ISO 27001 to SOC 2: reuse, retest or write new

What your certificate proves, and what it does not

A certificate says an accredited body audited your management system and found it conforming. That is valuable to a buyer. It is not something a SOC 2 auditor can test, since there is no population to sample and no artifact behind it that they produced. They go to your records instead.

One housekeeping point. ISO released the 2022 edition on 25 October 2022, and Annex A shrank from 114 controls in fourteen clauses to 93 in four: 11 new, 24 merged and 58 updated. The International Accreditation Forum set 31 October 2025 as the last transition date for 2013 certificates in IAF MD 26, issue 2, which we checked on 1 August 2026. A current certificate is a 2022 certificate. The mapping below assumes it.

Four ways your ISO evidence gets treated

Annex A groups controls into organizational, people, physical and technological themes. The Trust Services Criteria group them into nine common criteria series, plus optional categories for availability, confidentiality, processing integrity and privacy.¹ The two do not line up control by control. They do line up by theme, and each theme lands in one of four outcomes.

As is

The artifact you keep today satisfies the criterion. The auditor reads it once.

Re-tested

The same kind of record works, but a Type 2 checks it across the whole period, not at a single visit. Same process, bigger population.

Carved out

A subservice organization runs the control, usually your cloud host. You name it and exclude its controls from your description.

Net new

Your ISMS has nothing for this. You write it from scratch.

Annex A themes mapped to the Trust Services Criteria

Use the clause numbers to match each row against your Statement of Applicability. We describe each Annex A area in our own words because ISO does not publish the control text for free. The criteria references come from the public AICPA document.¹ The last group has no Annex A equivalent at all.

Privacy is missing from the final group by design. It has more criteria than the other three optional categories combined,¹ and a first report seldom needs it. Run the scoping tool to see which categories your buyer is asking for before you add any.

Documents you can hand over unchanged

The reusable set is paperwork you already maintain: the policy suite, the risk assessment and treatment plan, the Statement of Applicability, asset and supplier registers, signed confidentiality agreements, and role descriptions that carry security duties.

Two ISO records do more work than the rest. Your internal audit report speaks to CC4.1, which asks for periodic checks that controls exist and function.¹ Management review minutes hit the same criterion from the governance side. Both are accepted in the format your ISMS produces.

The Statement of Applicability plays a different role. It is not evidence of a control. It is the best index you have for the mapping, because it already says which controls apply and why the excluded ones do not. That is half a scoping memo, written before anyone asked.

Why a Type 2 retests controls ISO already audited

A certification body checks that the management system conforms, sampling during its visit. A SOC 2 Type 2 opinion covers a stated period, so the service auditor draws instances from everything that happened inside that period and tests each one.³ The control is identical. The question is not.

ISO asks if the process exists and runs. SOC 2 asks how many times it ran between two dates, and whether each sampled run was right. So the access review your certifier saw once becomes every review in the window. Joiner and leaver records for the full period get pulled, not a handful.

The real extra work is proving completeness. You will be asked to show an export is the full population rather than a filtered slice, and your retention settings decide if you can. Our SOC 2 evidence checklist lists what each artifact needs to carry to be testable.

The five SOC 2 documents your ISMS never produced

The remaining gap is not controls. It is a short stack of documents with no ISO counterpart. Expect to write each of these yourself, and start with the service commitments because they shape everything else on the list.

1. Service commitments and system requirements. ISO measures controls against your own risk assessment. SOC 2 measures them against what you promised customers in contracts, service level agreements and public documentation.¹ Write those promises down first.
2. The system description. Section 3 of the report: what the service does, where the boundary sits, which components are inside it, and which subservice organizations it depends on.
3. Subservice organization treatment. Carve-out or inclusive, decided per provider and stated in the description. Annex A has you manage suppliers but never asks you to declare what your report excludes.
4. Complementary user entity controls. What your customers must do for your controls to work, written as their obligations. Our page on wording CUECs shows why a vague one transfers nothing.
5. Management’s written assertion. Your signed statement about the description and the controls, which the CPA firm then examines. The Statement of Applicability cannot stand in for it.

Timeline: Type 1 first, Type 2 on the calendar

Treat the two report types separately, because their clocks are unrelated. A Type 1 speaks to one date and has no observation window. The work is the mapping, the five new documents, and whatever your Statement of Applicability excluded that a criterion still needs. With a live ISMS that is writing, not engineering.

A first Type 2 runs on elapsed time. Three months is the accepted minimum window and a certificate does not shorten it. Why three months is the floor explains the reasoning, and the SOC 2 timeline covers every other phase. ISO shortens one phase only: remediation, because the controls and policies already exist.

Cost: adding SOC 2 to what you have

If you hired help for this crosswalk, you would be paying for hours spent reading documents you already own. For context, here is one published range for the consultant route.

• Comp AI states that a vCISO or compliance consultant might charge $150 to $400 an hour, which can total $20,000 to $50,000 for a full SOC 2 prep engagement. Source, checked 2026-07-30.

You can do the mapping yourself with the table above and a copy of your Statement of Applicability. On our side, cybersoftware is SOC 2 software: $199 a month, cancel any time, or $2,189 a year, pay for eleven months, get twelve. You bring the ISMS records you already keep, and the software turns them into SOC 2 policies, evidence and an audit package.

Audits go through our preferred pricing program, and we negotiate the fee on your behalf, for the SOC 2 Type 1 and every Type 2, and you see the price in your account before you book. Audits unlock after four paid months on monthly, or right away on yearly. Your ISO surveillance and recertification stay with your own certification body; cybersoftware does not do ISO 27001 work. Holding a certificate does not change any of these prices. It shortens the time you spend before the examination starts.

A first week plan

Five steps get you from a certificate to a scoped SOC 2 project. None of them needs an outside party, and each one produces something you will hand to the auditor later.

1. Mark your exclusions. Walk the Statement of Applicability against the table above. Any excluded control that touches a common criterion is on your real gap list.
2. List your service commitments from contracts, service level agreements and public docs, then confirm a control exists for each one.
3. Choose carve-out or inclusive for every subservice organization before you draft the system description.
4. Compare retention to the window. Logs that roll off at 90 days cannot cover a six month period.
5. Let the deal pick the report type. A buyer who already has your ISO certificate and still asks for SOC 2 may want a Type 2, and may accept a Type 1 while the window runs. Ask them.

Then check your starting point. The free readiness assessment takes about 15 minutes and shows which SOC 2 gaps remain once your ISO controls are counted. Compare plans on the pricing page when you are ready.