If a customer has just told you they need to see SOC 2 or ISO 27001 before they will sign, you are probably trying to work out which one to do, how long it takes and what it costs. This page answers that.
The short version: the two frameworks cover much the same ground, but they are issued differently, they are recognised in different markets, and only one of them is a certification.
| If this sounds like you | Start with |
|---|---|
| Your customers are Australian enterprises, government or universities | ISO 27001 |
| Your customers are United States companies, or you sell to US tech buyers | SOC 2 |
| You sell into both, or you are raising from US investors | ISO 27001 first, then add SOC 2 |
| A tender or a contract names one of them specifically | The one it names, every time |
The last row matters more than the other three. If a contract says SOC 2, an ISO 27001 certificate will not close it, however good your security is.
This is the distinction almost every article gets wrong, and it changes what you can actually hand a customer.
ISO 27001 is a certification. An accredited certification body audits your information security management system and issues a certificate with your name on it. In Australia that accreditation runs through JAS-ANZ. The certificate is valid for three years with surveillance audits along the way.
SOC 2 is an attestation, not a certification. A licensed CPA firm examines your controls and issues a report describing what they tested and what they found. There is no certificate and no logo you are entitled to use. What you give a customer is the report itself, usually under NDA.
Anyone offering to make you “SOC 2 certified” is using language the framework does not have. You become SOC 2 compliant and you receive a SOC 2 report.
| ISO 27001 | SOC 2 | |
|---|---|---|
| What it is | An international standard for an information security management system | An attestation against the AICPA Trust Services Criteria |
| Who issues it | An accredited certification body | A licensed CPA firm |
| What you receive | A certificate | A report, usually shared under NDA |
| Who recognises it | Australia, the United Kingdom, Europe, Asia | Primarily the United States |
| How it is scoped | You define the scope of the management system | You choose which Trust Services Criteria apply |
| How long it lasts | Three years, with annual surveillance audits | Reports are typically renewed every twelve months |
| Point in time or period | Point in time at audit, maintained between audits | Type 1 is a point in time, Type 2 covers a period |
| Prescribes specific controls | Annex A gives a reference set of controls you justify including or excluding | Criteria are outcomes, and you choose the controls that meet them |
Most of the work. Access control, risk assessment, incident response, change management, vendor management, logging and monitoring, staff training and penetration testing all appear in both. That is why the second framework is far cheaper than the first.
In practice, a business that has done ISO 27001 properly already holds most of the evidence a SOC 2 examination asks for. The additional work is mapping what exists onto the Trust Services Criteria and running the observation period.
| ISO 27001 | SOC 2 | |
|---|---|---|
| Our fee | $2,750 per month excluding GST over twelve months, for up to 50 employees, on contracts signed by 31 December 2026. Normally $3,750. | |
| The independent fee | Certification body audit, typically $5,000 to $15,000, billed to you directly | CPA firm examination, the equivalent cost, also billed to you directly |
| Time to audit ready | Three to nine months | Three to nine months, plus the Type 2 observation period |
| Second framework | Considerably less than the first, because most of the evidence is shared | |
The independent audit fee is not something any consultancy can quote for you, because the certification body or CPA firm is independent by design and bills you separately. Anyone folding it into a single number is estimating it or marking it up. We can introduce you to certification bodies and CPA firms we work with regularly.
How we deliver both. ISO 27001 and SOC 2 are both delivered through our CERTIFY package at a fixed monthly price, with the policies, risk assessment, internal audit, training, external penetration testing and the compliance platform all included. See CERTIFY for ISO 27001, CERTIFY for SOC 2, or the full ISO 27001 and SOC 2 certification cost breakdown.
If you sell into Australian enterprise and United States customers, doing both is usually the right call and it is not twice the work. The control sets overlap heavily, so the second framework is an add-on rather than a second full programme.
The order that works best is ISO 27001 first, because building a management system gives you the structure that SOC 2 evidence then hangs off. Going the other way round is possible but tends to mean revisiting work.
If you would rather run the programme in-house with software than hand it to a consultancy, CertAssist is a compliance platform built for small teams taking on ISO 27001 or SOC 2 for the first time.
Neither is better. They are recognised in different markets. The right question is not which framework is stronger, it is which one your customers are asking for. If nobody has asked yet and you sell in Australia, ISO 27001 is the safer default.
Not if the customer has specifically asked for SOC 2. Some will accept ISO 27001 as an equivalent, and it is always worth asking, but a contract clause naming SOC 2 means SOC 2.
They cost much the same with us, because the underlying work is much the same. The difference sits in the independent fee and in the SOC 2 observation period, which adds elapsed time rather than consulting cost.
Three to nine months to be audit ready for either, with our packages. For a SOC 2 Type 2 you then need an observation period on top, usually three to twelve months, before the report can be issued.
Only if your customers span both markets. Plenty of Australian software companies hold ISO 27001 alone for years and only add SOC 2 when their first serious United States customer asks for it.
Both expect regular technical testing of the systems in scope, and auditors will ask to see recent reports. External penetration testing is included in our compliance packages rather than quoted separately.
Tell us which framework your customers are asking for and roughly how many people you employ, and we will come back with a fixed monthly price and a realistic date for being audit ready. If the honest answer is that you do not need either one yet, we will say so.
Next step: Send us your details and we will put a number in front of you, or see the full compliance price list.