ISO 27701 vs SOC 2 Privacy: Which Evidence Do Buyers Want?

Five. Instrument type: ISO certification attests conformity of a management system to a published standard, pass/fail with nonconformities; SOC 2 is an examination producing a detailed report, the auditor's opinion plus control descriptions, test procedures, and results, including exceptions, which buyers read. Scope model: ISO scopes a management system (activities, sites, processing); SOC 2 scopes a 'system' (the service and its infrastructure) with the privacy category applying to personal information within it. Time basis: ISO audits sample the system's operation at audit time with surveillance continuity; SOC 2 Type II covers a defined observation period (commonly 12 months) with controls tested across it, Type I (point-in-time design-only) carries little weight. Criteria source: ISO requirements are fixed by the standard; SOC 2 privacy criteria come from the AICPA Trust Services Criteria, but management writes the system description and control set, giving more drafting latitude and less comparability. Distribution: ISO certificates are public one-page facts; SOC 2 reports are confidential, shared under NDA, and their detail is exactly why sophisticated buyers prefer them. Net: ISO answers 'do you run a conforming privacy management system?'; SOC 2 answers 'did these specific controls operate effectively over the last year, and where did they fail?'

Cleanly, in most cases. US enterprise procurement default: SOC 2 Type II, security questionnaires assume it, vendor-risk platforms ingest it, and its absence triggers friction regardless of what else you hold; if your revenue is US enterprise SaaS, SOC 2 comes first and the only question is whether privacy joins the criteria set. EU and international default: ISO 27001 recognition is near-universal, 27701 rides that recognition, and Article 28 diligence conversations move faster with certificates than with US attestation reports counterparties must read under NDA; regulated European industries and public-sector procurement often name ISO standards explicitly in tender requirements. Sector overlays: healthcare and fintech buyers often want both plus regime-specific artifacts; government-adjacent US work pulls toward NIST frameworks instead. The decision heuristic: map the next eight quarters of pipeline by geography and sector, ask sales which artifact unblocks which deals, and let revenue sequence the roadmap, an uncomfortable but honest framing, since both instruments exist substantially to compress enterprise diligence. Where pipelines split roughly evenly, start with the one whose evidence you are closer to generating, then add the second on the shared control set within eighteen months.

The Trust Services Criteria privacy category covers the personal-information lifecycle: notice and communication of commitments; choice and consent; collection limited to identified purposes; use, retention, and disposal per commitments; access for review and correction; disclosure and onward-transfer controls plus incident notification; quality (accuracy, completeness); and monitoring including complaint handling. Management's system description must state the entity's privacy commitments (typically anchored to the privacy notice), and the examiner tests the controls implementing those commitments across the observation period. It is rare in the wild, the overwhelming majority of SOC 2 reports cover security plus availability and/or confidentiality only, because: the criteria demand operational privacy machinery (consent records, DSAR handling, retention execution) many SaaS processors lack; the commitments basis means your own privacy notice becomes testable audit criteria, sharpening the cost of aspirational notice language; and buyers historically pushed hardest on security. That is changing where processors handle consumer PII at scale, and privacy-inclusive SOC 2 reports increasingly function as the US-market analogue of a 27701 certificate: a costly signal that the privacy program actually operates, precisely because everyone knows most vendors decline the category.

ISO 27701: heavy first year, program build from the gap assessment through control implementation and evidence generation, then stage 1 and stage 2 fees; steady state is annual surveillance (a fraction of initial audit scope) and internal sustainment commonly estimated at a third of build effort annually; three-year recertification spikes. If 27001 is not already in place, its build precedes or accompanies, the dominant cost driver for ISO newcomers. SOC 2 privacy: if SOC 2 security already runs, adding privacy means extending the system description, implementing lifecycle controls, and paying incremental examination fees; if starting fresh, a readiness assessment, control build, a Type I (optional bridge), then annual Type II examinations, which cost roughly the same every year, because every year re-tests the whole observation period. Internal effort skews differently: ISO's burden concentrates in the management-system disciplines (internal audit, management review, documentation); SOC 2's concentrates in continuous evidence hygiene, examiners sample the full period, so a control that lapsed in March surfaces in the January report as an exception. Combined-path economics: shared control implementations, one evidence store, coordinated fieldwork, and a crosswalk register can hold the second instrument's marginal cost to a fraction of standalone, which is why the both-instruments pattern is now common at scale.

One control set, two reporting surfaces. Architecture: implement controls once against your own control register, then map each control to its 27701 clause and its Trust Services criterion with evidence pointers, the crosswalk register pattern; neither the ISO auditor nor the CPA examiner needs to know or care that the other exists, but your team maintains one program. Evidence design: build artifacts that satisfy the stricter of the two demands, SOC 2's period-coverage requirement usually wins, so instrument controls to emit continuous evidence (automated logs, ticketed workflows) rather than audit-time snapshots; this simultaneously makes ISO surveillance trivial. Calendar coordination: align the SOC 2 observation period end and the ISO surveillance audit so evidence collection peaks once; many companies run fieldwork in adjacent weeks with a shared internal-audit cycle preceding both. Description discipline: keep the SOC 2 system description, the ISO scope statement, and the privacy notice consistent, buyers and examiners read all three, and contradictions (a notice promising deletion in 30 days, an ISO retention schedule saying 90) become findings in one forum or another. Staffing: one program owner, control owners shared, and external advisors who have run combined programs; the anti-pattern is separate ISO and SOC 2 workstreams discovering each other's contradictions during fieldwork.