---
title: "SOC 2 vs ISO 27001 Deliverables Explained"
description: "Discover the essential deliverables of a SOC 2 and ISO 27001 engagement, including documentation, risk assessments, and audit preparation."
canonical: "https://axipro.co/soc-2-vs-iso-27001-deliverables/"
language: "en-US"
modified: "2026-07-23T08:23:36+00:00"
generator: "WordPress 7.1.4"
---

[Home](https://axipro.co)

/ [ISO-27001](https://axipro.co/category/iso-27001-2/), [SOC-2](https://axipro.co/category/soc-2-2/)

/ What Are the Deliverables for a SOC 2 and ISO 27001 Engagement?

# What Are the Deliverables for a SOC 2 and ISO 27001 Engagement?

![Picture of Pedro Dias](https://axipro.co/wp-content/uploads/2026/05/pedro-passport-picture-scaled.jpg)

- Pedro Dias
- July 23, 2026

Copy Link

After a SOC 2 and ISO 27001 engagement, there are two documents out of the whole pile that actually close deals: the [SOC 2 attestation report](https://axipro.co/soc-2/) and the [ISO 27001 certificate](https://axipro.co/iso-27001-certification/). Everything else your engagement produces exists to create those two, support them, or keep them alive for another year.

Companies routinely ask their auditor for a [SOC 2 certificate, which doesn’t exist](https://axipro.co/soc-2-report-vs-certification/). They send a prospect their full ISMS documentation when a one-page certificate would have done. They pay for six months of readiness work and then can’t say what they’re holding at the end of it.

So here’s the full list. What a SOC 2 engagement produces, what an ISO 27001 engagement produces, what a combined program produces, and who gets to see each one.

![SOC 2 and ISO 27001 Engagement](https://axipro.co/wp-content/uploads/2026/07/SOC-2-and-ISO-27001-Engagement-1024x535.png)

## Understanding SOC 2 and ISO 27001 Engagement Outputs

### The Core Difference: Report vs. Certificate

SOC 2 is an attestation. A licensed CPA firm examines your controls against the Trust Services Criteria under standards set by the [AICPA](https://www.aicpa-cima.com/), then writes up what it found and signs an opinion. No certificate. No logo from the AICPA. No pass or fail stamp. What you get is the report, and it usually runs 60 to 120 pages.

ISO 27001 is a certification. An accredited certification body audits your [Information Security Management System (ISMS)](https://en.wikipedia.org/wiki/ISO/IEC_27001) against [ISO/IEC 27001:2022](https://www.iso.org/standard/27001), and if you conform, it issues a certificate of registration. The certificate itself is a page or two. All the detail lives behind it, in your ISMS documentation and the audit reports the certification body writes as it goes.

![SOC 2 Engagement Deliverables](https://axipro.co/wp-content/uploads/2026/07/SOC-2-Engagement-Deliverables-683x1024.jpg)

## **SOC 2 Engagement Deliverables**

### The SOC 2 Attestation Report

The report is the engagement. The AICPA’s illustrative SOC 2 report lays out the standard structure: auditor’s report, management’s assertion, system description, the Trust Services Criteria in scope, and the controls tested with their results.

- A **Type I** covers control design at one point in time.
- A **Type II** covers whether those controls actually operated over a period, usually three to twelve months, and most enterprise buyers now won’t accept anything else.

### Independent Auditor’s Opinion Letter

First section of the report, and the first thing anyone experienced turns to. It gives the scope, the examination period, and the auditor’s conclusion.

- An **unqualified opinion** means the description held up and the controls worked.
- A **qualified opinion** means the auditor found something material, and every serious reviewer will want to talk about it.

### Management Assertion

Your leadership signs a written statement stating that the system description is accurate and that the controls were properly designed and are operating. It reads like a formality, and it isn’t. The auditor’s entire examination runs against what management asserts here, so overstating anything creates real exposure.

### System Description

Usually the longest part of the report, and you write it, not the auditor. It covers the services in scope, your infrastructure, software, people, processes, how data moves, which subservice organizations you depend on, and the complementary user entity controls your customers have to run on their side for your controls to hold up.

### Trust Services Criteria Applied

Security (the Common Criteria) is in every SOC 2. Availability, Processing Integrity, Confidentiality, and Privacy are optional, and the report names exactly which ones you picked. Whatever you decide during scoping ends up printed in a document your customers read for the next several years.

