Contents
- ISO 27001 and SOC 2: two different things
- ISO/IEC 27001:2022: the edition and the transition
- The Annex A controls that concern testing
- SOC 2: the criteria and the two report types
- The ISO certification cycle, step by step
- What technical evidence to prepare
- ISO 27001 and SOC 2 with the same test
- How we prepare the test for an audit
- Frequently asked questions
- Sources
In 30 seconds
- The current edition is ISO/IEC 27001:2022, published on 25 October 2022; certificates against the 2013 edition expired or were withdrawn on 31 October 2025 13.
- Annex A now has 93 controls in 4 themes (down from 114 in 14 clauses), 11 of them new 38.
- ISO 27001 does not explicitly require a penetration test; controls are chosen through risk assessment, but the audit verifies the implementation and effectiveness of technological controls 3.
- In SOC 2, criterion CC4.1 names penetration testing as one of the accepted forms of evaluation, alongside certifications such as ISO and internal audit 17.
- A Type 2 report covers an observation period (in practice 3–12 months), so evidence must exist across the whole period, not just at the end 2024.
- ISO 27001
- 2022 edition 1
- Annex A
- 93 controls 3
- ISO cycle
- 3 years, annual audit 14
- SOC 2 Type 2
- 3–12-month period 20
ISO 27001 and SOC 2: two different things
ISO/IEC 27001 is an international standard for an information security management system (ISMS). An accredited certification body audits the system and issues a certificate valid for three years 114. SOC 2 is a US assurance report, issued only by a CPA auditor, against the AICPA Trust Services Criteria 1519.
| Aspect | ISO/IEC 27001 | SOC 2 |
|---|---|---|
| What you get | A public certificate, valid 3 years 14 | An assurance report, shared with customers 19 |
| Who issues it | Accredited certification body 12 | CPA audit firm 19 |
| What is evaluated | Clauses 4–10, mandatory, and the Annex A controls chosen through risk 2 | The organisation’s controls against the TSC 15 |
| Where it matters | Europe, tenders, supply chains | US customers and partners, SaaS |
Many software companies selling into both markets do both. The good news: the same technical evidence serves both.
ISO/IEC 27001:2022: the edition and the transition
The third edition of the standard was published on 25 October 2022 by the joint committee ISO/IEC JTC 1/SC 27 13. No requirement in clauses 4–10 may be excluded if the organisation claims conformity 2. The transition rules were set by IAF (now Global Accreditation Cooperation) in document MD 26:2023 37.
- 25.10.2022The 2022 edition is published
The 36-month transition period begins 3.
- Feb 2024
- 30.04.2024Only the 2022 edition for new certifications
Initial certifications and recertifications are done against the 2022 edition only 3.
- 31.10.2025End of the transition
Certificates against the 2013 edition expire or are withdrawn 3.
Annex A now has 93 controls in four themes: organisational (37), people (8), physical (14) and technological (34). The 2013 edition had 114 controls in 14 clauses; of the 93, 11 are new, 24 merged and 58 updated 38. In the Republic of Moldova, the 2024 amendment is adopted identically as SM EN ISO/IEC 27001:2023/A1:2024 6.
The Annex A controls that concern testing
The control texts are copyrighted, so we describe them in our own words, by topic. These are the controls for which a technical test provides the most direct evidence 891011.
| Control | Topic | What evidence a test provides |
|---|---|---|
| 5.7 (new) | Threat intelligence | Test scenarios start from the sector’s real threats |
| 5.35 | Independent review of security | An external tester is, by definition, an independent check 10 |
| 8.8 | Technical vulnerabilities | Scans and penetration tests, with tracked remediation 9 |
| 8.16 (new) | Monitoring activities | Which tester actions were detected and which were not |
| 8.25–8.28 | Secure development, architecture, secure coding (8.28 new) | Application findings show where the rules are not applied |
| 8.29 | Security testing in development and acceptance | A test before release, with a retest after remediation |
| 8.34 | Protection of systems during audit testing | Tests on production are planned and approved in writing 11 |
SOC 2: the criteria and the two report types
SOC 2 reports against the 2017 Trust Services Criteria, with points of focus revised in 2022. The criteria themselves did not change then, only the points of focus, including identifying threats and vulnerabilities in risk assessment and testing patches; the points of focus need not all be met 1516.
| Criterion | What it asks, in short | Where the test fits |
|---|---|---|
| CC3.2 / CC3.4 | Identifying risks and significant changes | Findings feed the risk assessment |
| CC4.1 | Ongoing and/or separate evaluations of controls | A pentest is one of the forms named, alongside ISO certification and internal audit 17 |
| CC7.1 | Detecting configuration changes that introduce vulnerabilities, and new vulnerabilities | Periodic scans and scans after significant changes, with timely remediation 18 |
A Type 1 report evaluates control design at a point in time. A Type 2 report evaluates design and operating effectiveness over a period, in practice 3 to 12 months, most often 6–12; AICPA sets no minimum 2024. Some auditors accept an ISO certification instead of a pentest for CC4.1 — that is practice opinion, not a rule 21.
The ISO certification cycle, step by step
- Stage 1
The auditor reviews documentation and readiness for the main audit 14.
- Stage 2
Implementation and effectiveness of the system are verified. This is where technical evidence is requested 14.
- Surveillance
At least once per calendar year; the first within 12 months of the certification decision 14.
- Recertification
Before the three years expire, covering the whole system 14.
Certification bodies now work to ISO/IEC 27006-1:2024, published on 1 March 2024, which replaces ISO/IEC 27006:2015 12. UKAS, for example, required the transition by 31 July 2025 13.
What technical evidence to prepare
What technical evidence will the auditor ask for?
