ISO 27001, SOC 2 and small businesses: what you need and what you can skip

The short answer

ISO 27001 and SOC 2 are the two assurance frameworks small technology-adjacent businesses get asked about. ISO 27001 is an international standard for an information security management system: you define scope, assess risks, select and implement controls, operate the system, audit it internally, review it at management level, and an accredited body certifies it after an audit, with surveillance audits over a three-year cycle. SOC 2 is different in kind: an attestation report written by an accountant, assessing your controls against trust services criteria, either at a point in time or over a period, and it is most often requested by North American customers. Neither is required by law. Both are commercial requirements imposed by customers, and that is the only sound reason to pursue either. The cost is dominated not by audit fees but by the work of building and then operating the system, which is substantial for a team under twenty people. Until a customer actually requires certification, a documented security summary with real controls and evidence answers most questionnaires at a fraction of the cost.

Comparing the options

	ISO 27001	SOC 2	Documented security summary
What it is	Certification of a management system	Auditor’s report on controls	Your own evidence pack
Who asks for it	European and international enterprise, public tenders	Often North American customers	Most small and mid-sized customers
Cycle	Certification plus surveillance over three years	Usually annual	Updated quarterly
Main cost	Building and operating the system	Preparing and evidencing controls	Time to write and keep current
Time to achieve	Typically six to twelve months for a small business	Similar preparation; type two requires an observation period	Days
Ongoing burden	Significant and permanent	Significant and annual	Light
What it proves	You run a system that manages security risk	Your controls operated as described	You have thought about it and can evidence it

Deciding

What to do instead, for now

Write the security summary that describes how you host, control access, manage secrets, update, back up, monitor, respond to incidents, handle personal data and test. Collect the evidence for each. Commission a penetration test if the data or the customers justify it, and keep the report and the retest. Put the basic controls genuinely in place: second factors everywhere, least privilege, patching, tested backups, logging, an incident plan. That package answers most questionnaires, costs a fraction of certification, and is exactly the groundwork certification would require anyway.

What this means for you

ISO 27001 and SOC 2 are commercial requirements rather than legal ones, and the cost is dominated by building and operating the system rather than by the audit. Pursue one when a customer genuinely requires it, scope it narrowly, cost the ongoing cycle honestly and assign a real owner. Until then, build the controls, write the security summary, keep the evidence and answer questionnaires well, which is both cheaper and the foundation you would need anyway. This is general information rather than legal or compliance advice.