If you run a SaaS company selling into enterprise accounts, you've probably had this exact moment: a procurement team sends over a security questionnaire, and buried in it is a line that says "ISO 27001 certified?" You already have SOC 2. You figured that would cover it. It doesn't — not always, and not for every buyer.

ISO 27001 (formally ISO/IEC 27001:2022) is the international standard for information security management. Unlike SOC 2, which is a US-centric attestation report, ISO 27001 is a certification — issued by an accredited third-party body, recognized in over 150 countries, and built around an ongoing management system rather than a one-time audit snapshot. For companies expanding into Europe, the Middle East, or Asia-Pacific markets, it's often not optional. It's the price of entry.

Why ISO 27001 Is Different From SOC 2

The confusion is understandable. Both frameworks touch the same territory — access control, risk management, incident response, vendor oversight. But they're structured differently and they answer different questions.

SOC 2 tells a customer: "An independent auditor tested these specific controls over a defined period, and here's what they found." It's a report, and it expires after twelve months. It's also mostly meaningful to US-based buyers who already understand the AICPA framework behind it.

ISO 27001 tells a customer something broader: "This company has built and operates a functioning Information Security Management System — an ISMS — that identifies risk, treats it, and improves continuously." It's a certification rather than a report, valid on a three-year cycle with annual surveillance audits in between, and it comes with a public listing on the certification body's registrar. A buyer in Germany or the UAE who has never heard of SOC 2 will recognize ISO 27001 immediately, while that same buyer might need SOC 2 explained to them from scratch.

The practical upshot: SOC 2 opens doors in the US. ISO 27001 opens most of the doors everywhere else. Companies selling internationally tend to end up needing both, run as one coordinated program rather than two separate efforts.

The Structure Behind ISO 27001: Annex A and the Four Control Themes

The 2022 revision of ISO/IEC 27001 reorganized its control set — known as Annex A — into four themes that are far easier to reason about than the older, more scattered structure:

Organizational controls (37 controls): policies, roles, supplier relationships, and how security decisions actually get made inside the company.
People controls (8 controls): screening, training, remote work practices, and disciplinary processes.
Physical controls (14 controls): secure facilities, equipment handling, and physical access.
Technological controls (34 controls): access management, cryptography, logging, malware defense, and secure development practices.

That's 93 controls in total, but here's the part that surprises a lot of first-time applicants: you don't have to implement all 93. Your Statement of Applicability — a core document in the certification process — defines which controls genuinely apply to your business based on a formal risk assessment. A 40-person SaaS company doesn't need the same physical security controls as a company running its own data centers. ISO 27001 is designed to scale to the business, not the other way around.

How Certification Actually Works: Two Audit Stages

Where SOC 2 has its Type I and Type II split, ISO 27001 certification runs through two audit stages performed by an accredited certification body.

Stage 1 is a documentation review. The certification body examines your ISMS scope, your risk assessment methodology, and your Statement of Applicability to confirm you're actually ready for the operational audit. This typically takes one to two days and usually surfaces a short list of gaps to close before Stage 2.

Stage 2 is where things get tested for real. Auditors check whether your controls are operating as documented — not just written down somewhere, but genuinely in use. Expect interviews, evidence sampling, and in some cases site checks. This stage usually runs two to four days. A pass results in a certificate valid for three years, with annual surveillance audits in years one and two to confirm the ISMS is still holding up, followed by a full recertification audit at year three.

That surveillance cycle is really the heart of what makes ISO 27001 different from a report you file once. It's a management system that has to keep functioning, year after year, not a document that sits in a drawer after the audit ends.

The Realistic Timeline

For a company starting from zero, certification typically takes four to nine months — from the initial gap analysis through the Stage 2 audit. That range depends heavily on how mature your existing security practices already are.

Companies that already hold SOC 2 usually move faster. A meaningful amount of evidence — access reviews, incident response procedures, vendor risk assessments — maps directly onto Annex A controls, which cuts down on duplicate work considerably. If your team has already been through a SOC 2 Type II audit, you're not starting from a blank page.

A Common Scenario Worth Planning For

Here's a pattern that shows up often: a US SaaS company signs its first major EU customer, and that customer's procurement team specifically asks for ISO 27001 — SOC 2 isn't going to satisfy the requirement, no matter how strong the report is. At that point, the company is usually racing a deal clock, trying to figure out how fast certification can realistically happen.

The answer depends heavily on preparation. A gap analysis against Annex A, a properly scoped ISMS, and an accredited certification body lined up early can turn what feels like a scramble into a structured four-to-nine-month process instead of an open-ended one.

Another version of this: a company already holds SOC 2 and gets told, almost as an afterthought, that ISO 27001 is now a hard requirement too. The instinct is to dread a second full audit process from scratch. In practice, mapping Trust Services Criteria against Annex A controls means control owners answer questions once instead of twice.

How B4Q Assurance Helps

B4Q Assurance CPA PC works with US SaaS, fintech, and health-tech companies through the full ISO 27001 journey — not just the audit itself, but everything that has to happen before an auditor ever shows up.

That starts with a gap analysis against ISO/IEC 27001:2022, defining your ISMS scope and boundaries, and building out the risk assessment methodology and Statement of Applicability your certification body will expect to see. From there, we run the internal audit and management review the standard requires, coordinate directly with an accredited certification body across both Stage 1 and Stage 2, and stay engaged through corrective actions if any come up.

If you're already SOC 2 certified, we map your existing evidence directly onto Annex A so your team isn't rebuilding documentation that already exists — just extending it. And once certified, we stay on for the annual surveillance audits, because a lapsed ISMS defeats the purpose of certifying in the first place.

We've guided more than 50 businesses through this process, across SaaS, fintech, healthcare, and manufacturing, at every stage from first-time certification to multi-framework programs running SOC 2 and ISO 27001 side by side.

Ready to Map Out Your ISO 27001 Timeline?

If a customer, an investor, or your own growth plans are pushing ISO 27001 onto your roadmap, the earlier you start the gap analysis, the more realistic your timeline becomes.

Book a free strategy call with B4Q Assurance, and we'll walk through exactly where your business stands against Annex A and what a certification path looks like for you.

More Info: https://b4q.us/iso-27001/