SOC 2 vs ISO 27001 vs ISO 42001 (and ISO 27701)

SOC 2: an attestation report from a CPA firm

SOC 2 is an attestation framework published by the AICPA. A licensed CPA firm examines a service organisation's controls against the Trust Services Criteria (security, plus optionally availability, processing integrity, confidentiality and privacy) and issues a report containing the auditor's opinion, management's description of the system and the controls tested.

A Type I report covers the design of controls at a point in time. A Type II report covers design and operating effectiveness over a period, commonly 3 to 12 months. Buyers almost always want Type II.

A SOC 2 report is not a certificate and there is no SOC 2 register. It is a restricted-use document, shared under NDA, and its value lies in reading the scope, period, exceptions and complementary user-entity controls. A SOC 3 is a short general-use summary that can be published. SOC 2 is recognised worldwide but is strongest in North American procurement; it is issued only by CPA firms, which is why OpenDossier prepares evidence for it and introduces firms rather than issuing anything itself.

ISO/IEC 27001: certification by an accredited body

ISO/IEC 27001:2022 specifies requirements for an information security management system: context, leadership, planning, support, operation, performance evaluation and improvement, with Annex A listing 93 reference controls that the organisation selects and justifies in a Statement of Applicability.

Certification is issued by a certification body that is itself accredited by a national accreditation body (for example UKAS in the UK, ANAB in the US, JAB in Japan, SAC in Singapore, JAS-ANZ in Australia and New Zealand). The audit has a stage 1 (documentation readiness) and stage 2 (implementation), then a three-year certificate with annual surveillance audits and recertification. A certificate can be checked through the certification body or, for many bodies, through IAF CertSearch.

ISO 27001 travels well across Europe, Asia-Pacific and the Middle East and is often the first thing a non-US enterprise buyer asks for. The certificate shows the scope statement; as with SOC 2, read the scope before accepting that it covers the service you are buying.

ISO/IEC 42001 and ISO/IEC 27701

ISO/IEC 42001:2023 is the first certifiable management-system standard for artificial intelligence. It follows the same structure as 27001 and adds AI-specific requirements: AI policy, roles, impact assessment, lifecycle controls, data management, transparency and third-party relationships, with Annex A controls and Annex B implementation guidance. Certification is by accredited certification bodies in the same way as 27001; accreditation programmes for 42001 have expanded since 2024, and buyers should check that the body is accredited for 42001 specifically.

ISO/IEC 27701:2025 is the privacy information management standard. The 2019 edition was an extension to 27001; the second edition, published in October 2025, is a standalone management-system standard that can be certified on its own or integrated with 27001. Organisations holding 27701:2019 certificates should ask their certification body about transition timelines.

Enterprise buyers of AI systems increasingly ask for 42001 alongside 27001, and buyers in data-heavy sectors ask for 27701 as evidence that privacy obligations (GDPR, PDPA, APPI) are managed systematically rather than ad hoc.

Timelines and typical costs

Figures below are indicative ranges observed in 2025 and 2026 for small and mid-sized software companies; they vary by scope, size, auditor and readiness. Obtain quotes.

Internal cost (staff time, tooling, remediation) is usually larger than the audit fee. Readiness work compresses timelines: a company with policies, evidence collection and risk assessment already in place can reach stage 2 or the start of a Type II observation period within weeks. OpenDossier's certification-readiness service does that preparation and introduces accredited bodies and CPA firms; it does not audit or certify.

Which buyers ask for which

• US enterprise and SaaS buyers: SOC 2 Type II first; ISO 27001 accepted, sometimes preferred by global groups; both increasingly requested.
• European, UK and Asia-Pacific enterprises and public bodies: ISO 27001 first; SOC 2 accepted; sector schemes may add requirements (for example UK Cyber Essentials, Singapore CSA Cyber Trust mark).
• Financial-services buyers: both, plus regulator-specific outsourcing requirements (for example MAS outsourcing guidelines, EU DORA for ICT third parties).
• Buyers of AI systems: ISO 42001 or evidence mapped to it and to NIST AI RMF, alongside 27001 or SOC 2.
• Buyers processing personal data at scale: ISO 27701 or equivalent privacy evidence, plus a data processing agreement.

A frequent mistake is to pursue a certificate the target buyers do not ask for. Ask three current prospects what they require before committing to a programme. In a dossier, the certification section records what the company holds, by issuer, scope and expiry, and the Trust Workspace lets the company publish certificates and share reports under NDA from one place.

Reading a certificate or report in a dossier

OpenDossier records each attestation or certificate as a verified claim only when it has been checked at source: a SOC 2 report read with the auditor's opinion page, or a certificate confirmed through the certification body or an accreditation-body directory. A logo on a website is not evidence and is not recorded as such.

The chain for a certificate shows: standard and edition, certification body, accreditation body, certificate number, scope statement, issue and expiry dates, and the date verified. For a SOC 2 report: auditor, type, criteria covered, period end date, opinion, number of exceptions, and the date the report was read. Scope is quoted verbatim.

Expired or lapsed instruments are kept in the file with status expired, because the history is informative, and the monitoring feed alerts when an expiry date passes without a replacement. A company's statement that it is in progress is recorded as company-stated with the target date; it is useful but not equivalent to the instrument itself.