Compliance: SOC 2, ISO 27001, and GDPR.
When a company hands its data to a software vendor, say the names, emails, and call notes from its sales calls, it is trusting that the data stays safe and is used only as agreed. Compliance frameworks turn "we are careful" into something a third party can check.
Three names come up constantly for enterprise software, and the first idea to land is that they are not the same kind of thing. SOC 2 is an audit report. ISO/IEC 27001 is a certifiable standard. GDPR is a law. We walk the field the way it is built: what these frameworks are, why they are hard, how each is assessed, what they unlock, and where assurance is heading. The official standards and the statute are linked, so you can read the source yourself. This page explains the field. It is not legal advice, and it makes no claim about how any one product meets these frameworks.
A report, a certificate, and a law.
Compliance frameworks are published expectations for how an organization protects information, plus a mechanism that lets an outside party judge whether the expectations are met. The three differ in who issues the verdict.
SOC 2 is an attestation report, not a certificate. Under the AICPA's attestation standards, a licensed CPA firm examines a service organization's controls against the Trust Services Criteria and writes up what it found. ISO/IEC 27001 is a certifiable management-system standard: a vendor builds a documented, risk-driven security program, an accredited body audits it, and the vendor earns a certificate. GDPR is a law. It applies whether or not anyone audits you, it carries penalties, and it grants rights to the people whose data is being processed.
They overlap heavily in what they ask for: access control, encryption, logging, incident response, vendor management. They differ in who issues the verdict and what that verdict means. A vendor can hold all three. They answer different questions for different audiences.
A relatable example, tied to enterprise software. Before a sales team buys a CRM add-on, the buyer's security team asks for the SOC 2 report to read how security is run day to day, the ISO 27001 certificate as a quick signal that an accredited body signed off, and a data processing agreement because the system holds names, emails, and call notes about real people. For a sales voice co-pilot built on customer data, the same expectations apply: keeping one client's data walled off from another's, using data only for the purpose it was given, and being able to show, on request, who could access a record and why. These are illustrations of where the field's ideas apply, not claims about any one product.
- SOC 2Attestation report
- An independent auditor reports on the controls within the examination’s scope.
- ISO 27001Certification
- A certification body assesses an information security management system within a defined scope.
- GDPRRegulation
- Legal obligations for handling personal data, including rights for the people it concerns.
The hard part is evidence, not the policy PDF.
Trust does not scale, so frameworks let one independent assessment serve many customers. An honest explainer names where that gets difficult.
Evidence is what travels.
A buyer cannot personally inspect every vendor. One independent assessment, against shared criteria, can serve many customers at once. That reuse is the entire point of third-party attestation and certification.
A control must run for months.
The hard part of a SOC 2 Type II and of an ISMS is sustained evidence: logs, access reviews, change tickets, and incident records that show a control actually operated over time, not a policy that says it should.
A narrow scope can still pass.
SOC 2 lets the vendor pick categories and system boundaries. ISO 27001 requires a defined scope and a Statement of Applicability justifying which Annex A controls apply. A narrow scope can pass an audit while leaving a buyer's real concern out of bounds, so reading scope carefully matters.
A clean report is not a GDPR pass.
A SOC 2 report or an ISO certificate is not a GDPR compliance certificate. Liability under the law does not transfer to an auditor. Processing personal data without a lawful basis is unlawful even with a clean SOC 2.
Some controls are the customer's job.
Controls are split between vendor and customer. A SOC 2 report lists complementary user-entity controls: things the customer must do for the vendor's controls to work. Misreading that seam is a common source of gaps.
A badge goes stale.
A SOC 2 Type II covers a past window and ages. ISO certification carries surveillance audits and a recertification cycle. GDPR obligations are ongoing. Compliance is a state you maintain, not a badge you earn once.
How each verdict is actually reached.
An auditor examines and reports, an accredited body audits a loop and certifies, and a statute sets obligations directly. Underneath, the same controls are mapped across all three.
