Compliance overview
SOC 2, ISO 27001, and GDPR are control sets, not paperwork. SOC 2 audits whether you do what you say; ISO 27001 certifies a management system; GDPR is law with teeth. Learn what each actually demands of your code before sales promises a date.
Sales just closed an enterprise deal “pending SOC 2,” and the customer wants the report in 30 days. The CTO forwards it to you with a single line: “we have SOC 2, right?” You do not. And here is the part nobody told the CTO: a SOC 2 Type II report isn’t a thing you have — it is an auditor’s opinion that the controls you claimed were operating actually operated continuously over a window, usually six to twelve months. There is no 30-day path to a Type II. What you can do in 30 days is start, get a Type I (controls designed correctly at a point in time), and stop your sales team from ever again promising a compliance artifact as if it were a feature flag. The reason this hurts is that compliance failures are almost never technical — the encryption was fine. They are evidence failures: you did the right thing and could not prove you did it, every time, for everyone, over the whole period.
By the end of this lesson you’ll know what SOC 2, ISO 27001, and GDPR each actually demand of your systems, where they overlap, and which one can fine you 4% of global revenue.
Three frameworks, three different machines
Engineers lump “compliance” into one bucket and then get blindsided because the three names they hear most often are not the same kind of thing. One is an audit report, one is a certification, one is a law. Confusing them is how a team spends a quarter chasing the wrong artifact.
SOC 2 (System and Organization Controls 2) is an attestation report written by a licensed CPA firm, governed by the AICPA’s Trust Services Criteria. You pick which of five criteria are in scope — Security is mandatory, then optionally Availability, Confidentiality, Processing Integrity, and Privacy — you write your own controls, and the auditor tests whether those controls are designed well (Type I, a point-in-time snapshot) and whether they operated continuously over a window (Type II, the one customers actually want, requiring 3–12 months of evidence). SOC 2 is dominant in the US B2B SaaS market and is the artifact your enterprise customers will gate the contract on.
ISO/IEC 27001 is an international certification of an ISMS — an Information Security Management System. The crucial difference: SOC 2 audits the controls; ISO 27001 certifies the management system that decides on, runs, and improves those controls. You build the system (risk assessment, a Statement of Applicability mapping the ~93 Annex A controls in the 2022 revision, internal audits, management review), then an accredited body certifies it for a three-year cycle with annual surveillance audits. It is the lingua franca for selling internationally, especially in Europe and Asia.
GDPR (General Data Protection Regulation) is not a report or a certificate — it is EU law, in force since May 2018, applying to anyone processing the personal data of people in the EU regardless of where your servers live. It is the one with real teeth: fines up to €20 million or 4% of total worldwide annual turnover, whichever is higher, plus a 72-hour breach-notification deadline to the supervisory authority. You don’t get “certified” in GDPR; you are continuously liable under it.
| Dimension | SOC 2 | ISO 27001 | GDPR |
|---|---|---|---|
| What it is | Audit report (attestation) | Certification of an ISMS | Law (regulation) |
| Issued by | CPA / audit firm | Accredited certification body | Nobody — you’re just liable |
| Scope you control | You write your own controls | SoA selects from ~93 Annex A controls | Fixed: data-subject rights + principles |
| Time dimension | Type II = 3–12 mo of evidence | 3-yr cycle + annual surveillance | Continuous; 72-hr breach notice |
| Teeth | Lost deals / qualified opinion | Lost cert / lost market access | Up to 4% global turnover |
What this actually means for your code
The senior insight is that none of these frameworks tell you to write specific code — they describe outcomes and demand evidence that you produce those outcomes reliably. Your job is to translate a control phrased in audit English (“logical access is restricted to authorized personnel and reviewed periodically”) into concrete engineering work (RBAC enforced server-side, SSO with MFA, a quarterly access-review job that exports who-can-touch-what, and logs that prove the review happened).
This is why the same control infrastructure satisfies all three at once. RBAC, MFA, encryption in transit (TLS) and at rest, centralized audit logging, change management through pull-request review, and automated backups are the shared spine. SOC 2 asks you to prove they operated all year. ISO 27001 asks you to show the management system that keeps deciding to run them. GDPR asks you to demonstrate they protect EU personal data specifically — and adds requirements the other two don’t: the right to erasure (your “delete user” must actually delete, including from backups and analytics pipelines), data-processing agreements with every sub-processor, and a lawful basis recorded for each kind of processing.
