Compliance & Cybersecurity Glossary

Both demonstrate strong information security, but they differ in form and audience. ISO 27001 is an international certification of a management system (an ISMS), awarded by an accredited certification body and recognised worldwide. SOC 2 is an attestation report written by a CPA against the Trust Services Criteria, and it is the format most commonly requested by enterprise customers in North America. Many organisations pursue both, because an ISO 27001 ISMS supplies much of the control foundation a SOC 2 examines.

A certification (such as ISO 27001) is a pass/fail determination by an accredited body that your system conforms to a published standard, resulting in a certificate. An attestation (such as SOC 2) is an independent CPA's opinion on a defined subject matter — typically your controls and how they operated — resulting in a detailed report rather than a certificate. In short, certification says "you meet the standard," while attestation says "here is my examined opinion on your controls."

A Type I report assesses whether controls are suitably designed and in place at a single point in time, while a Type II report assesses whether those controls also operated effectively across an observation window — usually three to twelve months. Type I is quicker to obtain and is often a stepping stone, but Type II provides stronger assurance and is what most enterprise customers ultimately require.

A vulnerability assessment uses automated scanning to identify and catalogue known weaknesses broadly across your systems. Penetration testing goes further: a tester manually attempts to exploit selected weaknesses to prove real-world impact and uncover issues — such as business-logic flaws — that scanners miss. VAPT combines both for breadth and depth.