ISO 27001 vs SOC 2 vs PCI-DSS: Which Compliance Framework Does Your Business Actually Need?
Most companies chase compliance the wrong way: they pick the framework a sales prospect asked for on a questionnaire, spend six months gathering evidence, pass the audit, and then change nothing until the next audit cycle. That is compliance theater — the illusion of security without the substance. The right framework, pursued correctly, does the opposite: it imposes a floor of security practices that your organization has to maintain continuously, not once a year.
Compliance Is Not Security — But It Forces a Floor
Passing an audit does not mean you are secure. It means you satisfied a specific set of controls at a specific point in time. Attackers do not care about your certificate. What matters is whether those controls are actually working when an attacker shows up at 2 a.m. on a Saturday.
That said, frameworks are useful precisely because they are opinionated. They force conversations inside your organization that would otherwise never happen: Who owns asset inventory? Do we have a vulnerability management process? What is our incident response plan, and have we actually tested it? If you use a framework to answer those questions honestly, you come out with real security improvements — not just paperwork.
The mistake is letting the audit be the goal instead of the by-product.
ISO 27001: The International Standard
What it covers. ISO 27001 is a management system standard, not a technical checklist. It requires you to build an Information Security Management System (ISMS) — a documented, risk-driven program that covers 93 controls organized into four domains: organizational, people, physical, and technological.
Who needs it. Enterprises selling into European markets, companies pursuing government or defense contracts, and any organization where international customers ask for a formal security standard during procurement. It is table stakes in the UK, Germany, Japan, and the Gulf region.
Audit process. A two-stage audit by an accredited certification body. Stage 1 is a documentation review; Stage 2 is the on-site assessment. After certification you face annual surveillance audits and a full recertification every three years.
Cost. Expect $30,000–$80,000 total for mid-size organizations when you include consultant fees, internal time, and the certification body’s fees. Gap assessments and tooling add more. The ongoing maintenance cost is often underestimated — the standard requires continuous improvement, not a one-time project.
SOC 2: The SaaS Standard
Type I vs Type II. A SOC 2 Type I report says: “Our controls are designed appropriately as of this date.” A Type II report says: “Our controls operated effectively over a period of time (typically 6–12 months).” Every serious B2B customer wants Type II. Type I is a stepping stone, not a finish line.
The five Trust Services Criteria. Security (required), Availability, Processing Integrity, Confidentiality, and Privacy. Most SaaS vendors pursue Security and Availability. You define which criteria apply to your product based on what your customers actually care about.
Who needs it. Any SaaS company selling to mid-market or enterprise US customers. Security questionnaires from large buyers almost always ask for a SOC 2 Type II report. Cloud service providers, data processors, and managed service providers also commonly need it.
Timeline. Budget 6 months minimum from serious preparation to a Type II report. The observation period alone is 6–12 months. If you start from scratch, a realistic end-to-end timeline is 9–15 months before you have a report you are proud to share.
PCI-DSS: If You Touch Card Data, You Have No Choice
Who must comply. Any organization that stores, processes, or transmits cardholder data — credit card numbers, CVVs, track data. There is no opt-out. The card brands (Visa, Mastercard, Amex) mandate it through your payment processor contracts. Violate it and you face fines, increased transaction fees, and ultimately losing the ability to accept card payments.
SAQ vs full audit. Small merchants with limited card data exposure can self-attest using a Self-Assessment Questionnaire (SAQ). There are multiple SAQ types (A, A-EP, B, C, D) depending on your integration model. Larger merchants and service providers require a Qualified Security Assessor (QSA) to conduct a formal Report on Compliance (ROC).
The 12 requirements at a glance. Install and maintain a firewall; don’t use vendor defaults; protect stored cardholder data; encrypt transmission over open networks; use and update anti-malware; develop and maintain secure systems; restrict data access by business need; assign unique IDs to each person with computer access; restrict physical access; track and monitor all access to network resources and cardholder data; regularly test security systems; maintain an information security policy.
Comparison Table
| ISO 27001 | SOC 2 Type II | PCI-DSS | |
|---|---|---|---|
| Scope | Organization-wide ISMS | Cloud/SaaS service | Card data environment |
| Primary audience | Enterprise, international buyers | US B2B SaaS customers | Payment processors, merchants |
| Output | Certification | Attestation report (CPA-issued) | ROC or SAQ |
| Governing body | ISO/IEC | AICPA | PCI Security Standards Council |
| Time to achieve | 12–18 months | 9–15 months | 3–12 months |
| Typical cost | $30k–$80k | $20k–$60k | $5k–$100k+ |
| Ongoing cadence | Annual surveillance + 3-year recertification | Annual audit | Annual reassessment |
| Mandatory? | No (market-driven) | No (customer-driven) | Yes (contractual) |
How to Choose: A Decision Tree
You process payment card data? PCI-DSS is not optional. Start there, full stop.
You sell SaaS to US enterprise customers? SOC 2 Type II is what their vendor security teams will ask for. It maps cleanly to your product boundary.
You sell into European, UK, Japanese, or government markets — or you want a single framework to unify your whole security program? ISO 27001 is the right anchor. Its ISMS model is more comprehensive and internationally recognized.
You need both SOC 2 and ISO 27001? The controls overlap significantly — roughly 80% of ISO 27001 Annex A controls map to SOC 2 Trust Services Criteria. Companies that need both typically build the ISO 27001 ISMS first and produce SOC 2 reports as a by-product of the same evidence.
You are an early-stage startup with no immediate enterprise deals? Neither. Build a solid security baseline — MFA everywhere, least-privilege access, logging, vulnerability management — and get SOC 2 Type I in your roadmap for year two when customers start asking.
Common Mistakes
Checkbox compliance. Generating a policy document for every control and doing nothing to enforce it. Auditors look for evidence of operation, not existence of documents.
Audit theater. Spinning up evidence-collection sprints in the 90 days before the audit and relaxing the other 270. Auditors sample across the observation period. If your access reviews only happened in October, that is a finding.
Point-in-time thinking. Compliance is not a project with a completion date. The second you earn the certification, you are already accumulating drift. New services get deployed without being added to the asset inventory. Former employees’ accounts sit active in your IdP. Continuous monitoring is not a nice-to-have — it is the difference between a framework that improves security and one that just produces paper.
Conflating scope reduction with security. Narrowing your PCI cardholder data environment by offloading card processing to a third party is a legitimate strategy. But attackers are not constrained by your audit scope. Segmentation must be real, not just documented.
How OpenArmor Maps Controls Automatically
Building and maintaining control mapping by hand is one of the most tedious and error-prone parts of compliance work. OpenArmor’s control correlation engine ingests your existing security tooling — SIEM alerts, vulnerability scanner output, cloud configuration findings, endpoint telemetry — and maps observed evidence to specific ISO 27001 controls, SOC 2 Trust Services Criteria, and PCI-DSS requirements simultaneously.
When a control has a gap, OpenArmor surfaces it as a finding with the framework reference attached. When your auditor asks for evidence that you reviewed access permissions quarterly, the system has already been collecting that evidence continuously, not in a frantic pre-audit sprint.
The goal is to make compliance a continuous by-product of running good security operations — not a separate, parallel program that taxes your team twice. If you are pursuing multiple frameworks, the unified control mapping means you collect evidence once and satisfy requirements across all three. That is not compliance theater. That is how you use a framework the right way.