### Description of Tests of Controls and Results (Type II)

The matrix: every control, what the auditor did to test it, and what came back, including exceptions. Reviewers spend most of their time here, because **the exceptions tell them things the opinion letter won’t.**

### Bridge Letter / Gap Letter

Your report covers a fixed window, so one ending December 31 leaves a hole for a customer doing diligence in June. A **bridge letter** from your management, not the auditor, confirms that nothing material changed in the control environment between the report’s end date and today. You’ll write these often enough to keep a template.

### Management Letter and Observations

Plenty of auditors also send an internal-only letter covering observations, minor exceptions, and suggestions that never reached the threshold of a qualified opinion. It’s the closest thing to free consulting you’ll get before next year’s audit starts.

**Insider Note:** Ask early whether your auditor issues a management letter, and whether exceptions land in the report body or only in that letter. Firms handle this differently, and the answer decides what your customers see versus what stays behind your firewall. It rarely comes up in the proposal, but it changes how the finished report reads to a buyer.

![ISO 27001 Engagement Deliverables](https://axipro.co/wp-content/uploads/2026/07/ISO-27001-Engagement-Deliverables-683x1024.jpg)

## **ISO 27001 Engagement Deliverables**

### ISO 27001 Certificate of Registration

The document everyone asks for. It names the certified legal entity, states the ISMS scope, identifies the certification body, carries an accreditation mark from a body recognized under the [International Accreditation Forum](https://iaf.nu/) such as [UKAS](https://www.ukas.com/) or [ANAB](https://anab.ansi.org/), and shows the validity dates. It’s good for three years as long as you pass annual surveillance audits.

**Read the scope statement carefully**, on your own certificate as much as anyone else’s. A certificate covering one office or one product line says nothing about the rest of the business.

### Statement of Applicability (SoA)

After the certificate, this is the document buyers request most. The Statement of Applicability runs through all 93 Annex A controls in ISO/IEC 27001:2022, says which apply to you, justifies the ones you excluded, and records where each stands. Auditors use it as the map of your control environment, and larger customers increasingly want to see it or a summary of it during diligence.

### Risk Assessment and Risk Treatment Plan

Your methodology, the register it produced, and the Risk Treatment Plan showing what you decided to do about each significant risk: mitigate it with a control, transfer it, avoid it, or accept it. ISO 27001 is built around risk, so these documents are what justify every control decision recorded in the SoA.

### Information Security Management System (ISMS) Documentation

The policy and procedure set, plus the operational records that prove any of it happens. Information security policy, access control, incident management, supplier security, business continuity, and the rest. When a consultancy builds your ISMS, this pile is most of what they hand over at the end.

### Internal Audit Report

You have to audit yourself before the certification body does. The [internal audit report](https://axipro.co/services/internal-audit/), done in-house or outsourced, is a mandatory record and one of the first things an external auditor asks to see.

### Management Review Records

Minutes and outputs from leadership’s formal review of the ISMS: audit results, changes in risk, incidents, and what the business decided to do about them. Missing records, or records that were obviously written the week before the audit, are a reliable way to collect a nonconformity.

### Stage 1 Audit Report (Documentation Review)

Stage 1 is a readiness check. The auditor reads your scope, risk assessment, Statement of Applicability, and the evidence that you’ve run an internal audit and a management review, then decides whether you’re ready for Stage 2. The report comes back as a list of things to close first.

### Stage 2 Audit Report (Certification Audit)

Stage 2 tests whether any of it is true. The auditor samples evidence across your operation to confirm the controls you selected are running, then writes up the findings with a certification recommendation.

### Surveillance Audit Reports

In years one and two, the certification body samples part of the ISMS rather than reviewing the whole thing, checking that it still runs and still improves. Each visit produces a report, and each report becomes evidence at the next one.

### Nonconformity and Corrective Action Reports

Findings are graded.

- A **minor nonconformity** is an isolated slip.
- A **major nonconformity** points to something systemic and can hold up or suspend certification.

Each one generates a corrective action plan (CAP) with root cause analysis and proof you closed it, and the auditor will pull those up next visit.

**Important:** Certificates get suspended between audits. Skip a surveillance visit, leave a major nonconformity open, or let the ISMS go quiet for six months, and the certificate is at risk well before the three years are up. *You don’t earn it once. You keep earning it.*

Reach SOC 2 Compliance in 6 Weeks or Less

Schedule Your Free SOC 2 Assessment Today

[Schedule](https://axipro.co/free-assessment/)

## **Shared Deliverables in a Combined SOC 2 + ISO 27001 Engagement**

Somewhere around 70 to 80 percent of the underlying work is the same for both frameworks, which is why combined programs have become the default for companies selling into the US and internationally at once. Run properly, you end up with one set of artifacts instead of two stacks that slowly drift apart.

