At a Glance: How the Frameworks Compare
| | ISO 27001 | SOC 2 | ISO 27701 | ISO 27017 / 27018 |
|---|
| What it is | Certifiable management system standard | Attestation report (not a certificate) | Privacy information management system | Codes of practice for cloud security / cloud privacy |
| Scope | Your whole information security management system (ISMS) | Controls of a service you deliver, against the Trust Services Criteria | How you handle personal data, as controller or processor | Cloud services you provide or use |
| Issued by | Accredited certification body | Licensed CPA firm | Accredited certification body | Accredited certification body, as an extension of ISO 27001 |
| Output | Public certificate you can verify | Restricted report, usually shared under NDA | Public certificate | Extension to your ISO 27001 certificate |
| Validity | 3 years, with annual surveillance audits | No formal expiry; usually treated as current for 12 months after the period ends, with a bridge letter for any gap | 3 years, with annual surveillance audits | Follows your ISO 27001 cycle |
| Most recognised in | Global, especially Asia, Europe and government tenders | United States | Global, organisations handling personal data | Global cloud and SaaS market |
| Typical buyer request | "Send us your ISO 27001 certificate" | "Send us your SOC 2 Type II report" | "How do you protect our customers' personal data?" | "How is security shared between you and your cloud?" |
Each Framework Explained
ISO 27001: The Foundation
ISO/IEC 27001:2022 sets out requirements for an information security management system (ISMS). You define a scope, assess your information security risks, choose controls to treat them, and keep improving. Annex A lists 93 reference controls grouped into four themes: organisational, people, physical and technological. You decide which apply, and justify your choices in a Statement of Applicability.
Because it is a management system, ISO 27001 does not certify that you are "secure" on one day. It certifies that you have a working system to identify and manage security risks over time, which is why auditors return every year.
Two things to check on any ISO 27001 certificate, including your suppliers': the version and the scope. The transition from ISO 27001:2013 ended on 31 October 2025, so a certificate still showing the 2013 edition is no longer valid. And a certificate may cover only one office or one system, so read the scope statement and ask for the Statement of Applicability.
You need it when:
- A government department, public body or large corporate lists ISO 27001 in its tender requirements.
- Your clients are in Hong Kong, mainland China, Asia or Europe.
- You want one framework that other standards and regulations can build on.
SOC 2: Proof for US Clients
SOC 2 was developed by the American Institute of Certified Public Accountants (AICPA). A licensed CPA firm examines your controls against the Trust Services Criteria: security (always included), plus availability, processing integrity, confidentiality and privacy where relevant to your service.
There are two types:
- Type I reports on whether your controls are suitably designed at a single point in time.
- Type II reports on whether those controls actually operated effectively over an observation period, typically 3 to 12 months. Most enterprise buyers expect Type II. There is also SOC 3: a short, public version of a SOC 2 Type II report, without the detailed test results, that you can share freely, for example on your website.
A SOC 2 report describes past performance. If you fix a gap after the examination, the report for that period does not change; the improvement shows up in next year's report. ISO 27001 works differently: minor nonconformities need an accepted correction plan, and major nonconformities must be corrected and verified before the certification decision. The certificate then reflects your current state.
Two SOC 2 details that buyers often ask about:
- Subservice organisations. If your system runs on a cloud platform such as AWS or Azure, the report treats that provider as a subservice organisation. It is either carved out, meaning excluded and covered by the provider's own SOC report, or included in scope.
- Complementary user entity controls (CUECs). The report lists controls your clients must operate themselves, such as managing their own user accounts, for your controls to work as described.
You need it when:
- Your clients or investors are US-based, especially SaaS buyers and listed companies.
- Prospects send vendor security questionnaires that ask for a SOC 2 report by name.
ISO 27701: Privacy on Top of Security
ISO/IEC 27701 extends information security into privacy. It covers how you collect, use, share, retain and delete personal data, with separate controls for data controllers and data processors. Until 2025 it was an extension that could only be certified together with ISO 27001. ISO/IEC 27701:2025 is now a standalone management system standard with its own Clauses 4 to 10. Its Annex A lists 31 controls for controllers, 18 for processors and 29 shared controls. You can certify it on its own or, as most organisations do, integrate it with ISO 27001 in one audit. Organisations holding an ISO 27701:2019 certificate need to transition to the 2025 edition within the period set by the accreditation bodies.
You need it when:
- You handle large volumes of personal data, for example in insurance, healthcare, HR, education or e-commerce.
- Clients want evidence that you meet privacy laws such as Hong Kong's PDPO, mainland China's PIPL or the EU GDPR.
ISO 27017 and ISO 27018: The Cloud Add-ons
- ISO/IEC 27017 gives additional security controls for cloud services and clarifies which responsibilities sit with the cloud provider and which sit with the customer.
- ISO/IEC 27018 applies to public cloud service providers acting as PII processors, and focuses on protecting the personal data they process on behalf of their customers.
Both are codes of practice rather than standalone management systems. ISO 27001 certification is a prerequisite: both are audited as an extension of your ISO 27001 ISMS, and their certificates stay valid only as long as your ISO 27001 certificate does. Both are still based on ISO/IEC 27002:2013, so their controls need to be mapped to the 93 controls in ISO 27001:2022 Annex A.
You need them when:
- You are a cloud service provider, SaaS company or managed service provider.
- Enterprise clients ask how security is shared between you and your cloud platform.
