ISO and SOC Certifications

Updated: September 29, 2026

Sooner or later a customer's procurement form asks whether you are ISO 27001 certified, or whether you have a SOC 2 report. This section explains what each of those actually is, which ones apply to which kind of business, and what getting one involves — in time, in work, and in what has to change about how you operate.

The short version, before the detail: ISO gives you a certificate, SOC gives you a report, and they answer different questions. Neither of them is a statement that you are secure.

The Difference That Confuses Everyone

An ISO certificate is a binary outcome from an accredited certification body: you conform to the standard across a stated scope, or you do not. It is a public document you can put on a website, and it says nothing about what went wrong during the audit.

SOC — System and Organization Controls — is not a certification scheme at all. It is a family of attestation reports: an independent service auditor examines the controls you put forward and issues an opinion on them. Nobody is “SOC certified”, and a supplier who says they are has told you something about how carefully they read the report.

Which report you are looking at matters, because they are distributed differently:

• SOC 1 and SOC 2 are restricted-use reports. They are intended for a defined audience — your customers, and their auditors — and are normally shared under NDA. A Type 2 report also sets out the tests the auditor performed and their results, including any exceptions, which is what makes it worth reading properly.
• SOC 3 is a general-use report. Same criteria, same examination, but it carries only management's assertion and the auditor's opinion — no control listing, no tests, no results. Because it holds nothing confidential, it can be published openly, and several large providers do exactly that.

So a SOC report is not automatically a detailed document, and not automatically confidential. Ask which report, which type, and for which period.

The other structural difference is time:

Information Security — the ISO Standards

One certifiable management system and three codes of practice that extend it. They are audited together, so the order below is the order they are built in rather than a ranking.

Information Security — the SOC Reports

A different mechanism entirely, as the comparison above sets out: attestation reports rather than certificates. SOC 2 is the one buyers mean; the other two serve narrower purposes.

AI Management

New enough that many procurement teams are still adding it to their questionnaires, and moving faster than anything else in this section.

The Wider Management System Family

These are not security standards, but they are built the same way — the same clause structure, the same audit cycle — so once you have run one, the next costs far less.

How to Choose

The honest answer is that in most cases the market chooses for you, and it is worth being clear about that rather than building a compliance programme on principle.

• Selling to North American companies? They will ask for SOC 2. Start there.
• Selling to European or Asian enterprises, or bidding for public tenders? ISO 27001, and often ISO 9001 alongside it, because a tender scoring sheet asks for a certificate number rather than a report.
• Both markets? Do ISO 27001 first and SOC 2 second. The control work overlaps heavily, and 27001 gives you the management system that makes the SOC 2 evidence collection routine instead of a scramble.
• Selling anything with AI in it? Expect ISO 42001 to appear in questionnaires, and note that it is far cheaper to add once ISO 27001 is already running than to attempt on its own.
• Nobody is asking yet? Then do the underlying work — the security controls, the documented processes, the tested backups — and certify when a deal depends on it. The controls are what protect you; the certificate is what sells.

Three Things to Check on Anyone Else's Certificate

This works in both directions: it is how you evaluate a supplier, and it is what a customer should be doing to you.

1. The scope. A certificate covers a defined scope, and the scope is chosen by the organisation being certified. One product line, one office, or one legal entity out of six is entirely legitimate and entirely different from what the logo implies. Read the scope statement on the certificate, not the badge on the website.
2. The accreditation. An ISO certificate is worth what the certification body behind it is worth, and the body should itself be accredited by a national accreditation body — in Bulgaria that is the Bulgarian Accreditation Service, elsewhere the equivalent national body — operating under the international mutual recognition arrangement. Certificates from unaccredited bodies exist and are cheaper.
3. The date, and for SOC the period. An ISO certificate has an expiry. A SOC report covers a period that has already ended, sometimes many months ago; ask what has happened since, and whether there is a bridge letter covering the gap.

What It Actually Costs

Not in money, which depends entirely on size and on your certification body, but in the things people underestimate:

• Six to twelve months for a first ISO 27001, if you are starting from scratch and someone owns it properly. Less if your controls are already in good shape, more if they are not.
• A named owner with real time. Certification fails most often not on technical controls but on nobody having been given the job.
• Evidence, continuously. The audit does not ask whether you have a process; it asks you to show records that it ran. Reviews that happened without minutes did not happen as far as an auditor is concerned.
• It does not end. Surveillance audits, internal audits, management reviews, risk reassessments — every year, indefinitely. A certificate is an ongoing commitment, and treating it as a project with an end date is the most common way to lose it at the first surveillance audit.

Scope of this section. These pages explain what the standards require and how the process works, from the perspective of people who build and run the infrastructure being audited. We are not a certification body, an accredited auditor or a legal adviser, and nothing here is legal advice. Which standards apply to your business is a question for your legal counsel or a compliance specialist; standards are also revised on a cycle, so confirm the current edition before you commit to anything.