# Do we need ISO 27001 or SOC 2?

It depends mostly on who your customers are and what they ask for. ISO/IEC 27001 is an international certification of your management system, widely recognised in Europe and in public procurement; SOC 2 is an attestation report built on American auditing standards, common in North American software sales. Many European mid-sized companies are asked for ISO 27001 first, while companies selling software into the United States meet SOC 2 questionnaires. Both look at much the same controls, so the underlying work overlaps a great deal: risk assessment, access control, change management, supplier management, incident response, logging and monitoring. If you need both eventually, build one set of controls and map it to each framework rather than running two programmes. Before you start either, ask your largest customers and prospects which they accept, check whether a completed security questionnaire would do for now, and define the scope narrowly enough to finish. Neither replaces NIS2 duties. NetSenX holds neither today: SOC 2 Type I and ISO/IEC 42001 are in preparation.

FAQ: [Security standards: ISO 27001, SOC 2](https://netsenx.com/en/faq/standards) · https://netsenx.com/en/faq/iso-27001-or-soc-2-which-do-we-need

## Read next

- https://netsenx.com/en/compliance
- https://netsenx.com/en/security
- https://netsenx.com/en/nis2-readiness

## Related questions

- [What is ISO/IEC 42001?](https://netsenx.com/en/faq/what-is-iso-42001)
- [What is IEC 62443, and do we need it?](https://netsenx.com/en/faq/what-is-iec-62443)
- [Does an ISO 27001 certificate mean we meet NIS2?](https://netsenx.com/en/faq/does-iso-27001-cover-nis2)
- [Which ISO 27001 controls does network monitoring help with?](https://netsenx.com/en/faq/which-iso-27001-controls-does-network-monitoring-support)
- [Does NetSenX hold ISO 27001 or SOC 2 certification?](https://netsenx.com/en/faq/what-certifications-does-netsenx-hold)