ISO 27001 is a certifiable international standard for running information security as a management system. SOC 2 is a US audit report, NIST frameworks are US guidance, PCI DSS is a card industry rulebook and ISO 9001 covers quality, not security. For most Irish businesses the choice is set by who your customers are. ERS IT Solutions, in Dublin 15 since 1983, does not certify against any of these. We help clients run the technical controls they share.
The short answer: which framework does an Irish business need?
Start with the people asking. European customers, Irish public tenders and regulated sectors usually ask for ISO 27001. US customers of a software or cloud company usually ask for a SOC 2 report. If you take card payments, PCI DSS applies whatever else you do. US federal government cloud work needs FedRAMP. NIST frameworks are useful to structure your programme but carry no certificate.
| Framework | What it is | Who issues it | Certificate? | Usual reason an Irish firm meets it |
|---|---|---|---|---|
| ISO 27001 | Information security management system standard | Accredited certification body, e.g. NSAI | Yes, three-year cycle | EU customers, tenders, regulated sectors |
| SOC 2 | Attestation report on controls at a service organisation | Licensed CPA firm under AICPA standards | No, a report | US customers of SaaS and IT services |
| NIST CSF 2.0 | Voluntary cyber security framework | Self-assessed | No | Structuring a programme; basis of Ireland's CyFun |
| NIST SP 800-53 | Detailed security and privacy control catalogue | Self-assessed or US agency | No | US federal systems and their suppliers |
| FedRAMP | US federal authorisation for cloud services | US government programme | Authorisation | Selling cloud services to US federal agencies |
| PCI DSS | Security standard for card data | Assessed against PCI SSC rules | Report or self-assessment | Taking or storing card payments |
| COBIT | IT governance and management framework | Self-assessed | No | Board-level IT governance, audit teams |
| ISO 9001 | Quality management system standard | Accredited certification body | Yes | Quality, not security |
| ISO 20000 | IT service management system standard | Accredited certification body | Yes | IT service providers proving service quality |
ISO 27001 vs SOC 2
ISO 27001 certifies that you run an information security management system that meets the standard. You pass or fail, and get a certificate valid for three years with yearly surveillance audits. SOC 2 is different in kind. It is an attestation report, issued by a licensed CPA firm under AICPA standards, describing your system and the auditor's opinion on your controls against the Trust Services Criteria. There is no pass mark or certificate. The customer reads the report and decides.
ISO 27001 is better known in Europe. SOC 2 is the default in the US market. Many software companies selling on both sides of the Atlantic end up with both, and the overlap in controls is large, so the second one costs less than the first.
SOC 2 Type 1 vs Type 2, and SOC 1
A SOC 2 Type 1 report covers whether controls are designed properly at a single point in time. A SOC 2 Type 2 report covers whether they operated effectively over a period, commonly several months to a year. Customers usually want Type 2. SOC 1 is a separate report about controls relevant to a customer's financial reporting, such as a payroll processor. So "SOC 1 vs SOC 2 vs ISO 27001" comes down to: SOC 1 for financial controls, SOC 2 for security and related criteria, ISO 27001 for a certified security management system.
Is there an ISO 27001 to SOC 2 mapping spreadsheet?
People search for an "ISO 27001 vs SOC 2 mapping xls" because the frameworks overlap. Mappings exist from the AICPA and from audit firms, and your SOC 2 auditor or ISO consultant will normally provide one. Use a mapping as a starting point only. The wording and evidence each auditor expects differ, so a control that satisfies one does not automatically satisfy the other.
ISO 27001 vs NIST
The NIST Cybersecurity Framework, now version 2.0, organises security into six functions: Govern, Identify, Protect, Detect, Respond and Recover. It is voluntary, flexible and has no certificate. ISO 27001 is stricter about management system requirements and gives you independent certification.
This matters in Ireland because the NCSC recommends the Cyber Fundamentals (CyFun) framework, which is built on NIST CSF 2.0, as a voluntary route for organising NIS2 measures. The NCSC also says it will continue to recognise ISO 27001. Work done against one maps well to the other.
ISO 27001 vs NIST 800-53
NIST SP 800-53 is a large catalogue of security and privacy controls written for US federal information systems. It goes into far more detail than ISO 27001's 93 Annex A controls. Irish firms rarely need it unless they supply US federal agencies or their contractors.
ISO 27001 vs FedRAMP
FedRAMP is the US government programme that authorises cloud services for federal agency use. It is based on NIST 800-53 controls, not ISO 27001. An ISO 27001 certificate helps your security posture, but it does not give you a FedRAMP authorisation.
PCI DSS vs ISO 27001
PCI DSS applies to any organisation that stores, processes or transmits payment card data. It is narrow and prescriptive: it tells you exactly how to protect cardholder data. ISO 27001 is broad and risk-based. They are not alternatives. If you take card payments, PCI DSS is required by your card agreements regardless of any ISO certificate. The usual way to shrink PCI scope is to keep card data off your own systems entirely by using a hosted payment page.
ISO 27001 vs COBIT
COBIT, from ISACA, is a framework for governing and managing enterprise IT as a whole: how IT decisions are made, measured and aligned with the business. It is used by IT auditors and boards. ISO 27001 is focused on information security and can be certified. Larger organisations sometimes use COBIT for governance and ISO 27001 for the security system underneath.
ISO 27001 vs ISO 9001 and ISO 20000
All three use the same high-level management system structure, so an organisation certified to one finds the next easier. ISO 9001 covers quality management: consistent processes and customer satisfaction. ISO 20000 covers IT service management, the processes an IT provider uses to deliver services. ISO 27001 covers information security. Certification bodies, including NSAI, can often audit them together as an integrated system, which saves audit days.
ISO 27001 vs ISO 27002
ISO 27001 is the standard you are certified against. ISO 27002 is the companion guidance that explains each of the 93 Annex A controls in more depth: purpose, guidance and other information. You cannot be certified to ISO 27002. Use it as the handbook when you build the controls ISO 27001 asks for.
SOC 2 compliance vs ISO 27001: which is cheaper?
Neither publishes a standard price. ISO 27001 fees are quoted by certification bodies for a three-year cycle, and SOC 2 fees are quoted by CPA firms per report, with Type 2 needing an observation period. In both cases the larger cost is usually internal: fixing gaps and running the controls long enough to prove they work. Read our ISO 27001 certification guide for what drives ISO costs in Ireland.
Where ERS fits
Whatever the framework, the same technical controls come up again and again: MFA and access control, patching, endpoint protection, logging and monitoring, backups, device management and staff training. ERS runs those day to day through our managed cyber security services and produces the evidence auditors ask for. We are Cyber Essentials certified and help clients choose a sensible order: Cyber Essentials first, then the framework their customers require.
ERS quotes per business after a short call. Contact us or call 01 885 9500.