### Unified Policy and Procedure Set

One set of policies mapped to the Trust Services Criteria and Annex A at the same time. Keep two sets, and you’ll maintain both badly, and eventually they’ll contradict each other in front of an auditor.

### Consolidated Risk Register

A single register feeding the ISO 27001 risk treatment process and SOC 2’s risk assessment criteria under CC3. You maintain it once, and both auditors sample from it.

### Shared Evidence Repository

Access reviews, change tickets, training records, vendor assessments, all collected once and tagged to both frameworks, usually inside a [GRC platform like Vanta or Drata](https://axipro.co/drata-vs-thoropass-vs-vanta-which-compliance-tool-reigns-supreme/). Most of the cost savings people expect from a combined engagement actually come from here.

### Combined Control Matrix / Crosswalk

A [mapping document showing how each control you’ve implemented satisfies specific Trust Services Criteria and specific Annex A controls](https://axipro.co/soc-2-to-iso-27001-mapping/). Without the crosswalk, “collect once, comply twice” stays a slogan.

### Integrated Gap Assessment Report

One readiness assessment scored against both frameworks, producing one prioritized remediation list rather than two that compete for the same engineers.

### Pro Tip: Line up your SOC 2 Type II Observation

Line up your SOC 2 Type II observation window with the ISO surveillance schedule before either clock starts. Companies that stagger them by a few months end up in audit season permanently, fielding evidence requests every month of the year. One shared calendar takes a surprising amount of pressure off the team doing the collecting.

## **Pre-Engagement Deliverables (Readiness Phase)**

Readiness has its own outputs, and they usually come from a consultancy rather than the auditor or certification body, since independence rules cap how much hands-on help the certifying party can give you.

### Readiness Assessment Report

An evaluation of where you stand against every applicable requirement, with gaps rated by severity and by how much work they’ll take. This is the [Readiness Assessment Report](https://axipro.co/services/gap-analysis/) that turns “we should probably get SOC 2” into a plan with a number attached.

### Scoping Document

Names the systems, locations, entities, people, and for SOC 2 the Trust Services Categories in scope. What you decide here flows straight into the system description and the scope line on your certificate, so it deserves an hour of executive attention rather than a signature.

### Remediation Roadmap

The sequenced plan for closing each gap, with owners and dates, normally built backward from the date your Type II window opens or your Stage 1 audit begins.

### Control Design Documentation

Written descriptions of each control: what it does, who runs it, how often, and what evidence it leaves behind. Auditors test against these descriptions, so vague control language produces exceptions you didn’t need to have.

## **Post-Engagement Deliverables**

### Final Report Distribution Package

For SOC 2, the signed report plus guidance on who can receive it, since SOC 2 reports are restricted-use documents that go out under NDA. For ISO 27001, the certificate, the certification body’s rules for using its mark, and the final audit report.

### Customer-Facing Trust Documentation

Most companies build a trust page or a security packet: the ISO certificate, a SOC 3 summary if they have one, [penetration test summaries](https://axipro.co/services/penetration-testing/), and pre-written answers to the questions everyone asks. Your engagement deliverables feed it. The packet is what sales actually sends.

### Renewal and Continuous Monitoring Schedule

A [Renewal and Continuous Monitoring Schedule](https://axipro.co/continuous-monitoring-for-soc-2-compliance/) covering the next SOC 2 observation period, surveillance dates, internal audits, management reviews, access reviews, and policy refreshes. Skip it and year two turns into the same scramble as year one, which is the thing everyone swore wouldn’t happen again.

### Corrective Action Tracking

A live register of exceptions, nonconformities, and observations from every audit, with status and closure evidence. Your next SOC 2 auditor and your surveillance auditor will both open with the same question: *what happened to last year’s findings?*

## **Who Receives Each Deliverable?**

### Internal Stakeholders

Leadership signs the management assertion and receives the management letter, the audit reports, and any nonconformities. Security and engineering own the ISMS documentation, the control matrix, and the corrective action register. Boards now tend to expect a summary of both audit outcomes as part of cyber risk oversight.

### Customers and Prospects

Customers get the SOC 2 report under NDA, the certificate freely, and a bridge letter when they ask. Bigger ones may push for the SoA, penetration test summaries, or specific policy excerpts. Almost none of them have a legitimate claim on your full ISMS documentation, and handing it over sets a precedent you’ll regret.

