Use ISO/IEC 27017 to design and allocate cloud controls. Use a relevant to assess independent assurance over provider controls in its stated scope.
Neither substitutes for the other. Check the type, system, criteria, period, opinion, exceptions, subservice organizations, and customer controls before relying on it.
ISO/IEC 27017:2015 tells cloud providers and customers how to adapt information security controls to cloud services. A is a certified public accountant (CPA) attestation report about controls at a service organization relevant to security, availability, processing integrity, confidentiality, or privacy for a defined system and scope. Use ISO/IEC 27017 to build the responsibility and control model; use the SOC 2 report as evidence only for the provider controls and period it actually covers. ISO lists the 2015 edition used here as withdrawn and ISO/IEC 27017:2026 as its replacement; confirm the required edition before applying this comparison.
Side-by-side comparison
ISO/IEC 27017 vs SOC 2: scope, duties, evidence, and decision rule
Compare control guidance with attestation evidence and see what a customer must verify before relying on a provider's report.
Primary ISO listing for cloud-service security control guidance.
Code of practice for information security controls based on ISO/IEC 27002 for cloud services
SOC 2 covers the system described by service-organization management and the controls relevant to the Trust Services Criteria categories selected for the engagement.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
Use ISO/IEC 27017 to define the cloud control outcome. Use the only for provider controls inside its stated boundary.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
Primary ISO listing for cloud-service security control guidance.
Code of practice for information security controls based on ISO/IEC 27002 for cloud services
Service-organization management describes the system and controls, and an independent licensed CPA firm performs the attestation engagement. User entities remain responsible for their own controls.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
Map provider controls and complementary user-entity controls to separate owners and evidence.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
Primary ISO listing for cloud-service security control guidance.
Code of practice for information security controls based on ISO/IEC 27002 for cloud services
A SOC 2 engagement is commissioned by a service organization when customers and other specified users need assurance about controls relevant to the selected criteria.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
A customer can request and review a report but does not expand its scope. Contract separately for missing assurance or evidence.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
Primary ISO listing for cloud-service security control guidance.
Code of practice for information security controls based on ISO/IEC 27002 for cloud services
SOC 2 reports management's system description, assertion, applicable criteria and controls, the practitioner's opinion, and, for Type 2, tests of controls and results over a period.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
Do not turn report criteria into a replacement control framework. Map the exact report evidence to the ISO/IEC 27017 outcome it supports.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
Primary ISO listing for cloud-service security control guidance.
Code of practice for information security controls based on ISO/IEC 27002 for cloud services
The report provides scoped attestation evidence: opinion, system description, criteria, controls, tests and results for Type 2, exceptions, subservice treatment, and user-entity controls.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
Record the report section and control reference for each claim. A generic statement that the provider 'has SOC 2' is not enough.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
Primary ISO listing for cloud-service security control guidance.
Code of practice for information security controls based on ISO/IEC 27002 for cloud services
A Type 1 report addresses a specified date; a Type 2 report addresses a stated period. Later activity needs a new report or separately evaluated bridge evidence.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
Track the examination date or period and the date of your reliance decision. Do not invent a universal SOC 2 expiration date.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
ISO/IEC 27017 can support an ISO/IEC 27001 control environment and related audits or customer assurance, but it is not a standalone certificate or attestation.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
State the exact certificate, report type, opinion, contract, or legal requirement. None should be used as shorthand for the others.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
Reuse the report at claim level and retain separate evidence for customer controls, uncovered periods, excluded services, and exceptions.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
Use both for provider assurance, then close customer controls and coverage gaps with separate evidence.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
Scope and covered activity
ISO/IEC 27017
ISO/IEC 27017 gives cloud-specific security control guidance for cloud service providers and cloud service customers.
Primary ISO listing for cloud-service security control guidance.
Code of practice for information security controls based on ISO/IEC 27002 for cloud services
SOC 2
SOC 2 covers the system described by service-organization management and the controls relevant to the Trust Services Criteria categories selected for the engagement.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
Operational implication
Use ISO/IEC 27017 to define the cloud control outcome. Use the only for provider controls inside its stated boundary.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
Who must act
ISO/IEC 27017
The cloud service provider and customer agree their security roles; both may have actions under one shared control.
Primary ISO listing for cloud-service security control guidance.
