SOC 2 or ISO 27001: which security assurance artefact your customers actually want

Australian businesses selling software, data processing or managed services are routinely asked for "your SOC 2" or "your ISO cert" in a procurement questionnaire, usually with no explanation of which one the buyer needs or why. The two are not interchangeable. They are produced by different professions, under different rule sets, and they answer different questions.

This article is about the assurance artefact itself — what it proves, what an assessor tests, what you hand a customer, and what happens each year to keep it alive. It is not an implementation guide for an information security management system.

The difference in one line: a certificate versus a report

ISO/IEC 27001 produces a certificate; SOC 2 produces a report. That single distinction drives almost every other difference.

An ISO/IEC 27001 certificate is issued by a certification body after it audits your information security management system (ISMS) against the standard. The certificate is short, public-facing, and states the standard, the certificate number, the validity period and — critically — the scope statement. It says a conforming ISMS exists. It does not tell the reader which controls you selected or how well any of them worked.

A SOC 2 report is issued by an accounting firm under the American Institute of Certified Public Accountants (AICPA) attestation standards, using the Trust Services Criteria. It typically runs to 60–120 pages and contains the practitioner's opinion, management's description of the system, the list of controls tested, the tests performed, and — the part buyers read first — any exceptions the practitioner found. It is normally released under a non-disclosure agreement, not published.

So: a certificate is a badge, a report is evidence. A buyer who wants to run their own vendor risk assessment wants the report. A buyer who wants a box ticked wants the certificate.

What each one actually covers

ISO/IEC 27001 covers the management system: context, leadership, risk assessment and treatment, competence, internal audit, management review, and corrective action, together with the Annex A controls you selected. The set of controls you excluded, and why, is recorded in your Statement of Applicability. The certificate is only as meaningful as its scope statement, which is why a sophisticated buyer reads the scope before anything else — a certificate scoped to "the corporate head office" tells them nothing about the production platform.

SOC 2 covers whichever Trust Services Criteria categories you nominate. The security category (the common criteria) is mandatory. Availability, processing integrity, confidentiality and privacy are optional add-ons. A report scoped to security only says nothing about uptime, and a buyer relying on it for availability commitments is misreading it.

Type 1 and Type 2, stage 1 and stage 2

The two regimes both split the assessment in two, but they mean different things by it, and this is the most common source of confusion in Australian procurement.

SOC 2 Type 1 tests whether controls were suitably designed at a single point in time. SOC 2 Type 2 tests whether those controls operated effectively over a period — a minimum of three months, most commonly six or twelve. A Type 1 is a snapshot; a Type 2 is a film. Buyers who know the difference will accept a Type 1 once, from a first-time vendor, on the condition that a Type 2 follows.

ISO/IEC 27001 stage 1 is a readiness and documentation review. Stage 2 is the certification audit proper, where the auditor samples records and tests whether the ISMS operates as documented. Both stages happen before the certificate issues; neither is an alternative to the other, and there is no ISO equivalent of the "design only" Type 1 report.

The practical consequence is timing. A Type 2 cannot be produced faster than its observation window, so a vendor that has just switched on its controls is structurally incapable of handing a customer a twelve-month Type 2 this quarter. Certification is faster to a first artefact but slower to useful detail.

The Australian equivalents nobody asks for by name

Australia has its own controls assurance standards, issued by the Auditing and Assurance Standards Board. They are used constantly and named rarely.

• ASAE 3402 covers assurance reports on controls at a service organisation that are relevant to user entities' financial reporting. It is the local analogue of a SOC 1.
• ASAE 3150 covers assurance engagements on controls more generally, including operational and compliance controls. It was formulated for Australian purposes and has no international equivalent, and it expressly excludes the financial-reporting controls dealt with in ASAE 3402.

An Australian practitioner can issue a controls report under ASAE 3150 that does substantively what a SOC 2 does. Buyers rarely ask for it by name because the term "SOC 2" has become the market shorthand. If your customer base is entirely domestic and your auditor is Australian, an ASAE 3150 report is a legitimate answer to a SOC 2 request — but expect to explain it, and expect a US-headquartered buyer to push back.

Which artefact each Australian buyer asks for

The government columns matter. An ISO/IEC 27001 certificate does not satisfy a Commonwealth agency assessing a system against the Information Security Manual — that is a separate exercise, covered in IRAP assessments and hosting Australian government data. Nor does it substitute for a maturity rating under the Essential Eight; see ISO 27001 vs the Essential Eight and Essential Eight maturity levels explained.

Evidence the assessor will ask you to produce

The evidence sets overlap heavily. The difference is that a SOC 2 Type 2 practitioner samples across the whole observation window and will record a failed sample as an exception in a document your customers read.

If you hold personal information, the same evidence largely answers your obligations under APP 11, which is worth designing for once rather than assembling three times.

Renewal mechanics and what drives cost

ISO/IEC 27001 runs a three-year cycle: stage 1 and stage 2 in year zero, a surveillance audit in year one, another in year two, and a full recertification audit in year three. Surveillance audits sample a subset of the ISMS; recertification is a full re-assessment. Certificates lapse if the cycle is not maintained. The transition from the 2013 edition to the 2022 edition closed on 31 October 2025, after which certificates issued against the superseded edition were withdrawn (checked August 2026) — if a supplier hands you a certificate against the 2013 edition today, it is not current.

SOC 2 has no cycle in the same sense. Each report covers a stated period, and buyers expect continuous coverage: consecutive periods with no gap. A gap in coverage is treated as a red flag, because it is exactly where an incident could hide.

Cost varies too widely to quote a figure honestly, and anyone quoting one without seeing your scope is guessing. The drivers are consistent:

• Scope size — number of in-scope systems, products, entities and physical sites.
• Number of criteria or controls — adding availability and privacy to a SOC 2, or a large Annex A control set to an ISO scope.
• Observation window — a twelve-month Type 2 costs more to support than a three-month one, mostly in your own staff time.
• Evidence maturity — automated, system-generated evidence is cheaper to audit than screenshots assembled by hand.
• Remediation — findings from a readiness review are your cost, not the auditor's, and they are usually the largest line item in year one.
• Multi-site sampling — auditors sample sites, and more geographies means more sampling.

Two practical points. First, run a gap assessment before you engage an auditor; the ISO 27001 gap assessment tool is a reasonable starting inventory. Second, if you are also caught by Essential Eight maturity or CPS 234, map the evidence once. Most of what a SOC 2 practitioner samples is the same evidence an Essential Eight assessor tests, described in different vocabulary.