The failure mode: doing it right but proving nothing
The way teams actually fail an audit is rarely “the control didn’t exist.” It’s that the control existed but the evidence was missing, partial, or unsampleable. The access review happened — over Slack DMs, with no exported artifact, so the auditor can’t sample it. Backups ran — but you never tested a restore, so you can’t prove the control’s objective (recoverability) was met. Production access is locked down — except for the three break-glass admin accounts nobody reviews, which is exactly the sample the auditor will pull.
The senior reflex is to build evidence emission into the control from day one, not to reconstruct it under deadline. An access review that doesn’t write a dated, signed export isn’t a smaller version of the control — it’s a control that will fail the audit while looking fine in production. Compliance turns “we did the right thing” into “we can prove we did the right thing, every time, for everyone, across the whole period,” and that second clause is the entire job.
▸Why this works
Why does GDPR get a 72-hour clock when SOC 2 has no such rule? Because they answer to different masters. SOC 2 serves your customers — its consequence is a lost deal, so the timeline is commercial and negotiable. GDPR serves data subjects and is enforced by regulators — its consequence is a statutory fine, so the deadline is legal and fixed. This is why a GDPR breach response can’t live only in your incident runbook: the 72-hour notification to the supervisory authority is a legal obligation that starts ticking the moment you become aware of the breach, not when you finish investigating it. Engineers who treat all “compliance” as one negotiable bucket get the GDPR clock wrong every time.
How a senior scopes a compliance ask
When sales drops “we need SOC 2” on the team, the senior move is to refuse to treat it as a single binary task. First, which report — Type I (weeks, point-in-time) buys you a foot in the door while Type II (a full observation window) is what closes enterprise deals, so set expectations on the calendar immediately. Second, which Trust Services Criteria are in scope — adding Availability or Privacy widens the control set and the evidence burden. Third, what already exists — most of the technical spine (RBAC, MFA, encryption, logging, change management) is good engineering you should have anyway, so the real cost is usually formalizing policy, wiring evidence collection, and remediating the few genuine gaps. The framing that saves you: compliance is mostly the documentation and evidence layer over controls you already need, plus a continuous obligation to keep proving it.
An enterprise prospect says 'we can't sign until you're SOC 2 compliant' and needs to close in five weeks. What do you commit to?
What is the core difference between what SOC 2 and ISO 27001 assess?
Your team performs a quarterly access review over Slack and fixes any stale permissions, but exports nothing. Why does the SOC 2 auditor still flag this control?
Order these from achievable-soonest to longest-running, as a customer-facing compliance commitment:
- 1 SOC 2 Type I (controls designed correctly, point-in-time)
- 2 SOC 2 Type II (controls operated over a 3–12 month window)
- 3 ISO 27001 certification (ISMS built + audited, 3-year cycle)
- 4 GDPR compliance (continuous legal obligation, no end state)
- 01Explain the difference between SOC 2, ISO 27001, and GDPR — what kind of thing each is, who issues it, and what its 'teeth' are.
- 02Why do teams that have strong security controls still fail audits, and what's the senior fix?
SOC 2, ISO 27001, and GDPR are three different kinds of thing: an audit report, a certification of a management system, and a law. SOC 2 (CPA-issued, AICPA Trust Services Criteria) attests that controls you defined are designed well (Type I) and operated continuously over a 3–12 month window (Type II) — its teeth are lost deals. ISO 27001 certifies the ISMS that runs your controls, on a three-year cycle — its teeth are market access. GDPR is EU law applying wherever EU personal data is processed, with fines up to 4% of global turnover and a 72-hour breach clock — its teeth are statutory and non-negotiable. All three sit on the same control spine — RBAC, MFA, TLS and at-rest encryption, centralized logging, change management, tested backups — so the engineering cost is mostly formalizing policy and wiring evidence collection, not new features. The way teams fail is doing the right thing but proving nothing, so the senior reflex is to make every control emit dated, sampleable evidence from the start. Now when sales says “we need SOC 2,” your first question is “Type I or Type II, which criteria, and what evidence already exists” — not “do we encrypt things.”
Practice
Start at the top. Tasks go easiest → hardest: recall a fact, apply it to a case, then a senior-level stretch. Open one, attempt it, then reveal.
Something unclear?
Ask a question about this lesson. Questions are anonymous and go straight to the author to make the lesson better.