SOC 2 and ISO 27001: One Control Set for Both

Most of the security work behind a SOC 2 report and an ISO 27001 certificate is the same work. Here is how to build it once and evidence it for both.

This post covers the 11 frameworks ControlMapping mapped when it was written. Since then, DORA, CPS 234, Cyber Essentials were added on 2026-10-27; their pages and the coverage matrix include them.

Companies that sell software internationally often end up with both: a SOC 2 report for US customers and an ISO 27001 certificate for everyone else. Run them as two projects and you write two sets of policies, collect the same evidence twice and sit through overlapping audits. Run them from one control set and the second framework costs a fraction of the first.

This is how to set that up.

How much overlaps

Direction	Mapped	Loosely related	No mapping
Have ISO 27001 → need SOC 2	41 of 61 (67%)	0	20	report →
Have SOC 2 → need ISO 27001	98 of 123 (80%)	21	4	report →

Going from SOC 2 to ISO 27001, almost every Annex A control and ISMS clause maps to a SOC 2 criterion. The few with no mapping are ISO's management-system mechanics: defining the ISMS itself and controlling documented information. Going the other way, the SOC 2 criteria with no ISO counterpart are the optional Privacy and Processing Integrity categories; the Security criteria all map.

So the overlap is in the security controls. The differences are in structure: ISO wants a management system around the controls, and SOC 2 wants evidence that they operated over a period.

Step 1: pick a spine

A common control set needs one primary structure that everything maps to. Use ISO 27001's Annex A as the spine if you have or want the certificate, because the Statement of Applicability already lists every control with a reason. Use the SOC 2 criteria if the report is your main deliverable. Either works; what matters is that every control has one home.

Step 2: write each control once

For each control, keep one record with:

A plain statement of what you do ("Access to production is granted through a ticket approved by the system owner and reviewed quarterly").
An owner and a frequency.
The framework references it satisfies, for example ISO A.5.15 and A.5.18, SOC 2 CC6.1–CC6.3.
The evidence it produces, and where that evidence lives.

The references come from a mapping like ours. For access control, it looks like this:

Framework	Access Control	Link
NIST CSF 2.0	PR.AA-01 PR.AA-05	Topic definition
ISO 27001	A.5.15 A.5.16 A.5.18 A.8.3	Crosswalk
CIS v8.1	CIS 5.1 CIS 6.1 CIS 6.2 CIS 6.7 CIS 6.8 CIS 3.3 CIS 5.2 CIS 5.3 CIS 5.5 CIS 5.6 CIS 6.6 CIS 12.5	Crosswalk
SOC 2	CC6.1 CC6.2 CC6.3	Editorial
PCI DSS	7.2.1 7.2.2 7.2.4 8.2.1	Crosswalk
CMMC	AC.L2-3.1.1 AC.L2-3.1.2	Crosswalk
800-53	AC-2 AC-3	Crosswalk
HIPAA	§164.308(a)(4)§164.312(a)§164.312(a)(2)(i)§164.312(d)	Crosswalk
GDPR	Art.25(2)Art.32(1)(b)	Editorial
NIS2	11.1 11.2 11.5	Crosswalk
Essential Eight	—	No mapping in our data

Full detail and the reason for every link: Access Control across frameworks →

Step 3: collect evidence once, tag it twice

SOC 2 Type II auditors sample evidence from across the observation period: tickets, reviews, scans, training records. ISO surveillance auditors ask for the same kinds of records. Collect each piece once, in one place, and tag it with every framework reference its control carries.

Photograph of a row of grey archive box files on a metal shelf, marked with two colours of blank sticker dots, some boxes carrying both — File evidence once and tag it for every framework it serves.

Step 4: line up the calendars

Start the SOC 2 observation period when your controls have run for a few weeks, not on the day they launch.
Schedule ISO internal audits and management reviews so they produce records inside the SOC 2 period: they are good governance evidence for the SOC 2 common criteria too.
Ask whether your auditors can coordinate fieldwork. Even when they can't, putting the two audits close together means one round of evidence requests.

Step 5: fill the gaps each side leaves

Run the SOC 2 → ISO 27001 gap report and the reverse. Expect two kinds of new work:

For ISO: the management system. Scope, objectives, risk assessment and treatment, the Statement of Applicability, internal audit, management review and corrective action.
For SOC 2: any optional categories you include, and the habit of keeping evidence continuously for a full period.

Our ISO 27001 vs SOC 2 comparison lists every requirement in both directions, and both the SOC 2 and ISO 27001 guides cover the audits themselves.

A note on the mappings

No openly licensed SOC 2 crosswalk exists, so every SOC 2 link on this site is ControlMapping's editorial judgement, with the reason shown. Use the mapping to design the control set, then confirm the details with your auditors before relying on it.

Questions

Can one auditor do SOC 2 and ISO 27001 together?

Some firms have both a CPA practice and an accredited certification body and coordinate the audits, but they remain two engagements with two deliverables: a SOC 2 report and an ISO 27001 certificate.

Which should come first, SOC 2 or ISO 27001?

The one your customers ask for first. If you build the common control set described here, the second one mostly adds the management-system clauses (for ISO) or the evidence period and optional criteria (for SOC 2).

Data as of 2026-10-27: numbers in this post are computed from the current crosswalk and update when it changes. Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Not compliance advice.

One control set for SOC 2 and ISO 27001: run both without doing everything twice