- 01SOC 2
Examination and report.
- 02ISO 27001
Management-system certification.
- 03GDPR
Legal obligations for personal data.
- 04Controls
Evidence can support multiple requirements.
Not a ranking. Three answers to three different questions, with one shared control set underneath.
1SOC 2 mechanics
An examination, written up under NDA.
The service organization documents its controls and maps them to the Trust Services Criteria. A CPA firm performs the examination under the AICPA attestation standards and issues a report with the auditor's opinion, management's system description, the criteria, and, for a Type II, the tests performed and results. A Type I assesses whether controls are suitably designed at a point in time. A Type II assesses whether they also operated effectively over a period, commonly three to twelve months. Type II is the one enterprise buyers usually want, because design without sustained operation proves little.
SOC 2 Type I
- Scope
- Design of controls at a specified date.
- Evidence
- A picture of the system at that point.
SOC 2 Type II
- Scope
- Design and operating effectiveness over a specified period.
- Evidence
- Examples of controls operating throughout that period.
2The Trust Services Criteria
Five categories, one always included.
The criteria cover five categories: Security, Availability, Processing Integrity, Confidentiality, and Privacy. The vendor chooses which are in scope, but Security, also called the common criteria, is always included. Those common criteria are built on the COSO internal-control framework and broken into series such as the control environment, risk assessment, monitoring, logical and physical access, system operations, change management, and risk mitigation. The other four categories add criteria on top.
- Security
Common criteria form the required foundation.
- Availability
Operation and accessibility as committed.
- Processing integrity
Complete, valid, accurate, timely processing.
- Confidentiality
Protection of information designated confidential.
- Privacy
Handling of personal information.
3ISO/IEC 27001 mechanics
A loop, not a finish line.
ISO/IEC 27001 specifies an Information Security Management System: a documented, risk-driven way of running security that is continually improved. Establish context and scope, get leadership commitment, run a risk assessment and risk treatment process, select controls using Annex A as a reference catalog, write the Statement of Applicability, then operate, monitor, audit internally, review, and improve. That is the Plan-Do-Check-Act cadence. The 2022 revision reorganized Annex A into four themes: organizational, people, physical, technological. An accredited body audits in stages, grants certification, and returns for periodic surveillance audits.
- Plan
Establish scope, assess risk, and choose treatment.
- Do
Implement the selected controls and processes.
- Check
Monitor, audit, and review evidence.
- Act
Correct problems and improve the system.
4GDPR mechanics
Roles, a lawful basis, and rights.
GDPR fixes who decides and who executes. A controller decides why and how data is processed. A processor processes on the controller's instructions, under a data processing agreement (Article 28). Processing needs a lawful basis (consent, contract, legal obligation, vital interests, public task, or legitimate interests). People in the data hold rights: access, rectification, erasure, portability, objection. Apply data protection by design and by default, keep records of processing, run a Data Protection Impact Assessment for high-risk processing, report qualifying breaches to the supervisory authority generally within 72 hours, and use lawful mechanisms such as standard contractual clauses for international transfers. Described here as what the regulation says, not as guidance for your own compliance.
Controller
- Responsibility
- Determines the purposes and means of processing.
Processor
- Responsibility
- Processes personal data on the controller’s behalf.
Access, erasure, and other rights depend on the applicable circumstances.
5The catalogs underneath
One control, three homes.
Auditors and security teams lean on shared catalogs. NIST SP 800-53 is a large control catalog, and the NIST Cybersecurity Framework 2.0 organizes outcomes into functions: Govern, Identify, Protect, Detect, Respond, Recover. The same control, say quarterly access reviews or encryption at rest, shows up under SOC 2 criteria, ISO Annex A, and GDPR's "appropriate technical and organizational measures." Published crosswalks tie these together, so one well-run control can satisfy several frameworks at once instead of being re-evidenced many times.
Quarterly access review
- SOC 2
- Evidence relevant to logical access criteria.
- ISO 27001
- Evidence for the selected access control measures.