Code of practice for information security controls based on ISO/IEC 27002 for cloud services
SOC 2
Service-organization management describes the system and controls, and an independent licensed CPA firm performs the attestation engagement. User entities remain responsible for their own controls.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
Operational implication
Map provider controls and complementary user-entity controls to separate owners and evidence.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
Trigger or threshold
ISO/IEC 27017
ISO/IEC 27017 is adopted when an organization wants cloud-specific security guidance, often within an ISO/IEC 27001 and 27002 control environment.
Primary ISO listing for cloud-service security control guidance.
Code of practice for information security controls based on ISO/IEC 27002 for cloud services
SOC 2
A SOC 2 engagement is commissioned by a service organization when customers and other specified users need assurance about controls relevant to the selected criteria.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
Operational implication
A customer can request and review a report but does not expand its scope. Contract separately for missing assurance or evidence.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
Core obligations
ISO/IEC 27017
ISO/IEC 27017 guides the selection and implementation of cloud controls and divides provider and customer responsibilities.
Primary ISO listing for cloud-service security control guidance.
Code of practice for information security controls based on ISO/IEC 27002 for cloud services
SOC 2
SOC 2 reports management's system description, assertion, applicable criteria and controls, the practitioner's opinion, and, for Type 2, tests of controls and results over a period.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
Operational implication
Do not turn report criteria into a replacement control framework. Map the exact report evidence to the ISO/IEC 27017 outcome it supports.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
Evidence and records
ISO/IEC 27017
Evidence comes from provider and customer agreements, configurations, logs, reviews, tests, incidents, risk decisions, and assurance material.
Primary ISO listing for cloud-service security control guidance.
Code of practice for information security controls based on ISO/IEC 27002 for cloud services
SOC 2
The report provides scoped attestation evidence: opinion, system description, criteria, controls, tests and results for Type 2, exceptions, subservice treatment, and user-entity controls.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
Operational implication
Record the report section and control reference for each claim. A generic statement that the provider 'has SOC 2' is not enough.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
Timing and cadence
ISO/IEC 27017
ISO/IEC 27017 review timing follows risk, service change, supplier, incident, audit, and management-review cycles.
Primary ISO listing for cloud-service security control guidance.
Code of practice for information security controls based on ISO/IEC 27002 for cloud services
SOC 2
A Type 1 report addresses a specified date; a Type 2 report addresses a stated period. Later activity needs a new report or separately evaluated bridge evidence.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
Operational implication
Track the examination date or period and the date of your reliance decision. Do not invent a universal SOC 2 expiration date.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
Assurance and legal effect
ISO/IEC 27017
ISO/IEC 27017 can support an ISO/IEC 27001 control environment and related audits or customer assurance, but it is not a standalone certificate or attestation.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
Operational implication
State the exact certificate, report type, opinion, contract, or legal requirement. None should be used as shorthand for the others.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
Overlap and reuse
ISO/IEC 27017
ISO/IEC 27017 identifies provider-side outcomes for which a may supply independent assurance evidence.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
Operational implication
Reuse the report at claim level and retain separate evidence for customer controls, uncovered periods, excluded services, and exceptions.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
Practical decision rule
ISO/IEC 27017
Use ISO/IEC 27017 to define and operate the cloud security control and responsibility model.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
Operational implication
Use both for provider assurance, then close customer controls and coverage gaps with separate evidence.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
Practical decision rule
What is the practical decision rule?
Use ISO/IEC 27017 to decide what the provider and customer should do for cloud security.
Use the to test whether independent assurance supports a specific provider-operated control in the relevant system and period.
Treat customer controls, report exceptions, excluded subservice organizations, unselected criteria, and uncovered periods as separate work.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
1
Section 1
Do you need ISO/IEC 27017, a SOC 2 report, or both?
Use ISO/IEC 27017 to select, design, and allocate cloud security controls. Request a when you need a CPA's conclusion on a service organization's description and controls against selected Trust Services Criteria.
A Type 1 report addresses control design at a specified date. A Type 2 report also covers operating effectiveness over a stated period. Neither report proves activity before or after its date or period, and neither proves customer-operated controls.
