ISO 27001 or SOC 2? Which one fits your Dutch SMB?

ISO 27001 is Europe-oriented, SOC 2 is American. Which one do your clients actually need — and can you combine them? Here's the practical difference for an SMB.

The short version: do you have EU clients? Go ISO 27001. Do you have US clients? Go SOC 2. Do you have both? Consider ISO 27001 + SOC 2 Type II — they overlap by 70–80%.

Differences in philosophy

• ISO 27001: a certificate, valid for three years, with an annual surveillance audit. Demonstrates that your ISMS is working.
• SOC 2: a report, issued annually or bi-annually. Demonstrates that your controls worked over a specific period.

Trust Service Criteria (SOC 2)

SOC 2 has 5 criteria: Security (always required), Availability, Confidentiality, Processing Integrity, and Privacy. You choose which ones to have assessed. For most SMBs: Security + Confidentiality.

What do clients ask for?

• US tech clients: almost always ask for SOC 2 Type II.
• EU enterprise: ISO 27001 is the standard request.
• EU government: ISO 27001 + sometimes BIO.
• Financial services: both + specific sector requirements.

Combining them

Many SMBs growing internationally start with ISO 27001 (easier to "build on" with a single certificate) and then add SOC 2 on top of the existing control set. Overlap > 70%, so the duplicate effort is minimal.

See also: ISO 27001 pillar, certification costs.