How They Fit Together
Think of these frameworks as layers rather than competitors:
- ISO 27001 is the foundation. It gives you the risk assessment, policies, governance and continual improvement that everything else relies on.
- ISO 27017, ISO 27018 and ISO 27701 are extensions. They add specialist controls for cloud and privacy on top of your ISMS, and are usually audited at the same time.
- SOC 2 sits alongside, not on top. It is a separate attestation with its own criteria, but most of the controls it examines, such as access control, change management, incident response and vendor management, are the same ones you already run under ISO 27001.
In short: ISO 27001 gives you a system; SOC 2 gives a US audience a report on how that system performed; ISO 27701 and the cloud standards show you have gone further where your clients need it.
Which Should a Hong Kong Business Choose First?
Start with who your clients are
| Your situation | Start with | Then consider |
|---|
| Clients mainly in Hong Kong, mainland China or Asia | ISO 27001 | ISO 27701 if you handle personal data |
| Bidding for government or public sector tenders | ISO 27001 | Sector-specific requirements in the tender |
| Selling SaaS to US enterprises or listed companies | SOC 2 Type II | ISO 27001 as you expand into Asia or Europe |
| Cloud, SaaS or managed service provider in Asia | ISO 27001 + ISO 27017 | ISO 27018, and SOC 2 for US clients |
| Banks and financial institutions | ISO 27001 | HKMA technology risk requirements, and the CI Ordinance if designated |
| Insurance, healthcare, HR, education or e-commerce | ISO 27001 + ISO 27701 | ISO 27018 if personal data sits in public cloud |
| Critical infrastructure operator, or IT supplier to one | ISO 27001 | A gap check against the Code of Practice |
Hong Kong's new Critical Infrastructure Ordinance
The Protection of Critical Infrastructures (Computer Systems) Ordinance took effect on 1 January 2026, together with its Code of Practice. It covers eight sectors: energy, information technology, banking and financial services, air transport, land transport, maritime transport, healthcare services, and communications and broadcasting. The Commissioner's Office regulates most sectors, while the HKMA and the Communications Authority act as designated authorities for banking and for telecoms and broadcasting.
Designated operators must meet these obligations:
| Obligation | What it requires |
|---|
| Organisation | Keep an office in Hong Kong, set up a computer-system security management unit, and notify the Commissioner of operator changes |
| Security management plan | Approved by the board, covering risk management and supply chain security; reviewed at least every two years or after major changes |
| Risk assessment | At least once a year, with the report submitted within 3 months |
| Independent security audit | At least once every two years, with the report submitted within 3 months |
| Emergency response | A board-endorsed emergency response plan; security drills when the Commissioner requires, no more than once every two years |
| Incident reporting | Serious incidents within 12 hours of becoming aware; other incidents within 48 hours |
| Material changes | Notify the Commissioner of major changes to critical computer systems, such as platform migrations or major upgrades |
Offences carry fines from HK$300,000 to HK$5 million, plus daily fines for continuing offences.
The Code does not name ISO 27001, but an ISO 27001 ISMS already covers much of this ground: risk assessment, security policies, supplier management, incident management, business continuity and internal audit. It is the most direct starting point. Note, however, that an ISO 27001 certification audit is not the same as the ordinance's independent security audit. You will still need a gap check for ordinance-specific items such as the reporting timelines, board approvals and reports to the Commissioner.
What it means for IT vendors and cloud providers
Even if you are not designated, the ordinance will reach you through your contracts. Operators must manage supply chain risk, which means writing security requirements aligned with the Code into supplier contracts. External cloud services used for critical computer systems also count as part of the supply chain.
The government does not publicly disclose which organisations are designated, so you may not know which of your clients are regulated. Holding ISO 27001 before they ask is the simplest way to stay on their approved vendor list.
Personal data: the PDPO today and tomorrow
The Personal Data (Privacy) Ordinance already requires data users to take all practicable steps to protect personal data against unauthorised or accidental access, processing, erasure, loss or use (Data Protection Principle 4). The Privacy Commissioner also encourages organisations to adopt a Privacy Management Programme (PMP). On top of that, the government is studying amendments, including mandatory data breach notification, direct regulation of data processors, required data retention policies and higher penalties.
ISO 27701 maps well onto these expectations. It gives you the governance structure a PMP calls for, and the security, retention and incident processes the proposed amendments target. For businesses moving personal data between Hong Kong and mainland China, it also supports the controls behind the Greater Bay Area Standard Contract for cross-boundary personal information flows, alongside mainland China's PIPL.
Doing More Than One Without Paying Twice
Many organisations end up needing two or three of these frameworks. The good news is that most of the work overlaps. A few ways to keep the cost down:
- Build one control set, map it to many frameworks. Design your controls once, then map each to ISO 27001 Annex A, the SOC 2 Trust Services Criteria and ISO 27701. One policy on access control can serve all three.
- Collect evidence once. Access reviews, change tickets, incident logs and training records can support your ISO 27001 audit and your SOC 2 examination at the same time.
- Combine audits. ISO 27001, ISO 27701, ISO 27017 and ISO 27018 can usually be audited together by the same certification body, with one audit plan and less disruption to your team.
- Align your calendars. Schedule your SOC 2 observation period and your ISO 27001 surveillance audit so the same people are not preparing for audits all year.
The usual sequence is ISO 27001 first, because its risk-based management system makes every later framework faster to add.