Auditor practice, not standard text: neither ISO 27001 nor SOC 2 gives a fixed list. This shows what organisations that pass without nonconformities usually prepare.
0 pieces of technical evidence for your audit
- The penetration test report, with scope, date, method and findings ranked by severity.
- The vulnerability scanning schedule and the latest results (ISO 8.8; SOC 2 CC7.1).
- Remediation tickets, with an owner and a deadline for every finding.
- The retest showing that significant vulnerabilities were closed.
- The Statement of Applicability (SoA) and the risk assessment justifying why technical controls are included and how they are verified.
- The written agreement for tests on production (scope, time windows, who approves) — the subject of control 8.34.
- The link to risk assessment: how findings fed into the threat and vulnerability analysis (CC3.2, CC3.4).
- Evidence across the whole observation period: recurring scans and a test performed inside the period, not before it.
- What changed since the last audit: new systems, reopened findings, tests after significant changes.
- The three-year history: tests, remediations and retests across the whole certification cycle.
For Type 2, the test must fall inside the observation period (usually 6–12 months). Plan it from the start of the period.
Plan the test for your audit →ISO 27001 and SOC 2 with the same test
A single well-documented test can serve both audits, if the scope covers the systems of both and the report contains scope, date, method, findings and the retest. AICPA published a mapping between the TSC and ISO 27001 in 2018 22 — it predates the 2022 edition, so it uses the old Annex A numbering.
- The same scope, described once, covering the systems of both audits.
- The test scheduled inside the SOC 2 Type 2 observation period.
- Findings linked to ISO controls (8.8, 8.29) and to SOC 2 criteria (CC4.1, CC7.1).
- The retest, dated, before the audit.
In the Republic of Moldova, a valid ISO/IEC 27001 certificate exempts you from the annex of Decision 562/2025 under the cybersecurity law, but the Agency may still assess you 23. Details in the Law 48/2023 guide.
How we prepare the test for an audit
- Scope from the SoA or the system description
We start from what you declared to the auditor, so the test covers exactly the audited systems.
- Written agreement for production
Windows, contacts and limits agreed in advance, in the spirit of control 8.34.
- Manual testing
Applications, APIs, cloud or network, depending on scope; scanning is only the starting point.
- A report for the auditor
Scope, date, method, findings with severity and remediation, plus references to the relevant controls and criteria.
- Retest
After remediation, the retest closes findings with dated evidence — exactly what the auditor looks for.
Frequently asked questions
Does ISO 27001 require a penetration test?
Is an ISO 27001:2013 certificate still valid?
Does the 2024 climate amendment require recertification?
Is a vulnerability scan enough for SOC 2?
How long is a SOC 2 Type 2 period?
Who can issue a SOC 2 report?
Sources
Every statement about a law or standard links to its official source. Consulted on the date shown.
- ISO/IEC 27001:2022 — publication record (edition 3, 25.10.2022)webstore.iec.ch · accessed 22 October 2026
- ISO/IEC 27001:2022 — standard abstract (clauses 4–10)sis.se · accessed 22 October 2026
- IAF MD 26:2023 — transition requirements for ISO/IEC 27001:2022iaf.nu · accessed 22 October 2026
- ISO/IEC 27001:2022/Amd 1:2024 — climate action changesiso.org · accessed 22 October 2026
- Joint IAF–ISO communiqué on the climate amendments (February 2024)iaf.nu · accessed 22 October 2026
- SM EN ISO/IEC 27001:2023/A1:2024 — adoption in the Republic of Moldovashop.standard.md · accessed 22 October 2026
- Global Accreditation Cooperation (successor to IAF and ILAC since 2026)globalaccreditationcooperationincorporated.org · accessed 22 October 2026
- DQS — what changed in ISO 27001:2022 (the new controls)dqsglobal.com · accessed 22 October 2026
- DQS — controls 8.8 and 8.9: technical vulnerabilities and configurationdqsglobal.com · accessed 22 October 2026
- Advisera — control 5.35, independent reviewadvisera.com · accessed 22 October 2026
- ISMS.online — control 8.34, protection of systems during audit testingisms.online · accessed 22 October 2026
- ISO/IEC 27006-1:2024 — requirements for certification bodieswebstore.iec.ch · accessed 22 October 2026
- UKAS — transition to ISO/IEC 27006-1:2024ukas.com · accessed 22 October 2026
- Bureau Veritas — technical terms for accredited certification (ISO/IEC 17021-1)bureauveritas.com · accessed 22 October 2026
- AICPA — 2017 Trust Services Criteria (with revised points of focus, 2022)aicpa-cima.com · accessed 22 October 2026
- EY — revised points of focus in the SOC 2 criteria (November 2022)ey.com · accessed 22 October 2026
- SOC 2 CC4.1 — types of evaluations (point of focus)cloudaware.com · accessed 22 October 2026
- SOC 2 CC7.1 — vulnerability scanning (point of focus)cloudaware.com · accessed 22 October 2026
- AICPA — SOC 2: assurance reportsaicpa-cima.com · accessed 22 October 2026
- Deloitte — providing assurance through SOC reportsdeloitte.com · accessed 22 October 2026
- Linford & Co — penetration testing in SOC 2linfordco.com · accessed 22 October 2026
- AICPA — mapping the 2017 TSC to ISO 27001 (2018)aicpa-cima.com · accessed 22 October 2026
- Government Decision No. 562/2025: cybersecurity obligations (Republic of Moldova)legis.md · accessed 22 October 2026
- Linford & Co — the SOC 2 Type 2 reportlinfordco.com · accessed 22 October 2026
About the authors
The guides are written by the team that does the testing, not a marketing department. We update them when the law, the standard or what we see in testing changes.