ISO 27001 or SOC 2 first?
It's one of the most common questions in the startup community. Should we go for SOC 2
or ISO 27001 first?
The usual answer is "it depends on your market." Selling to US customers? Go with SOC 2.
Selling outside the US? Start with ISO 27001.
In general, that's not wrong. But FEHA believes every early-stage startup should start by
looking at ISO 27001. Not necessarily as a certification you have to go through, but as a
framework.
Why ISO 27001
ISO 27001, together with ISO 27002, gives a company a clear structure and a solid
reference to build its information security management system (ISMS).
SOC 2 is different. The criteria often aren't descriptive enough. It's not always clear what
you actually need to do as a company to show you comply.
To be fair, SOC 2 has real upsides for startups. You define your own controls, and you can
keep the scope as small as you want. But an early-stage startup that wants to build
something serious needs clear guidance and a clear structure. ISO 27001 and 27002 give
you that. SOC 2 mostly doesn't.
Build first, pick the audit later
Once you've implemented the ISO 27001 controls, you can decide which audit you want.
An ISO 27001 certification audit, a SOC 2 audit, or both.
The two are largely interchangeable. From FEHA's experience, around 85% of the controls
are actually the same. So the work you put into ISO 27001 doesn't go to waste if a US
customer asks for a SOC 2 report later.
Need both? Do them together
Because of that overlap, FEHA always tells customers the same thing. If you already know
you'll need both, implement both at the same time.
Use ISO 27001 as your reference. Use SOC 2 as your discipline for evidence.
Why? SOC 2 isn't a certification. It's an attestation. If you say you perform a control every
month, you need to be able to show the evidence for every month of the audit period.
Consistently.
ISO 27001 works a bit differently. Auditors typically look at samples to judge whether your
ISMS is working. With SOC 2, you're expected to back up each control exactly the way you
defined it. Building with that discipline from the start makes both audits easier.
So, which one first?
From FEHA's point of view, start with ISO 27001 to structure your information security
management system. From there, decide which audit to go for first.
Or do both together. In FEHA's opinion, that's even better. You cut audit costs because a
lot of the evidence is shared. And it's less stressful for the rest of the company, because
everyone can focus on one point in time instead of having different audits scattered
across the whole year.
Hope that helps!