- GDPR
- Evidence relevant to appropriate organizational measures.
6Evidence is the currency
The deliverable is a verifiable trail.
Across all three frameworks, the deliverable is the same: verifiable evidence that a control ran. Access logs, change records, training completion, vendor reviews, encryption configuration, and incident timelines. Modern programs centralize this so a single artifact answers several framework requirements, and so the trail can show, after the fact, who could reach a record and why. As an illustration for enterprise SaaS, that is the same trail that lets a vendor demonstrate one client's data stayed isolated from another's, and was used only for the purpose it was given. An example of the field's payoff, not a claim about any system.
| Control | Evidence |
|---|---|
| Access review | Reviewed user list and removal tickets |
| Change management | Approved change and deployment record |
| Incident response | Timeline, decisions, and follow-up actions |
| Security training | Attendance and completion records |
What a well-run program unlocks.
Done well, these frameworks do more than satisfy a checklist. The examples below illustrate the field's payoff. They are not claims about any one product.
A shorter path through security gates.
A SOC 2 Type II report and an ISO 27001 certificate shorten the security review that gates most enterprise and regulated-industry deals. They are often a precondition to even being evaluated.
Compare vendors against shared criteria.
Buyers, auditors, and regulators can judge against published criteria instead of a bespoke questionnaire every time. Due diligence gets a vocabulary everyone already shares.
One program, several frameworks.
Because the controls overlap, one well-run program produces evidence that serves SOC 2, ISO 27001, and GDPR together, lowering the marginal cost of each additional framework.
A forcing function, not just paperwork.
The discipline of continuous evidence, access reviews, change control, incident drills, improves actual security. The paperwork is a by-product of doing the work.
Provable boundaries around data.
Done well, these programs let a vendor demonstrate that one customer's data stays isolated from another's, that data is used only for agreed purposes, and that access can be explained after the fact. Stated as the field's payoff and as an example for enterprise SaaS, not as a claim about our systems.
The direction assurance is heading.
We describe the direction of the field, not a roadmap of our own.
Away from point-in-time audits.
The trend is toward continuous control monitoring, with evidence collected automatically and dashboards showing control status in near real time, instead of a once-a-year, screenshot-driven scramble.
One control set, mapped outward.
Teams increasingly build to a unified control set and map to SOC 2, ISO 27001, GDPR, and CSF 2.0, rather than running each framework as a separate project. CSF 2.0's new Govern function pushes governance and supply-chain risk to the front.
Security and privacy, closer together.
ISO/IEC 27701 extends an ISMS into a privacy information management system, and SOC 2's Privacy category and GDPR increasingly share the same underlying controls. Expect tighter integration of security and privacy assurance.
Scrutiny of how data moves.
As products process more personal data through models, reviewers focus on data lineage, purpose limitation, retention, and whether a person's data is used only for what they may see. Frameworks are extending toward AI-specific risk, and buyers are asking about it directly.
The standards behind this page.
Standards are correct as of the cited revisions.
- AICPA & CIMA. 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (with revised points of focus, 2022). The basis for what a SOC 2 report measures.
- ISO. ISO/IEC 27001:2022, Information security management systems · Requirements. The certifiable ISMS standard and Annex A control set.
- EUR-Lex. Regulation (EU) 2016/679 (General Data Protection Regulation), official Journal text. Controller and processor roles, lawful basis, data-subject rights, DPAs, breach notification, penalties.
- NIST (2024). The NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29). The reference taxonomy of cybersecurity outcomes.
- NIST. SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations. The control catalog underlying many crosswalks.
- NIST. AICPA Trust Services Criteria mapping. Evidence that the same controls map across frameworks.
This page explains the field. It is not legal advice, and it makes no claim that any product holds SOC 2, ISO 27001, or any certification.
Keep reading.
Sibling explainers in the Research section.
Talk. Done.
The frameworks above are how trust gets checked instead of assumed. See the product on a real call.
No app required. Just your phone number.