SOC 2 vs ISO 27001 for Digital Asset Firms

By Owen Thurm Published November 6, 2026 5 min read

Quick answer. Start with what your buyers ask for. Drata's 2026 guide points North American sales to SOC 2 and international sales to ISO 27001; EU DORA rules list audit reports and certifications alike. Neither tests contract code.

Watch: SOC 2 vs ISO 27001 for Digital Asset Firms 1:45

Video transcript

Banks and funds will ask how you prove your security. SOC 2 and ISO 27001 are both accepted answers, but they are not the same thing.

SOC 2 is a CPA firm's report on your controls. ISO 27001 is a certificate for your security management system, running three years with surveillance audits.

US banking guidance lets banks consider SOC reports or independent certifications, and ranks neither higher. DORA's due diligence rules list audit reports and certifications alike. Neither names SOC 2 or ISO 27001.

Both have hooks for crypto risk, from keys and signers to upgrades and monitoring. Neither was written for it.

Each one tests only what is in scope, and neither reads contract code, which still needs a smart contract audit.

Drata, which sells compliance software, estimates that most startups spend twenty five to fifty thousand dollars on SOC 2 in their first year.

So which comes first? Selling to US banks means SOC 2 Type 2. Outside North America, start with ISO 27001. Too early for either? Map your controls to the free NIST CSF 2.0. Holding client keys means adding key evidence. Already have one? Add the other when a questionnaire names it.

Guardian does not issue either. It prepares you for both, with an Annex A maturity assessment, mapped technical evidence, and an assurance pilot built on your key ceremony.

Read the full guide, or talk to Guardian about getting audit-ready for both at guardian.security.

A bank or fund that onboards you will ask how you prove your security. Two answers it can accept are a SOC 2 report and an ISO 27001 certificate.

They are not the same thing. One is a CPA's report on your controls; the other certifies an information security management system (ISMS).

This guide compares the two for crypto firms. For NIST CSF 2.0, CCSS and the crypto-native standards, see our security standards comparison.

Where this article discusses regulation, it covers the technical and security side only. It is not legal advice; confirm how the rules apply to you with counsel.

The Differences in One Table

	SOC 2	ISO/IEC 27001:2022
What it is	An attestation report	A certificate
Who issues it	A licensed CPA firm	A certification body
Criteria	AICPA Trust Services Criteria	ISMS clauses and 93 Annex A controls
What is tested	Controls in your system description	Your ISMS and Annex A controls
Report types	Type 1: design, one date. Type 2: operation over a period	One certificate, after a two-stage audit
Period or cycle	Type 2: typically 3 to 12 months	Three years, with surveillance audits
Renewal	A new report, typically yearly	Recertification after year three

What Buyers Ask For

We found no official data on which buyers ask for which. What exists is guidance on what buyers may accept, and vendor experience.

United States

The Federal Reserve, FDIC and OCC's 2023 third-party guidance says a bank "may consider reviewing" SOC reports. The same sentence adds certification "by independent third parties" against domestic or international standards.

Its footnote names ISO among the standard setters. The guidance ranks neither above the other.

Drata's March 2026 comparison calls SOC 2 critical for providers "serving customers in North America" and "frequently required in vendor security questionnaires."

Europe

DORA has applied since January 17, 2025. Its scope includes crypto-asset service providers authorized under MiCA.

Article 28(5) lets financial entities contract only with ICT providers that "comply with appropriate information security standards."

For ICT services that support critical or important functions, Delegated Regulation (EU) 2024/1773 Art. 6(3) has the firm's policy choose its due diligence evidence from a list. It includes:

The firm's own audits or independent assessments.
"Independent audit reports" from the provider, such as a SOC 2.
"Appropriate third-party certifications", such as ISO 27001.

Neither text names SOC 2 or ISO 27001. Either can serve as evidence; neither is required by name.

International buyers

Drata calls ISO 27001 "especially valuable for international companies." Its advice: start with the framework your customers demand most.

Crypto Controls Each Covers

Both have hooks for crypto risk. Neither was written for it.

