theagentindex.io/guides/soc-2-to-iso-27001/ · Last reviewed 21 Oct 2026
Free guide · 21 Oct 2026
SOC 2 to ISO/IEC 27001
A category-level look at what commonly carries over, what is ISO-specific, and where the official AICPA mapping spreadsheet lives. This page does not invent a control-by-control map. This is not a ranking or score.
Two different outputs
A SOC 2 report is a CPA examination of controls relevant to one or more of the trust services criteria (security, availability, processing integrity, confidentiality or privacy). [1]
ISO/IEC 27001 is a management-system standard. ISO does not certify and does not issue certificates. Certification is optional and is performed by a certification body. Certificates should cite the full reference (for example “certified to ISO/IEC 27001:2022”). Current edition: ISO/IEC 27001:2022 (published 2022-10), with Amd 1:2024. [2]
Report types, Type 1 vs Type 2, and how to verify a CPA or an ISO certificate are on the SOC 2 auditor FAQ.
Category-level overlap (not a control map)
The rows below name TSC categories next to ISO clause or Annex A themes. They are orientation only. Do not treat them as a mapping of individual criteria to individual Annex A controls.
| TSC category | ISO area to look into |
|---|---|
| CC1 Control environment | Clause 5 Leadership (policy, roles) |
| CC2 Information and communication | Clause 7 Support (awareness, documented information) |
| CC3 Risk assessment | Clause 6 Planning (risk assessment and treatment) |
| CC4 Monitoring activities | Clause 9 Performance evaluation (internal audit, management review) |
| CC5 Control activities | Clause 8 Operation; Annex A themes as scoped in the SoA |
| CC6 Logical and physical access controls | Annex A technological and organizational themes; physical theme for facilities |
| CC7 System operations | Annex A technological theme (operations / monitoring area) |
| CC8 Change management | Annex A technological / organizational themes (change area) |
| CC9 Risk mitigation, including vendors (CC9.2) | Supplier-controls area of Annex A (organizational theme); clause 6 treatment of vendor risk |
| A1 Availability | Annex A themes as scoped for continuity / capacity — confirm in the SoA |
| C1 Confidentiality; P1–P8 Privacy | Annex A organizational / technological themes plus any privacy-specific work you scope separately |
ISO/IEC 27002:2022 has 93 controls in four themes (37 organizational, 8 people, 14 physical, 34 technological). Those 93 controls provide the content for Annex A. [3] Clauses 4–10 follow the ISO management-system clause structure. [4]
ISO-specific work to look into
- ISMS scope and interested parties (clause 4)
- Statement of Applicability justifying inclusion and exclusion of Annex A controls (clause 6.1.3) [3]
- Internal audit and management review (clause 9)
- Nonconformity, corrective action and continual improvement (clause 10)
Working-aid checklists: ISO/IEC 27001:2022 readiness checklist.
Official mapping (use this for detail)
AICPA & CIMA publishes Mapping: 2017 Trust Services Criteria to ISO 27001 (spreadsheet, listed as published 2018). It was built against the earlier ISO 27001 edition; check it against the 2022 Annex A. [5]
NIST also hosts an AICPA 2017 Trust Services Criteria Crosswalk (privacy-framework crosswalk). [6]
Related hubs and directory pages (facts only, not endorsements): SOC 2 · ISO 27001 · ISO 27001 auditors filter · ISO 27001 auditors in the US (where published) · all auditors.
FAQ
Is this a control-by-control mapping?
No. This page only compares TSC categories with ISO clause and Annex A themes. For a detailed spreadsheet, use the official AICPA mapping (published 2018, built against an earlier ISO 27001 edition). Check it against the 2022 Annex A.
What is the difference between a SOC 2 report and an ISO 27001 certificate?
SOC 2 is a CPA attestation examination of controls relevant to one or more trust services criteria. ISO/IEC 27001 is a management-system standard; certification is optional and is issued by a certification body, not by ISO.
What ISO-specific work does a SOC 2 programme not already cover?
Look into ISMS scope, a Statement of Applicability that justifies inclusion and exclusion of Annex A controls, internal audit, and management review. Those sit in ISO clauses 4, 6, 9 and related documented information.
Is this legal advice or a ranking?
No. General information, not legal advice; confirm scope with your counsel or auditor. This is not a ranking or score.
Related: which framework to look into · after the audit · tools.
Get updates by email
Subscribe to the Brief
Weekly, free, unsubscribe anytime.
Check your inbox to confirm your email. We’ll only send the weekly brief after you click the link.
We use your email only to send the newsletter. See our privacy policy.
Sources
- AICPA, 2017 Trust Services Criteria (March 2020 points of focus), archived official PDF. https://web.archive.org/web/20230905175109id_/https://us.aicpa.org/content/dam/aicpa/interestareas/frc/assuranceadvisoryservices/downloadabledocuments/trust-services-criteria-2020.pdf
- ISO — ISO/IEC 27001 (Edition 3, 2022-10; Amd 1:2024). https://www.iso.org/standard/27001
- ISO/IEC JTC 1/SC 27 Journal Vol 2 Issue 2 (Dec 2022) — 93 Annex A controls in four themes. https://committee.iso.org/files/live/sites/jtc1sc27/files/resources/ISO-IEC%20JTC%201-SC%2027_N22755_SC27%20Journal%20Vol%202%20Issue%202%20%28update%20Dec%202022%29.pdf
- ISO — management system standards (harmonized clause structure). https://www.iso.org/management-system-standards.html
- AICPA & CIMA — Mapping: 2017 Trust Services Criteria to ISO 27001 (2018 spreadsheet). https://www.aicpa-cima.com/resources/download/mapping-2017-trust-services-criteria-to-iso-27001
- NIST — AICPA 2017 Trust Services Criteria Crosswalk. https://www.nist.gov/itl/applied-cybersecurity/privacy-engineering/american-institute-certified-public-accountants-aicpa
- Agent Index dataset v0.1.27. https://theagentindex.io/agents.json
Prepared by Agent Index (Heritage Services). Last reviewed 21 Oct 2026. General information, not legal advice; confirm scope with your counsel or auditor. Checklist items are working aids, not a statement of what any auditor requires. Licensed CC BY 4.0.