How do I reuse SOC 2 evidence for ISO 27001?
March 6, 20262 min readBeyond SOC 2
What Reuses Directly
| SOC 2 Evidence | ISO 27001 Control | Reuse? |
|---|---|---|
| MFA enforcement screenshots | A.9.4 (Access control) | Direct reuse |
| User access reviews | A.9.2 (User access management) | Direct reuse |
| GitHub branch protection | A.14.2 (Development security) | Direct reuse |
| PR review evidence | A.14.2 (Change management) | Direct reuse |
| Encryption settings | A.10.1 (Cryptographic controls) | Direct reuse |
| Incident response plan | A.16.1 (Incident management) | Direct reuse |
| Risk assessment | Clause 6.1 (Risk assessment) | Partial — may need ISO format |
| Vendor management records | A.15.1 (Supplier relations) | Direct reuse |
| Security training records | A.7.2 (Awareness) | Direct reuse |
| System monitoring evidence | A.12.4 (Logging/monitoring) | Direct reuse |
What You Need to Add for ISO 27001
| ISO 27001 Requirement | What to Create | SOC 2 Equivalent |
|---|---|---|
| Information Security Management System (ISMS) | Formal ISMS document describing scope, policies, processes | No direct equivalent — new document needed |
| Statement of Applicability (SoA) | Document listing all 114 Annex A controls with justification for including/excluding each | No direct equivalent — new document needed |
| Management review | Minutes from management review meeting covering ISMS performance | SOC 2 has no formal management review requirement |
| Continual improvement | Evidence of improvements made based on incidents, reviews, or audits | No formal requirement in SOC 2 |
| Internal audit | Results of your internal ISO 27001 audit | SOC 2 doesn't require internal audit |
The Dual-Compliance Approach
- Start with SOC 2. Get your controls, policies, and evidence library established.
- Map SOC 2 controls to ISO 27001 Annex A. Use a mapping spreadsheet to identify which controls are already covered.
- Write additional ISO documents. Focus on ISMS, SoA, and management review — the uniquely ISO requirements.
- Reuse all compatible evidence. Point your ISO assessor to the same evidence library your SOC 2 auditor uses.
- Engage an ISO certification body. The assessment builds on your existing control foundation.
Timeline
If you already have SOC 2: 2-4 months to add ISO 27001. Most of the work is documentation (ISMS, SoA), not new controls.