Question 1

What is the difference between SOC 2 and ISO 27001?

Accepted Answer

One is a report about your controls. The other is a certificate for your management system. SOC 2 gives a customer a detailed report describing what you do and what the auditor found. ISO/IEC 27001 certifies that you run an information security management system meeting the standard. ISO does not issue that certificate. An accredited certification body does, and you can verify anyone's through the IAF database. Certification is optional; some firms implement the standard without it. North American buyers ask for SOC 2. ISO travels further elsewhere. Neither substitutes for the other once procurement has named one.

Question 2

Does ISO 27001 certification satisfy a customer asking for SOC 2?

Accepted Answer

Occasionally. Ask rather than assume. These are different objects: a certificate against a management system standard, and a CPA's report on controls over a defined system. Some buyers accept either. Some accept one because their own policy names it. Some want both, because they sell into different regions. The underlying work overlaps enough that your second one is cheaper than your first. Ask whether their requirement names a specific report. That decides whether you have a mapping exercise or a new engagement.

Question 3

What is an ISMS?

Accepted Answer

The management system ISO 27001 certifies. It is how you decide, run and improve your security. Not a document set, and not a tool. It covers how you assess risk and what you decide to do about it. Who owns what. How you check it works. How you correct it when it does not. The standard specifies requirements your system must meet, and certification examines whether you actually run one. That is why ISO work feels like operating discipline, rather than the control-by-control shape of a SOC 2.

Question 4

Do I have to get certified to benefit from ISO 27001?

Accepted Answer

No, and ISO says so directly. Companies implementing the standard decide for themselves whether to go through certification. Some adopt it for the practice it contains; others certify to reassure customers. The distinction is useful when procurement pressure arrives before budget does. You can implement the standard, use it to structure your security programme, and certify later when a deal requires it. What you cannot do is describe yourself as certified in the meantime. And when you are, use the full reference including the year.

Question 5

How do I check whether someone else's ISO certificate is real?

Accepted Answer

Look it up in the IAF database, or ask the body that issued it. ISO does not perform certification and holds no register, which surprises people who go looking on iso.org. Your certificate comes from a certification body, and an accreditation body confirms that body is competent. The International Accreditation Forum runs a global database where you can verify both. Do this for your own subprocessors. A certificate scan in an email is not verification, and checking takes minutes.

Question 6

What is an accreditation body and why does it matter?

Accepted Answer

It is the body that vouches for your certification body. Certification is written assurance from an independent body that you meet requirements. Accreditation is formal recognition that the body giving that assurance is competent. One layer up. ISO notes accreditation is not compulsory, and that a non-accredited certification body is not automatically disreputable. But an accredited certificate carries a check somebody else performed. That is what your procurement reviewer is looking for when they ask who issued yours.