### Regulators and Third Parties

Regulators, cyber insurers, and partners generally take the certificate and the SOC 2 report as primary evidence. Insurers have started pricing against them, and a current Type II plus a valid certificate visibly shortens the underwriting questionnaire.

## **Timeline of Deliverables Across the Engagement Lifecycle**

### Kickoff Phase Outputs

Scoping document, engagement letters, readiness assessment, and remediation roadmap. On the ISO side, your initial risk assessment and a draft SoA land here too.

### Fieldwork Phase Outputs

Evidence requests and responses, control design documentation, interim findings, the Stage 1 report, and for a Type II, the evidence accumulating through the observation window itself.

### Reporting Phase Outputs

Draft and final SOC 2 report, the management assertion, the Stage 2 report, the certification decision, and the certificate. This phase compresses badly when fieldwork evidence was messy, which is the most common reason timelines slip.

### Ongoing Maintenance Outputs

Bridge letters, surveillance reports, annual internal audit reports, management review records, updated risk assessments and SoA versions, and next year’s Type II. The stream doesn’t stop after certification. It settles into a rhythm.

Worth Knowing: SOC 2 reports carry no formal expiration date, but the market treats one as stale about 12 months past the period end. That makes a Type II less a project than a subscription, and what buyers really want is an unbroken chain of reports with no uncovered months in between.

### Worth Knowing: SOC 2 Reports

SOC 2 reports carry no formal expiration date, but the market treats one as stale about 12 months past the period end. That makes a Type II less a project than a subscription, and what buyers really want is an unbroken chain of reports with no uncovered months in between.

Let Axipro help you build a business continuity plan that's practical, compliant, and audit-ready.

Schedule Your Free Assessment Today

[Schedule a consultation](https://axipro.co/free-assessment/)

## **In Summary**

**SOC 2** gets you a long, restricted-use report built from an opinion letter, a management assertion, a system description, and control test results, refreshed every year and bridged in between.

**ISO 27001** gets you a public three-year certificate backed by the SoA, the risk treatment plan, your ISMS documentation, and the Stage 1, Stage 2, and surveillance reports behind it. Running both together adds shared artifacts, one policy set, one risk register, and one evidence repository, which is what makes doing both cheaper than doing either one twice.

Know what each document is for, who’s allowed to read it, and when the next one is due, and the whole engagement starts paying for itself in vendor reviews.

## **Frequently Asked Questions**

Is the SOC 2 report the same as an ISO 27001 certificate?

No. The SOC 2 report is a detailed attestation from a CPA firm, shared under NDA. The ISO 27001 certificate is a short public document from an accredited certification body. Related questions, completely different artifacts.

Can one engagement produce both deliverables at once?

Yes, and plenty of companies now do exactly that. The CPA firm still issues the report and the certification body still issues the certificate, but one evidence collection effort, one policy set, and one audit calendar sit behind both.

How long are SOC 2 reports and ISO 27001 certificates valid?

A SOC 2 report covers its stated period and is generally accepted as current for around 12 months after that period ends. An ISO 27001 certificate lasts three years, assuming you pass the annual surveillance audits and keep the ISMS running.

Who owns the deliverables after the engagement ends?

You own the ISMS documentation, the policies, the risk register, the SoA, and the system description. The auditor keeps their workpapers. The report and certificate are issued to you, but the report carries distribution restrictions and the certificate comes with rules about how you can use the certification body’s mark.

Are the Statement of Applicability and SOC 2 System Description interchangeable?

No. The SoA is a control-by-control inventory against Annex A with justifications for anything excluded. The system description is a narrative about your services, infrastructure, and processes written for someone reading the report. Same subject matter, different structure and different audience.

What deliverables can be shared publicly vs. under NDA?

Public: the certificate, a SOC 3 report if you commission one, and whatever summary you put on your trust page. Under NDA: the SOC 2 report, the SoA in most cases, bridge letters, and audit findings. Not shared at all: internal audit workpapers, the raw risk register, and detailed corrective action records.

Do surveillance audits produce new deliverables each year?

Yes. Each one produces a report, plus any nonconformities raised and the corrective action records that close them. Updated SoA versions, internal audit reports, and management review minutes pile up alongside, and the recertification audit in year three goes back through the whole trail.