Use both when provider evidence must support an ISO/IEC 27017 responsibility map. Link each provider-side claim to the exact SOC 2 system description, criterion, control, test, result, exception, and any complementary user-entity control. For example, a Type 2 test of the provider's infrastructure logging can support that provider action during the report period, but it does not show that an infrastructure as a service (IaaS) customer enabled or reviewed logs inside its virtual machines.
Confirm that the legal entity, service, locations, infrastructure, and report period match the service you use.
Check which Trust Services Criteria categories are included; security is central, while the other categories depend on the engagement scope.
Record complementary user-entity controls and carve-out or inclusive treatment of subservice organizations before accepting coverage.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
AICPA overview used for the distinction between SOC report purposes and the Type 1 specified-date and Type 2 period-of-time examination formats.
2
Section 2
How should a customer review a SOC 2 report?
Read the full report, not the provider's badge or summary. Confirm the report type and period, practitioner's opinion, management assertion, system description, included criteria, control tests, deviations, subservice organizations, significant changes, and complementary user-entity controls.
Then compare the report with the ISO/IEC 27017 responsibility matrix. A provider control is useful only if it supports the same service, control outcome, time period, and provider action. The customer must implement and evidence every stated customer control. Complementary user-entity controls are safeguards the report expects the customer to implement so the provider can meet its stated commitments. A carved-out subservice organization is an upstream supplier whose controls are excluded from the examination; assess the provider's monitoring and obtain separate evidence when that is insufficient.
Scope: provider entity, system or service, locations, boundaries, period or date, and selected Trust Services Criteria.
Conclusion: opinion, qualifications, control deviations, management responses, and whether the exception affects your use case.
Dependencies: subservice organizations, carve-out or inclusive method, and complementary user-entity controls.
Coverage decision: mapped ISO/IEC 27017 claim, uncovered period, bridge evidence, contract commitment, remediation, owner, and next review.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
How should SOC 2 evidence be mapped to ISO/IEC 27017?
Start with the provider actions in the cloud responsibility matrix. For each action, locate the relevant SOC 2 system-description boundary and control, then read the practitioner's test and result. Mark full, partial, or no support.
Record what the report cannot show: customer configurations, controls outside the examination period, excluded subservice organizations, unselected criteria, and provider commitments that exist only in the contract or service documentation.
Define the ISO/IEC 27017 control outcome and provider/customer split.
Confirm scope, criteria, type, period, opinion, and subservice treatment.
Map the exact provider control and test result; list every exception and coverage gap.
Verify complementary user-entity controls through customer evidence and resolve residual gaps.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
4
Section 4
What SOC 2 reliance mistakes should teams avoid?
A clean opinion is not blanket assurance over every provider service or security requirement. Coverage is limited by the report's described system, criteria, date or period, control design, tests, subservice treatment, and user-entity assumptions.
SOC 2 is an attestation engagement, not an ISO certification and not legislation. ISO/IEC 27017 is guidance, not a practitioner report. Keep legal, contractual, certification, and attestation claims separate.
Do not accept a SOC 2 logo, sales summary, or expiry date in place of the full report.
Do not treat a Type 1 report as evidence that controls operated over a period.
Do not ignore complementary user-entity controls or controls assigned to carved-out subservice organizations.
Do not bridge a report-period gap with an unsupported provider statement; identify the evidence and its limits.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
Primary ISO listing for cloud-service security control guidance.
Code of practice for information security controls based on ISO/IEC 27002 for cloud services
5
Section 5
When should SOC 2 coverage be reassessed?
Review the report before onboarding and on receipt of each new report. Reassess after significant service, architecture, location, provider-chain, contract, criteria, opinion, or responsibility changes and after an incident or control exception affects the service.
If the report ends before the next one begins, document the uncovered period and evaluate appropriate bridge evidence. A bridge letter is management information, not a new CPA examination, so assess it with the change history, incident information, and risk of the gap.
Track the report period and expected next report without calling it a universal expiration date.
Revalidate the exact provider controls used in the ISO/IEC 27017 map.
Close exceptions through provider remediation, customer controls, contract changes, alternate evidence, or an authorized risk decision.
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
System and Organization Controls (SOC) is a suite of service offerings
Official AICPA overview of CPA SOC assurance services and SOC 2 examinations of service-organization controls relevant to security, availability, processing integrity, confidentiality, or privacy.
"System and Organization Controls (SOC) is a suite of service offerings"