ISO 27001
An international standard for an information security management system, with certification issued by an accredited body.
It focuses on the management system rather than a list of technical controls: how risk is assessed, how decisions are made, how effectiveness is measured, and how improvement happens.
It carries more weight internationally than SOC 2, which is largely a North American convention, so buyers outside the US often ask for it specifically.
Where this comes up
ISO 27001 sits inside our compliance and frameworks work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.
Related terms
SOC 2 An audit report on how a service organization controls customer data, assessed against the Trust Services Criteria. Risk assessment A structured evaluation of what could go wrong, how likely it is, what it would cost, and what you will do about it. Security control A specific safeguard put in place to reduce risk, whether technical, administrative, or physical. Security policy The written statement of what your organization requires regarding security, and who is responsible for what.