Area	SOC 2 criterion	ISO 27001 Annex A	Evidence to add
Keys	CC6.1, "Protects Encryption Keys"	8.24 Use of cryptography	Ceremony records, a dated recovery test
Signers and admins	CC6.1, CC6.2 access	8.2 Privileged access rights	Signer and role map read from the chain
Contract upgrades	CC8.1 change management	8.32 Change management	Deployed bytecode matched to the audited commit
Contract code	CC8.1 covers the process	8.28 Secure coding	A smart contract audit
Monitoring	CC7.2 anomaly monitoring	8.16 Monitoring activities	Onchain alerts on roles, upgrades and flows
Custodians and RPCs	CC9.2 vendors and partners	5.19 Supplier relationships	The vendor's own report and key diligence

The AICPA lists "Protects Encryption Keys" as a point of focus: keys protected during generation, storage, use and destruction.

Two gaps are shared. Each tests only what is in scope, and neither reads contract code.

So check the boundary first. A signing service outside the system description or the ISMS scope is outside the report or certificate. For what SOC 2 misses, see SOC 2 for crypto companies.

Cost and Renewal

Both are priced mainly by scope. These are Drata's 2026 estimates; Drata sells compliance software.

	SOC 2	ISO 27001
Audit fee	$7,500 to $100,000+	$10,000 to $100,000+ for the external audit
Main cost driver	Scope and complexity	Auditor time, set by size and scope
After year one	A new attestation, typically yearly	Surveillance audits, then recertification

For SOC 2, Drata says most startups spend $25,000 to $50,000 in the first year. A Type 2 costs 30% to 50% more than a Type 1.

For ISO 27001, more employees, locations and systems mean more auditor days. Major nonconformities can add follow-up audits.

Crypto scope adds signing services, wallet vendors and onchain operations. Our SOC 2 cost guide breaks those down.

Doing Both Efficiently

Some crypto firms hold both. Kraken's and Fireblocks' public trust centers each list a SOC 2 Type 2 and ISO/IEC 27001:2022.

To avoid doing the work twice:

Build one control set and map it to both frameworks.
Check your crosswalk's edition. The AICPA's own ISO 27001 mapping is dated May 2018, before the 2022 edition.
Use NIST's CSF 2.0 export as a bridge: it maps CSF outcomes to ISO/IEC 27001:2022 clauses and Annex A controls.
Run one risk assessment, one pentest and one incident exercise, and file the evidence for both.
Line up the SOC 2 period with the ISO audit cycle, so one evidence set serves both.

Which to Get First

Selling mainly to US banks and enterprises: SOC 2 Type 2.
Selling mainly outside North America: ISO 27001.
Too early for either: map your controls to NIST CSF 2.0, which is free.
Holding client keys: add key-specific evidence. Kraken and Fireblocks also list CCSS.
Already have one: add the other when a buyer's questionnaire names it.

How Guardian Helps

Guardian does not issue SOC 2 reports or ISO certificates. A CPA firm or a certification body does.

Guardian's Regulatory & Compliance service prepares you for both. Its maturity assessment covers the 93 Annex A controls for design and operation, "so certification readiness falls out of the assessment."

Its Technical Evidence maps each artifact to the provisions it answers. Deployment verification, for example, maps to SOC 2 CC8.1 and ISO 27001 A.8.32.

The Digital Asset Assurance Pilot maps CCSS, ISO 27001 and NIST CSF onto your actual key ceremony and change control.

Guardian's own SOC 2 Type II is underway, with an auditor engaged. Its site lists NIST CSF 2.0 and CCSS as aligned.

Frequently Asked Questions

Is SOC 2 or ISO 27001 better for a crypto company?

Neither is better in general. Pick the one your buyers ask for: Drata links SOC 2 to North American customers and ISO 27001 to international ones. Both leave smart contract code to a separate audit.

Can ISO 27001 replace SOC 2?

Sometimes. US guidance lets banks consider independent certifications as well as SOC reports, and DORA's due diligence standard lists audit reports and certifications alike. A buyer whose questionnaire names SOC 2 may still insist on it.

How long do SOC 2 and ISO 27001 last?

A SOC 2 Type 2 covers a period of typically 3 to 12 months, and a new report usually follows each year. An ISO 27001 certificate runs three years, with surveillance audits between and recertification at the end.

Do SOC 2 or ISO 27001 cover smart contracts?

Neither tests contract logic. Both can cover the change process around a deployment if it is in scope: SOC 2 criterion CC8.1 and ISO 27001 control 8.32. Whether the code is correct needs a smart contract audit.

Sources

Get audit-ready for SOC 2 and ISO 27001

Guardian maps one set of controls and evidence to both frameworks, then tests the keys, contracts and signing services they leave open.

Talk to Guardian Explore the assurance pilot