 5.11 (return of assets) and 7.14 (secure disposal or re-use of equipment). The technological controls of section 8 then cover the device itself: 8.1 (user endpoint devices), 8.5 (secure authentication), 8.7 (protection against malware), 8.8 (management of technical vulnerabilities), 8.9 (configuration management), 8.10 (information deletion) and 8.24 (use of cryptography). Remote work adds 6.7 (remote working) and 7.9 (security of assets off-premises).

SOC 2 device management sits mainly in CC6 and CC7. CC6.1 covers logical access and the inventory of information assets, CC6.5 requires that protections are removed from a physical asset only after its data can no longer be read or recovered, CC6.7 restricts and protects the movement and removal of information (encrypted laptops and removable media), and CC6.8 covers the prevention and detection of malicious or unauthorised software. CC7.1 adds the detection of configuration changes and new vulnerabilities.

Advantage: tie. The device controls overlap almost completely, which is why one set of evidence can serve both audits.

Which device evidence will the auditor ask for?

Auditors do not accept a policy alone: they sample devices and ask for system-generated proof. For a distributed team, that means an inventory export that matches HR records, MDM compliance reports showing encryption and OS versions, and a deletion record for every device returned or retired during the period.

Use this checklist to prepare the endpoint part of either audit:

The two most frequent exceptions are devices missing from the inventory (bought locally by a manager, or kept by a leaver) and retired laptops with no deletion record. Both come from the device lifecycle rather than from technology, which is why the procurement and offboarding process matters as much as the security tooling. Our guide to choosing and installing an MDM covers the enrolment side, and the information system security policy is where the device rules are written down.

How much ongoing effort does each one require?

ISO 27001 runs on a three-year cycle: one certification audit, two yearly surveillance audits, then recertification, with internal audits and management reviews in between. SOC 2 Type II is renewed every year with a new observation period. Both require evidence to be collected continuously, not just before the audit.

The difference is in what the effort goes into. ISO 27001 demands more documentation of the management system itself (risk register, SoA, objectives, review minutes). SOC 2 demands more proof that each control ran every time it was supposed to during the period, which rewards automated evidence collection.

Advantage: ISO 27001 for lighter yearly audits once the system is in place; SOC 2 for companies that already collect evidence automatically.

Does ISO 27001 cover SOC 2?

No, but the overlap is large. Most SOC 2 Common Criteria map to ISO 27001 Annex A controls, so a certified company can reuse policies, risk assessments and evidence. A CPA firm still has to issue a separate SOC 2 report, and ISO 27001 requires management-system elements that SOC 2 does not test.

Several audit firms offer combined engagements where one fieldwork period produces both an ISO 27001 surveillance or certification audit and a SOC 2 report. That only works if evidence is organised by control rather than by framework, which is another reason to keep device evidence in one place.

SOC 2 or ISO 27001: which one should you choose?

The decision depends first on where your customers are, then on how much evidence you can already produce. Most growing companies end up with the framework their largest prospects ask for, then add the second when they enter the other market.

• European SaaS or services company, 50 to 200 people: ISO 27001, because it is the default expectation of European buyers and tenders.

• Company selling mainly to US mid-market and enterprise customers: SOC 2 Type II, because US procurement teams rarely accept a certificate in its place.

• Company in a regulated sector in the EU (finance, health): ISO 27001 as the backbone for DORA or NIS2 requirements, with SOC 2 if US customers ask for it.

• Company expanding from Europe to the US: keep ISO 27001 and add a SOC 2 Type II report, reusing the same device and access evidence.

• Company with no dedicated security team: whichever framework you choose, outsource the parts that generate evidence, starting with device lifecycle and MDM, so the audit is not blocked by missing inventory or wipe records.

Prepare your device evidence for ISO 27001 and SOC 2 with Fleet

Endpoint controls are where both audits get concrete: an inventory that matches HR records, encryption and OS versions reported per device, laptops returned by every leaver, and a deletion record for each retired machine. A small IT team can assemble this by hand, but every laptop bought locally or kept after an exit becomes an audit exception.

Fleet manages the device lifecycle end to end in one platform, across 150+ countries, from the first laptop to its second life:

• Audit-ready inventory: every device, OS version and compliance status tracked in the Cockpit dashboard.

• Security policies applied: Fleet MDM applies your security policies, with remote enrolment, configuration and wipe; Fleet's security partners are ISO 27001 and SOC 2 certified.

• Configured before arrival: devices are pre-configured through zero-touch enrolment, so they are managed from day one.

• Clean offboarding: order, deliver, store, transfer and redeploy devices from one place, without a local supplier per country.

• Controlled end of life: devices are renewed every 3 years and Fleet handles their second life.

Fleet already equips over 100,000 users from 1,500 companies. Book a demo and see how Fleet helps you turn device management into audit evidence.

FAQ

Is SOC 2 harder than ISO 27001?

Neither is objectively harder. SOC 2 Type II is more demanding on proof of operation, because the auditor tests controls across a whole period. ISO 27001 is more demanding on governance, because it requires a documented risk-based management system with internal audits and management reviews.

Can a company get ISO 27001 and SOC 2 at the same time?

Yes. Many companies run a combined programme with a shared control set and one evidence repository. Some audit firms are both an accredited certification body and a CPA firm, or partner with one, and schedule both audits in the same period.

Is ISO 27001 recognised in the United States?

Yes. ISO 27001 is recognised worldwide and accredited certification bodies operate in the US under ANAB. US buyers still tend to ask for a SOC 2 report because it is the format their vendor risk processes are built around.

Does SOC 2 require an MDM?

SOC 2 does not name a tool. It requires that devices are inventoried, protected against malware, encrypted where they hold sensitive data, and wiped before disposal. For a company with remote laptops, an MDM is the usual way to enforce and prove those controls.

What is ISO 27001 asset management?

It is the set of Annex A controls that require an inventory of information and associated assets, with an owner for each one, rules for acceptable use, the return of assets when people leave, and secure disposal or re-use of equipment. Laptops and phones are the assets auditors sample most often.

Conclusion

ISO 27001 and SOC 2 differ in format, auditor and market, but they ask the same questions about laptops and phones. Choose the one your customers request first, and organise device evidence once so the second framework costs far less than the first.