Preparing for SOC 2 and ISO 27001 at once

Roughly two thirds of the work is shared. The third that is not shared is the third that decides whether doing both at once saves you money or costs you a quarter.

Last reviewed 2026-09-01Written by Jacob Masse, TrazTech Inc.

Preparing for both at the same time is worth it if you already know that a second buyer has asked for ISO 27001 in writing. It is not worth it on speculation. The control work overlaps heavily, so the second framework adds around 30 to 40 percent to your preparation effort rather than doubling it, but the audit fees do not overlap at all and the management-system paperwork ISO demands has no SOC 2 equivalent. Expect roughly $30,000 to $55,000 CAD of certification-body fees on top of your SOC 2 audit fee for a first ISO certification at Canadian SaaS scale.

This page is the preparer's side. If your question is which of the two your buyer wants, that comparison lives on iso27k.ca. Read it first. The answer changes what you do here.

What actually overlaps between the two?

The overlap is in controls and evidence. It is not in structure. Every row below that says "shared" means one artifact satisfies both auditors, though you will still produce it twice because the two engagements happen at different times against different scopes.

Read the last five rows as the real cost of the second framework. Everything above them you were going to build anyway, and the preparation guide already sequences it. The Statement of Applicability, internal audit, management review and objectives are net new documents with no SOC 2 counterpart, and together they are most of the extra 30 to 40 percent.

Which direction is easier, SOC 2 first or ISO first?

SOC 2 first is easier for a Canadian SaaS company, and it is what we would recommend unless the ISO request came first and in writing. Two reasons.

The window is the constraint, not the controls

A Type 2 needs three to twelve months of records to exist before an auditor can start. ISO has no equivalent wait. So the SOC 2 clock is the one worth starting first, because ISO preparation can run inside the window you are already waiting through.

ISO's extra documents are cheap once the controls exist

A Statement of Applicability against controls you already operate is a week of writing. The same document written before the controls exist is a wish list you then have to go and make true, twice.

The reverse is defensible in one case

If your buyers are in the EU or UK, ISO 27001 is the report they actually recognize and SOC 2 may be the speculative one. Then invert everything on this page. The honest counter-case is that this site is written for a Canadian company selling into the United States, and for that reader ISO first is the more expensive order.

Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.

What order should the work go in?

1. Fix scope once, for both. The ISMS scope statement and the SOC 2 system description describe the same boundary in different registers, so decide the boundary a single time. The scope and system description page has the boundary tests.
2. Run one gap analysis mapped to both. Insist the output has an ISO column. A gap analysis priced for SOC 2 alone and then repeated for ISO is the single most common way companies pay twice for one week of work.
3. Build the shared controls. Everything in the first seven rows of the table above. This is the bulk of the calendar and it counts for both.
4. Open the SOC 2 observation window as soon as the shared controls run. Waiting for the ISO paperwork before starting the window adds that paperwork's duration to your report date for no benefit.
5. Write the ISO-only documents during the window. Statement of Applicability, objectives, the internal audit plan, and the management review agenda. This is the quarter that would otherwise be dead time.
6. Run the ISO internal audit near the end of the window, then book Stage 1. Certification bodies want the internal audit and at least one management review already done before Stage 2.

What does running both cost in CAD?

The penetration test row is the one people miss when they budget. It is a single test that both frameworks accept, so it is shared, and what a SOC 2 auditor expects from that test is close enough to what a certification body expects that one scope covers both. Ranges are CAD and reflect Canadian firm quotes in 2026.

When is doing both at once the wrong call?

Three situations.

The counter-case: if you have already decided ISO is coming within eighteen months, running it in sequence rather than together means building the same control twice under two different owners with two different sets of evidence conventions, and the rework there is real. The break-even is whether the second framework is a decision or a hypothesis.