Management-system standards and independent reports that show customers how an organisation protects the information it holds: ISO/IEC 27001, SOC 2, TISAX and related standards.
Information security compliance is usually the first compliance question an IT company meets, and it rarely comes from a regulator. It comes from a customer's security questionnaire: "Are you ISO 27001 certified?" or "Can you share your SOC 2 report?" Neither is required by law in most countries. Both have become the way buyers decide whether to trust a supplier with their data.
What this category covers
The guides here cover the standards that define an information security management system (ISO/IEC 27001 and the control guidance in ISO/IEC 27002), the risk method behind it (ISO/IEC 27005), independent attestation reports (SOC 2) and sector schemes built on the same ideas (TISAX for the automotive supply chain). Cloud-specific extensions such as ISO/IEC 27017 and 27018, and the privacy extension ISO/IEC 27701, are listed here too because they build on the same management system.
Certification or attestation: the difference
ISO/IEC 27001 is a certification. An accredited certification body audits your management system against the standard and, if you pass, issues a certificate that is valid for three years with surveillance audits in between. SOC 2 is an attestation. A licensed CPA firm examines your controls against the AICPA Trust Services Criteria and writes a report, which you share with customers under NDA. A certificate says you meet a standard; a SOC 2 report describes your controls and how well they worked, and the reader decides.
Which one first?
Ask your customers. European and Asian buyers, and most government tenders, tend to ask for ISO/IEC 27001. US enterprise and SaaS buyers tend to ask for SOC 2. The control work behind them overlaps heavily, so companies that need both usually build one control set and map it to each. The individual guides explain the requirements, the documents, the audit and the common mistakes for each standard.
ISO/IEC 27001 Information security, cybersecurity and privacy protection: Information security management systems: Requirements
ISO/IEC 27001 is the international standard for an information security management system (ISMS): a managed, risk-based way of protecting the confidentiality, integrity and availability of information. It sets requirements in clauses 4 to 10 and a reference list of 93 controls in Annex A. It is voluntary, and an accredited certification body can audit and certify an organisation against it, which is why customers and tenders ask suppliers for it.
ISO/IEC 27002 Information security, cybersecurity and privacy protection: Information security controls
ISO/IEC 27002 is the international reference set of information security controls with implementation guidance. Its 2022 edition reorganised the controls into 93 controls across four themes (organisational, people, physical and technological), added 11 new controls such as threat intelligence, secure coding and data masking, and introduced attributes for filtering controls by type, property and capability. It is not certifiable, but it is the guidance behind the Annex A controls of ISO/IEC 27001.
ISO/IEC 27005: Information security, cybersecurity and privacy protection, Guidance on managing information security risks
ISO/IEC 27005 is the international guidance standard for information security risk management. It explains how to set risk criteria, identify risks using asset-based or event-based approaches, analyse likelihood and consequences, evaluate and treat risks, and keep the process running. The 2022 edition aligns with ISO/IEC 27001:2022 and ISO 31000, and is the usual reference for designing the risk assessment that ISO 27001 certification requires.
System and Organization Controls 2: report on controls at a service organization relevant to security, availability, processing integrity, confidentiality or privacy
SOC 2 is an attestation report in which an independent CPA firm gives an opinion on a service organisation's controls against the AICPA Trust Services Criteria: security, and optionally availability, processing integrity, confidentiality and privacy. A Type I report covers the design of controls at one date; a Type II report also tests whether they operated effectively over a period. It is voluntary, but it is the security evidence US enterprise buyers ask SaaS and IT vendors for most often.
Trusted Information Security Assessment Exchange (TISAX), based on the VDA Information Security Assessment (VDA ISA) catalogue
TISAX is the automotive industry's shared information security assessment and exchange mechanism. Suppliers, service providers and software vendors that handle sensitive information or prototypes for carmakers are assessed against the VDA ISA catalogue by accredited audit providers, and the results are shared with customers through the ENX platform as TISAX labels. Labels cover information protection, availability, prototype protection and data protection. The new ISA2027 catalogue applies to assessments ordered from 1 January 2027.
HITRUST Common Security Framework (CSF) and HITRUST e1, i1 and r2 assessments and certifications
HITRUST is a private security and privacy framework and certification program widely used in US healthcare. Its Common Security Framework harmonises requirements from HIPAA, NIST, ISO, PCI DSS and other sources into one control set, and its e1, i1 and r2 assessments offer increasing levels of assurance, validated by authorised assessors and HITRUST quality review. It is voluntary and not a government certification, but many health systems and payers require HITRUST from vendors that handle patient data.
ISO/IEC 27017 Information security controls for cloud services (code of practice based on ISO/IEC 27002)
ISO/IEC 27017 is the international code of practice for information security in cloud computing. It adds cloud-specific guidance to the ISO/IEC 27002 controls for both cloud service providers and cloud service customers, and defines extra controls for issues unique to the cloud, such as shared roles, segregation of virtual environments and removal of customer assets. Its second edition, published in 2026, aligns it with ISO/IEC 27002:2022. It is voluntary and assessed alongside ISO/IEC 27001.
ISO/IEC 27031: Cybersecurity, Information and communication technology readiness for business continuity
ISO/IEC 27031 gives guidance on ICT readiness for business continuity (IRBC): making sure the technology that critical business activities depend on can withstand and recover from disruption. It explains how to link ICT continuity with business continuity and security, identify critical ICT services from the business impact analysis, set ICT recovery time and point objectives, choose strategies for people, facilities, technology, data, processes and suppliers, write ICT continuity plans, and test them. The 2025 edition updated the 2011 original.
ISO/IEC 27701 Information security, cybersecurity and privacy protection: Privacy information management systems: Requirements and guidance
ISO/IEC 27701 is the international standard for a privacy information management system (PIMS): a managed way to protect personal data and meet privacy obligations as a controller, a processor or both. The 2025 edition made it a standalone, certifiable management system standard with its own clauses 4 to 10, no longer an extension that required ISO/IEC 27001. It includes control sets for controllers and processors and is widely used to structure compliance with laws such as the GDPR.
In most countries, no. Both are voluntary. They become effectively required when customers or tenders ask for them, and some regulators accept them as evidence of reasonable security practices.
Can we get ISO 27001 and SOC 2 at the same time?
Yes. Many companies run one set of controls and have it audited twice: once by a certification body against ISO/IEC 27001 and once by a CPA firm against the SOC 2 Trust Services Criteria.
Does a certification make our product secure?
No. It shows that you run a managed, audited process for finding and treating security risks. Your product still needs secure design, testing and maintenance, which is what the software development guides cover.
We build the parts auditors and privacy laws look for: role-based access, audit logs, encryption, consent records, data export and erasure, and secure development practices. Tell us about your product and get a free quote within one business day.
