{"page":"/blog/soc-2-ad-tech","modified":"2026-11-10","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Point","SOC 2","ISO/IEC 27001"],"rows":[["What it is","An auditor's report on controls against the Trust Services Criteria","Certification of an information security management system"],["Who issues it","A licensed CPA firm","An accredited certification body"],["Output","A detailed report: system description, controls, tests, exceptions","A certificate with a scope statement"],["Shared how","Under NDA or through a trust portal","Certificate often published; audit report not"],["Time dimension","Type 2 covers a stated period","Certificate valid between surveillance audits"],["Current version","2017 criteria, revised points of focus 2022; 2027 drafts exposed (AICPA)","ISO/IEC 27001:2022 (Google Cloud, ISO 27001)"]],"sourceUrls":[[],[],[],[],[],["https://www.aicpa-cima.com/resources/download/aicpa-exposure-drafts-proposed-2027-soc-2-trust-services-criteria-and-description-criteria","https://cloud.google.com/security/compliance/iso-27001"]]}