Two security labels show up in almost every vendor deck. Learn what SOC 2 Type II and ISO 27001 mean, how they differ, and what to ask to see.
—
3 min read
The short answer
SOC 2 Type II is an independent audit report showing that a company's security controls worked over a stretch of time. ISO 27001 is an international standard for running information security, and a company earns certification after an outside audit. Having both is a good sign, but you should still ask to see the documents and read what they cover. Spacture AI is SOC 2 Type II and ISO 27001 certified, and GDPR and CCPA compliant.
What is SOC 2?
SOC 2 comes from the American Institute of Certified Public Accountants. An independent auditor checks a company’s controls against criteria such as security, availability, and confidentiality.
There are two types. Type I looks at whether controls are in place on a single date. Type II looks at whether they actually worked over a period, usually several months to a year. That is why Type II carries more weight.
SOC 2 is technically an audit report and not a certificate, though many companies, including us, say “certified” in everyday language.
What is ISO 27001?
ISO 27001 is an international standard for managing information security. A company works through it with an accredited outside auditor and receives a certificate when it meets the standard.
It covers how a company finds security risks, decides what to do about them, and keeps reviewing its work over time.
How do they differ?
SOC 2 Type II is a report on how controls performed over a period. It is common with US buyers.
ISO 27001 is a certificate for the whole security management system, recognized around the world.
They overlap a lot. Both show that someone outside the company checked.
What about GDPR and CCPA?
Those are privacy laws, not certifications. GDPR covers personal data of people in the European Union. CCPA covers the privacy rights of California residents. Being compliant means a company follows the rules for handling personal data.
What should you ask a vendor to show?
The latest SOC 2 Type II report, usually shared under an NDA
The date range it covers
Which systems and services are in scope
The ISO 27001 certificate and its scope statement
How the company handles requests to access or delete data
How the company responds to a security incident
What mistakes do buyers make?
Treating a logo on a slide as proof
Skipping the scope, which can leave out the very product you are buying
Accepting an old report
Mixing up certifications and laws
Frequently asked questions
Is SOC 2 required by law?
No. It is voluntary, but many buyers ask for it.
Which matters more, SOC 2 or ISO 27001?
Neither one alone. They cover similar ground, so ask for both and read the scope of each.
How recent should a SOC 2 report be?
Many buyers look for one that was issued within the past year.
Key takeaways
SOC 2 Type II shows controls worked over time, and ISO 27001 shows a company manages security in a structured way. Ask for the documents and check the scope.
