SOC 2 criteria with no ISO 27001 equivalent, and why they exist
An ISO 27001 certificate gets you most of the way to a SOC 2 report, but not all of it. The criteria that don't carry over all come from two optional categories.
If your organisation already holds ISO 27001 and a customer asks for a SOC 2 report, most of the work is done. The security controls overlap heavily, and the ISMS gives SOC 2 auditors the governance evidence they look for. But a group of SOC 2 criteria has no counterpart in ISO 27001 at all, and they are worth knowing before you agree a scope with your auditor.
The headline number
Of the 61 SOC 2 criteria, 41 (67%) map to something in ISO 27001, 0 are only loosely related and 20 have no mapping in our data. Open the gap report →
None of the SOC 2 criteria is merely "loosely related" to ISO: each one either maps or doesn't. That clean split is a clue to what is going on.
The criteria with no ISO mapping
| SOC 2 | Requirement | Match | ISO 27001 |
|---|---|---|---|
| P1.1 | Privacy notice | No mapping in our data | — |
| P2.1 | Choice and consent | No mapping in our data | — |
| P3.1 | Collection limited to privacy objectives | No mapping in our data | — |
| P3.2 | Explicit consent where required | No mapping in our data | — |
| P4.1 | Use limited to privacy objectives | No mapping in our data | — |
| P5.1 | Data subject access | No mapping in our data | — |
| P5.2 | Correction of personal information | No mapping in our data | — |
| P6.1 | Disclosure to third parties with consent | No mapping in our data | — |
| P6.2 | Record of authorized disclosures | No mapping in our data | — |
| P6.3 | Record of unauthorized disclosures | No mapping in our data | — |
| P6.4 | Privacy commitments from third parties | No mapping in our data | — |
| P6.5 | Notification by third parties of unauthorized disclosures | No mapping in our data | — |
| P6.7 | Accounting of disclosures to data subjects | No mapping in our data | — |
| P7.1 | Quality of personal information | No mapping in our data | — |
| P8.1 | Handling privacy inquiries, complaints and disputes | No mapping in our data | — |
| PI1.1 | Information about processing objectives | No mapping in our data | — |
| PI1.2 | Controls over system inputs | No mapping in our data | — |
| PI1.3 | Controls over system processing | No mapping in our data | — |
| PI1.4 | Controls over system outputs | No mapping in our data | — |
| PI1.5 | Storing inputs, items in processing and outputs | No mapping in our data | — |
Every criterion in the list comes from two of SOC 2's five categories: Processing Integrity (PI1) and Privacy (P1 to P8). Both are optional. The Security category, the common criteria CC1 to CC9 that every SOC 2 report includes, maps completely, as do Availability and Confidentiality.
Why Processing Integrity has no ISO equivalent
Processing Integrity asks whether a system processes data completely, accurately, on time and as authorised: that inputs are checked, processing errors are caught, outputs reach the right place, and stored data stays consistent. It is about the correctness of the service itself, not the security around it.
ISO 27001 is an information security standard. It protects the confidentiality, integrity and availability of information, but "integrity" there means protection against unauthorised change, not whether a payroll run calculated every salary correctly. No Annex A control asks you to validate business processing. So if a customer relies on your system to get the numbers right (payments, billing, payroll, claims, data pipelines), Processing Integrity is new work even with a mature ISMS: input validation, reconciliation, error handling and output controls, with evidence.
Why most Privacy criteria have no ISO equivalent
SOC 2's Privacy criteria follow the life of personal information: notice (P1), choice and consent (P2), collection (P3), use, retention and disposal (P4), access and correction (P5), disclosure (P6), quality (P7) and monitoring and complaints (P8). They are privacy-programme requirements, closer to GDPR than to security.
ISO 27001 touches a few of them. A.5.34 requires you to identify and meet obligations for protecting personal data, A.5.33 covers protection of records, and A.8.10 information deletion. That's why retention (P4.2), disposal (P4.3) and breach notification (P6.6) do map in our data, through editorial links with stated reasons. The rest, such as privacy notices, consent, data-subject access requests and records of disclosures, have no Annex A control.
If you need them, ISO/IEC 27701 extends an ISMS into a privacy information management system and is the natural partner standard. On the GDPR side, see how ISO 27001 compares with GDPR's security articles.
What to do about it
- Agree the scope first. Include Processing Integrity or Privacy only if customers need them. Many SOC 2 reports cover Security alone, or Security plus Availability and Confidentiality.
- If you include them, treat them as new controls, not as an ISO mapping exercise: write them, run them, and keep evidence for the whole observation period.
- Reuse the ISMS for everything else. The ISO 27001 → SOC 2 gap report lists every criterion with its ISO match, and our post on running one control set for both covers the mechanics.
The other direction is a different story: going from SOC 2 to ISO 27001, the new work is the management system itself. The ISO 27001 vs SOC 2 comparison covers both directions.
A note on the data
No openly licensed SOC 2 crosswalk exists, so every SOC 2 link here is ControlMapping's editorial judgement, with the reason shown on each requirement page. The counts above are computed live from the current data.
Questions
Does ISO 27001 cover SOC 2 Privacy criteria?
Mostly not. ISO 27001 protects personal data as information (A.5.34) but doesn't require privacy notices, consent, data-subject access or disclosure records. ISO/IEC 27701 extends an ISMS to privacy management and is the closer match.
Do I have to include Processing Integrity in a SOC 2 report?
No. Only the Security category (the common criteria) is required. Add Processing Integrity when customers rely on your system to process their data completely and accurately, for example payments or payroll.
Data as of 2026-10-27: numbers in this post are computed from the current crosswalk and update when it changes. Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Not compliance advice.
Related posts
Analysis · 2026-10-27APRA CPS 234 and ISO 27001: what your ISMS covers and what APRA addsAn ISO 27001 ISMS covers nearly every paragraph of APRA's CPS 234, yet APRA adds Board duties, third-party assurance and strict notification deadlines.
Analysis · 2026-10-27Cyber Essentials vs the Essential Eight: two national baselines comparedThe UK's Cyber Essentials and Australia's Essential Eight both target common attacks, but they cover different ground. What overlaps, what doesn't, and why.
Analysis · 2026-10-27DORA vs NIS2: what a NIS2 programme already coversDORA and NIS2 share most of their security content, but DORA adds a register, contract terms and threat-led testing. Article by article, what carries over.