Axipro Author

![Picture of Pedro Dias](https://axipro.co/wp-content/uploads/2026/05/pedro-passport-picture-scaled.jpg)

### Pedro Dias

Pedro has been writing online for over 10 years. With experience in all things programming, cyber security, and compliance, he is our editor-in-chief at Axipro.

- July 23, 2026
- [ISO-27001](https://axipro.co/category/iso-27001-2/), [SOC-2](https://axipro.co/category/soc-2-2/)

Copy Link

## Blog Highlights

## Explore More Articles

[Read More Blogs](https://axipro.co/blog/)

- [EU AI Act](https://axipro.co/category/eu-ai-act/)

- November 14, 2026

#### [Is Your AI Tool High-Risk Under the EU AI Act? An Annex III Guide Before December 2027](https://axipro.co/eu-ai-act-high-risk-annex-iii/)

An AI system is high-risk under the EU AI Act when its intended purpose falls into one of the eight areas listed in Annex III, such as hiring, credit scoring, education or biometrics. The Article 6(3) filter can take some of these systems back out, but never a system that profiles people. The obligations for Annex III systems apply from 2 December 2027, after the AI Omnibus (Regulation (EU) 2026/1744) pushed the date from the original 2 August 2026. This guide covers how the classification test works, what the eight areas include in SaaS terms, who carries which obligations, what the Omnibus changed, and a 12-month plan to be ready before the deadline. Annex III high-risk in brief: eight areas, one narrow exit, one deadline An AI system is high-risk under Annex III if it is intended for one of eight listed uses, and it stays high-risk unless the provider documents that it meets an Article 6(3) exemption and does not profile people. Providers and deployers of these systems must comply from 2 December 2027, and breaching the high-risk requirements can cost up to €15 million or 3% of worldwide annual turnover, whichever is higher. Figure 1. The EU AI

[Read more](https://axipro.co/eu-ai-act-high-risk-annex-iii/)

- [SOC-2](https://axipro.co/category/soc-2-2/)

- November 11, 2026

#### [Best SOC 2 Compliance Companies and Consultants in 2026](https://axipro.co/best-soc-2-compliance-companies/)

Picking a SOC 2 company starts with knowing which job you’re hiring for. A readiness consultant builds and runs your controls, a licensed CPA firm examines them and signs the report, and a compliance platform collects the evidence in between. This guide ranks the strongest firms in each group for 2026, with Axipro first for readiness and Insight Assurance, Prescient Assurance, A-LIGN and Sensiba leading the audit firms. It also covers what each type of provider charges, who is legally allowed to issue a SOC 2 report, and the warning signs that got much harder to ignore after this year’s rubber-stamp audit allegations. The Short Answer: Best SOC 2 Companies by Role in 2026 Axipro is the top pick for SOC 2 readiness, with fixed fees from $4,000 and most clients audit-ready in six weeks, while Insight Assurance, Prescient Assurance, A-LIGN and Sensiba lead the licensed CPA firms for the audit itself. A Type 2 audit from a boutique or specialist CPA firm typically costs $15,000 to $50,000 in 2026, against Big Four fees that usually start around $60,000. Only a licensed CPA firm can sign the report, so every consultant and platform here still hands the final examination to

[Read more](https://axipro.co/best-soc-2-compliance-companies/)

- [PENTEST](https://axipro.co/category/pentest/)

- November 10, 2026

#### [Web App Penetration Testing: Scope, Costs & Requirements](https://axipro.co/web-application-penetration-testing-scope-cost/)

A web application penetration test is a manual, time-boxed attack on your application by a human tester, and its price is set almost entirely by scope: how many user roles, API endpoints and integrations the tester has to cover. Most manual web app tests in the US are quoted between $5,000 and $30,000. This guide sets out what a standard engagement covers, which scope items push the quote up, and what you need to hand testers before day one so you don’t pay for days lost to broken logins. What a Web App Pentest Covers, Costs, and Needs From You A manual web application penetration test usually costs $5,000 to $30,000 and takes 1 to 3 weeks, with complex multi-tenant SaaS platforms running past $50,000. The quote rises with each extra user role, API surface, tenant, and integration, and with add-ons such as source code review, out-of-hours testing, and attestation letters. Working test accounts for every role, API documentation, a stable staging environment, and allow-listed tester IPs are what keep the engagement on schedule. What a Web Application Penetration Test Covers A web application penetration test is a manual assessment in which a qualified tester attacks your application the way

[Read more](https://axipro.co/web-application-penetration-testing-scope-cost/)

WhatsApp us