Why We Finally Merged Our ISO 27001 and SOC 2 Programs

Two audits, one control set, the math only works one way

A few years back, our security lead printed out both audit checklists side by side just to prove a point to the rest of us. Same access review questions. Same incident response walkthrough, word for word in some places. Same vendor risk section. Two different auditors, two different PDFs, two different invoices for what was basically the same conversation twice a year.

Nobody had ever actually sat down and asked if that was necessary. It wasn’t. Once you look closely, ISO 27001 and SOC 2 aren’t really competing standards. They’re the same underlying idea wearing different clothes.

Same Question, Different Accent

Both frameworks exist to answer one thing: can this company be trusted with sensitive data? They just approach it from different angles.

ISO 27001 is the international one, a certification built around a full Information Security Management System, heavy on documentation, and the one European or APAC clients tend to ask for by name. SOC 2 isn’t technically a certification at all. It’s an attestation, built on the AICPA’s Trust Services Criteria, and it’s the one you’ll hear about constantly if you sell SaaS to U.S. companies.

Strip away the labels, though, and the controls underneath overlap more than most teams realize access control, encryption, incident response, onboarding and offboarding, vendor due diligence. Different numbering systems. Basically the same requirements.

What Actually Changes When You Merge Them

This isn’t about favoring one framework and letting the other one slide. It’s building one control environment that happens to satisfy both auditors without extra translation work.

Here’s roughly what that looked like for us:

• One control matrix instead of two map Annex A against the Trust Services Criteria and most controls line up almost exactly
• Policies written once, referencing both frameworks by name, instead of an “ISO version” and a “SOC 2 version” that inevitably drift apart over time
• Evidence collected in a format that works for either auditor the first time, not reformatted after the fact
• A single risk assessment methodology (ISO requires this formally anyway) that then informs how SOC 2 controls get scoped
• One internal audit pass covering both, instead of staggering internal reviews across the year

Small stuff individually. Adds up fast.

Where the Tooling Earns Its Keep

This is honestly the whole reason platforms like Vanta, Drata, Secureframe, and Sprinto took off. Configure a control once, and the platform maps it across ISO 27001, SOC 2, sometimes HIPAA and GDPR too, without you touching it again per framework.

The time savings are nice. What actually matters more is visibility when an offboarding ticket sits open three days too long, you see it’s a problem for both frameworks at once, not just whichever one an auditor happens to be looking at that quarter.

What You Get Back For the Effort

Nothing dramatic happens overnight. But over a couple of cycles, teams that do this properly tend to see:

• Meaningfully less prep time the second year through, once the shared control set is actually built out
• Lower audit fees, since a lot of firms will run combined engagements if you just ask
• Fewer internal arguments about which policy document is the “real” one
• A security posture that’s closer to audit-ready most months, not just the six weeks before someone shows up

Don’t Pretend They’re Identical

Here’s the part I’d push back on if someone tells you to just collapse the two frameworks entirely. Don’t. ISO 27001 wants a documented ISMS, formal management review cycles, a Statement of Applicability, none of which SOC 2 asks for. And SOC 2 is scoped to a specific window, usually six to twelve months for a Type II report, while ISO certification is more of a snapshot with annual surveillance visits.

Merge the shared 80%. Fine. Keep the other 20% clearly labeled as framework-specific and don’t let anyone tell you it’s redundant just because it’s annoying.

If You’re Doing This For the First Time

Already certified in one and chasing the other? Skip the part where you rebuild everything from scratch.

• Map your existing controls against the new framework first, the overlap will be obvious almost immediately
• Ask your current audit firm about combined engagements; more of them offer this now than even two years ago
• Put one person in charge of the whole program. Splitting ownership by framework is how you end up with two spreadsheets again in eighteen months

Compliance was never supposed to be a twice-a-year performance for two different audiences. Merge the frameworks properly, and it stops being theater, it just becomes part of how the company runs.

Why We Finally Merged Our ISO 27001 and SOC 2 Programs was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.