ISO 27001 to SOC 2: what carries over

The counts first, because everything below sits on them. ISO published the 2022 edition on 25 October 2022. Annex A went from 114 controls in fourteen clauses to 93 in four, of which 11 are new, 24 are merged and 58 are updated. The International Accreditation Forum states those figures in IAF MD 26, issue 2, and set 31 October 2025 as the last date an accredited 2013 certificate could be transitioned. Checked 1 August 2026. So if your certificate is current, it is a 2022 certificate, and the crosswalk below assumes that.

Themes map, controls do not

Annex A sorts its controls into organizational, people, physical and technological measures. The Trust Services Criteria sort differently: nine common criteria series that every SOC 2 report covers, plus category criteria for availability, confidentiality, processing integrity and privacy when you scope them.¹ One structure is built around a management system. The other is built around commitments made to customers.

So a control-by-control mapping is the wrong shape. It produces a column of maybes and a false sense of coverage. Group by theme instead. Then decide, per area, what your auditor does with the evidence you already keep. That last decision is the column worth reading.

As is

The artifact you already maintain satisfies the criterion in the form it is in. Your auditor reads it and moves on.

Re-tested

The same artifact type carries over, but a Type 2 tests it across the whole observation period instead of at one audit visit. You keep the process. The population changes.

Carved out

The control belongs to a subservice organization, usually your cloud provider, and is excluded from your description with its own criteria named.

Net new

Nothing in your ISMS produces this. You write it.

The Annex A to Trust Services Criteria crosswalk

Clause references are given so you can line each row up against your own Statement of Applicability. The control areas are described rather than quoted, because Annex A text is copyrighted and ISO does not publish it freely. The criteria come from the AICPA document, which is public.¹

Privacy is left out of the last group on purpose. It carries more criteria than availability, confidentiality and processing integrity put together,¹ and a first report rarely needs it. The scoping tool works out which categories your buyer is actually asking for.

What an auditor reads as it is

The reusable set is documentary, and you already own all of it. Your policy suite. The risk assessment and risk treatment plan. The Statement of Applicability. The asset register, the supplier register, signed confidentiality agreements, job descriptions with security responsibilities in them.

Two of your ISO artifacts are worth more than the rest. The first is the internal audit report, because CC4.1 asks for periodic evaluations of whether controls are present and working, and an ISO internal audit is exactly that.¹ The second is management review, which lands on the same criterion from the governance side. Both are accepted in the form your ISMS already produces them.

The Statement of Applicability is the third, and it does a different job. It is not evidence of anything. It is the best starting index you will find for the mapping work, because it already records which controls apply to you and why the excluded ones do not. That is half of a scoping memo written before anyone asked for one.

What gets re-tested, and why that is not duplication

A certification body audits conformity of the management system and samples at the audit visit. A SOC 2 Type 2 opinion covers a stated period, so the service auditor selects instances from the population that occurred inside that period and tests each one.³ Same control. Different question.

ISO asks whether the process exists and operates. SOC 2 asks how many times it fired between two dates, and whether every selected instance was correct. That is why the access review your certification body looked at once becomes a population of every review inside the window, and why the joiner and leaver records for the whole period get pulled rather than a handful.

The practical consequence is about completeness rather than effort. You will be asked to prove that an export is the whole population and not a filtered view of it. A conformity audit does not have to ask that, because it samples at the visit rather than across a window. Retention settings decide whether you can answer. The evidence checklist lists what each artifact has to carry to be testable.

What SOC 2 adds that ISO never asked for

This is the part of the delta nobody writes down, and it is not controls. It is documents, and none of them exist inside an ISMS.

1. The system description. Section 3 of the report. What the service does, where its boundary sits, which components are inside it, and which subservice organizations it depends on. ISO has no equivalent document.
2. Management’s written assertion. Your own signed statement about the description and the controls, which is the thing the CPA firm then examines. The Statement of Applicability is not this and cannot stand in for it.
3. Service commitments and system requirements. The largest conceptual gap. ISO measures your controls against your own risk assessment. SOC 2 measures them against the promises you made to customers in contracts, service level agreements and published documentation.¹ Those promises have to be written down as the basis for the controls.
4. Subservice organization treatment. Carve-out or inclusive, decided per provider, and stated in the description. Annex A asks you to manage suppliers. It does not ask you to declare which parts of your own report you are excluding.
5. Complementary user entity controls. The things your customers have to do for your controls to work, written as obligations on them. Wording them is the part with consequences, because a vague one transfers nothing.

Four of those five are writing tasks. The fifth, service commitments, is a decision about scope that then drives everything else, so do it first.

How many weeks the delta actually takes

Split the answer by report type, because the calendars are unrelated.

A Type 1 has no observation period. It speaks to a single date, so the work is the mapping, the three net-new documents, and whatever your Statement of Applicability excluded that a criterion still requires. For a company with a live ISMS that is document work rather than engineering, and it is the fastest route out of a blocked deal.

A first Type 2 is set by elapsed time. Three months is the accepted minimum window, and no certificate shortens it. Controls have to operate across a period before anyone can test whether they operated effectively. Why three months is the floor works through the arithmetic, and the phase by phase timeline gives every other duration.

Holding ISO 27001 moves one phase and only one. Gap remediation is shorter, because the controls exist and the policies are written. Everything downstream of that runs on the same clock as it would for anyone else.

What it costs on top

Through Polara Labs a Type 1 is $4,000 one time, and that number includes the first examination and the engagement fee for the independent partner auditor. Type 2 monitoring is $600 per month on a 12-month term, and each examination is $5,000, so a full Type 2 year with one examination comes to $12,200.

Your certificate does not move those figures. The examination fee pays for testing, and the testing happens whether or not you arrived organized. What an ISMS buys you is the part before the examination, which is the part that usually takes the longest.

Where to start on Monday

1. Open the Statement of Applicability and mark every excluded control against the crosswalk above. Exclusions that touch a common criterion are your real gap list.
2. Write the service commitments down. Pull them from your contracts, your service level agreements and your public documentation, then check that a control exists for each one.
3. Decide carve-out or inclusive for each subservice organization before you draft the description, because the choice changes what the description has to say.
4. Check your retention windows against the observation period you intend to claim. Logs that roll off at 90 days cannot evidence a six month window.
5. Pick the report type from the deal, not from the framework. A buyer holding your ISO certificate and still asking for SOC 2 usually wants the Type 2, and usually accepts a Type 1 while the window runs.