Will SOC 2 Take the Place of ISO 27001 in the UK & EU?
Over the last few years there’s been a surge in the number of UK and Europe-based companies seeking a SOC 2 assessment in addition to the ISO 27001 certification. This growing demand has led to speculation as to whether the US-originated SOC 2 audits will replace the need for the international ISO 27001 certification in some EMEA markets.
The short answer: Not quite.
While both provide some level of assurance to clients and regulating bodies, a SOC 2 assessment and an ISO 27001 certification by definition are two different processes.
ISO 27001 is an internationally recognised standard with a framework of controls that can be applied to any organisation, regardless of the size or sector, with a pass/fail certification decision.
A SOC 2 assessment is an audit standard created by the American Institute of Certified Public Accountants (AICPA) in which a CPA (Certified Public Accountant) will review your policies, procedures, and systems against five categories called Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy). The independent assessor’s detailed SOC 2 report contains their expert opinion of how well the organisation meets the selected criteria in regard to protecting all aspects of its systems.
Why the speculation?
The rising use of SOC 2 in the US over the past decade is due to many large companies becoming more proactive about their cybersecurity risk management. These organisations began setting forth requirements stipulating that their vendors must have a SOC 2 report ready as part of the due diligence process. This demand impacts not only US-based companies, but also any international companies that are looking to sell to these US enterprises, as they will be subject to the same requirements.
Following this same trend, UK and Europe-based companies are also imposing more demands to their vendors. Certain key industry sectors require SOC 2 reports so they can determine whether organisations along the supply chain have the necessary controls in place to protect the data of all parties involved.
However, despite its growing demand, SOC 2 is unlikely to replace ISO 27001. In fact, some organisations may need to obtain both to meet customer requirements, and there may even be other frameworks layered on top for certain industries and markets. Ultimately, each company’s individual needs and the requirements imposed by the market and industry they operate in will dictate which frameworks are best suited for them.
What are some of the benefits of obtaining a SOC 2 attestation?
The SOC 2 assessment offers an extensive attestation report up to 150+ pages in length. It tends to give a company’s partners and clients a higher level of detail about their security posture compared to the result of an ISO 27001 audit which offers a certification letter and a shorter report. The detailed report, along with the high acceptance rate in the US, make SOC 2 an excellent supplemental security framework.
There’s also a significant overlay in requirements between a SOC 2 and an ISO 27001 which – when supported by the right auditor and technology – may mean you can obtain a second framework without expending too many resources.
Which is better: SOC 2 or ISO 27001?
Because the two differ in scope and function, identifying one as superior over the other isn’t the correct way to think about it. Depending on the organisation’s goals and capabilities, one may be better to prioritise as the first approach to security. Identifying which one is right for your company can be done by consulting with an information security governance, risk and compliance management consultancy firm.
You may find that leveraging both a SOC 2 assessment and an ISO 27001 certification only increases the efficacy and durability of your cybersecurity posture, enabling you to tap into the US and EMEA markets with a greater competitive edge. Using an audit management platform such as A-SCEND allows organisations to easily satisfy multiple audit requirements by deduplicating evidence collection, saving time and resources during the completion of both audits.
Different markets require different compliance needs
In addition to SOC 2 and ISO 27001, there are several different certifications and standards that organisations can meet to remain compliant in their region of operation and improve their security posture. For companies who wish to do business in the UK, attaining a Cyber Essentials (CE) Certification (a certification developed by the UK Government and industry to help protect organisations against common online attacks) is encouraged. And in some European countries, ISAE 3000 is a popular choice – a framework similar to SOC 2 and that can be obtained as an integration to a SOC 2 report. There are also many UK and European regulations to be taken into account, such as the General Data Protection Regulation (GDPR), the EU AI Act, the Digital Operational Resilience Act (DORA) and the NIS2 Directive, to name a few.
Strengthening your business’s compliance programme
Ensuring the privacy of consumer data and the protection of information will continue to be of utmost importance for your organisation in the coming years. If you’re looking to fine-tune your business’s compliance programme in order to abide by the latest regulations, while also winning new business, A-LIGN can help. Our expertise spans privacy impact assessments, GDPR-related services, ISO 27001 Certification and SOC 2 examinations. We have everything needed to take your compliance programme to new heights.
