FAQ: Can an organization opt for both SOC2 and ISO 27001?

Yes. SOC 2 provides a CPA examination report about a defined service system and its applicable Trust Services Criteria. ISO/IEC 27001 certification concerns an information security management system within a defined scope. Neither necessarily covers more of the company than the other. Compare the systems, locations, commitments, and customers covered before planning both. You may reuse suitable policies and evidence, but the assessments and deliverables remain separate; one does not automatically replace a customer’s request for the other.

Related: SOC 2 report guide for the SOC-specific examination scope.

Additional FAQs

What if no employee left or no incident occurred during the period?

Verify and document that no relevant events occurred. Explain the control’s design and agree on the audit approach; never invent an event or disguise an exercise as one.

What should we check before changing compliance platforms?

Export and test your evidence, mappings, review history and attachments before leaving the old platform. Plan the collection handoff so audit history remains accessible.

How often is a SOC 2 audit required?

Timing depends on customer and contractual needs. Agree the reporting period with your auditor and plan ahead to avoid unwanted gaps in coverage.

What should happen after we approve a vendor?

Assign an owner, track important changes and follow up on open issues. For services you depend on, keep a practical exit plan.

Can employees put customer data into an AI tool?

Use customer data only after the organization approves the use and checks the relevant terms, security and privacy requirements. Prefer limited or de-identified input where suitable.

How should we review an AI vendor beyond its SOC 2 report?

Read the SOC 2 scope, then check the AI service’s data use, model providers, settings and limitations. Assign responsibility for unanswered questions and your own safeguards.

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide