ISO 27001 vs SOC 2 in Europe

Which one buyers actually ask for.

Who it applies to

A software company deciding which attestation to get first: selling into Europe, ISO 27001 is the one buyers name; selling mainly to US customers, SOC 2 is the shape their procurement expects; selling to both, the ISO management system comes first, since it produces the evidence a later SOC 2 reads.

The dates

Before the first deal or tender that asks for one, and early enough that the audit is booked before the buyer's deadline, since neither attestation can be produced in the month a questionnaire arrives.

The one thing to do

Count what your own buyers ask for, re-run the public TED query for the European share, get ISO 27001 if Europe is the market, add SOC 2 when a US customer's procurement requires the report, and build the management system first so that the second attestation reads the evidence the first one produces.

If you sell into Europe, ISO 27001: in the 365 days to 12 September 2026 it appears in 3,405 tender notices on TED, the EU's own procurement portal, against 104 for SOC 2, about 33 times more often, and month by month the ratio never once fell below 18 to one.

If you sell mainly to US companies the answer runs the other way, because SOC 2 is the shape their procurement expects. The count is of mentions rather than hard requirements, TED's search API is public, and the query is below so you can re-run it.

This one is answerable with evidence that is not ours.

The measurement

TED is the European Union's own procurement portal. Every public tender above the EU thresholds is published there, and its search API is open to anyone with no key and no account. So "what does European procurement actually ask for" is a question with a checkable answer rather than an opinion.

Counting every spelling of both terms across the 365 days to 12 September 2026:

Term	Notices mentioning it
ISO 27001	3,405
SOC 2	104
NIS2	599
ISO 42001	17

ISO 27001 appears roughly 33 times more often than SOC 2. The first snapshot, taken on 11 August 2026, said 3,408 against 104: the count moves by single digits a month and the ratio does not move at all.

Month by month

The same query one calendar month at a time, for the twelve complete months from September 2025 to August 2026: ISO 27001 is named in between 242 and 343 notices a month, SOC 2 in between 4 and 19. The narrowest month was June 2026, 343 against 19, 18 to one; the widest was August 2026, 242 against 4, 60 to one. There is no month in which the answer changes. The full series with a chart, the buyer countries and a CSV are on the research page.

What that number is and is not

It is a count of mentions, not of hard requirements. A notice that names ISO 27001 in a list of desirable qualifications counts the same as one that makes it a condition. The ratio compares like with like, so the comparison holds even though the absolute number overstates how many tenders truly demand it.

It is also public procurement only. Private enterprise buying is not in TED, and a large German manufacturer's vendor questionnaire does not become a tender notice. What public procurement gives you is the one slice of European buying where the requirements are published rather than inferred, which makes it the best available proxy and not a perfect one.

The honest version of the answer

If you sell into Europe, ISO 27001 is not a close call. It is the certification European buyers name, and the gap is not marginal.

If you sell mainly to US companies, the argument runs the other way. SOC 2 is the shape American procurement expects, its report format is what their security teams are trained to read, and an ISO certificate will often prompt a follow-up questionnaire rather than replace one.

If you sell to both, the sequencing question matters more than the choice. ISO 27001 builds a management system; SOC 2 attests to controls over a period. The ISO system is the thing that produces evidence continuously, so companies that build it first usually find a later SOC 2 cheaper than the reverse.

Run it yourself

The API is api.ted.europa.eu/v3/notices/search, it takes an expert query string, and it needs no credentials. Set paginationMode to ITERATION and count the notices matching each term; the exact query and the script are on the research page. Our snapshot is dated; if your numbers differ from ours, yours are the more recent ones.

Nothing about this is a claim you have to take from a vendor, which is the point.

Where in Europe

The same query split by buyer country: which EU countries name ISO 27001 in public tenders. Germany and Poland account for seven in ten mentions, and France, Spain and Italy name their national schemes instead.

Once the choice is made: what ISO 27001 certification costs, by headcount, and how StandardOS compares with the platforms that sell SOC 2.

The questions people ask

Do European tenders ask for ISO 27001 or SOC 2?

ISO 27001, by a wide margin: in the 365 days to 12 September 2026, public tenders on TED named it in 3,405 notices against 104 for SOC 2, about 33 times more often. The count is of mentions, so it says what buyers name, not how many make it a condition.

Is SOC 2 accepted in Europe?

As evidence in a security questionnaire, often; as the thing a tender names, rarely. A SOC 2 report is the shape US procurement expects, and an ISO 27001 certificate in a US procurement usually prompts a follow-up questionnaire rather than replacing it.

Do I need both ISO 27001 and SOC 2?

Only if you sell to both markets, and then the order matters more than the choice: ISO 27001 builds a management system that produces evidence continuously, and a later SOC 2 attests to controls over a period from that evidence, so the ISO system first is usually the cheaper sequence.

How do I re-run the count?

TED's search API is public and needs no key: count the notices that mention each spelling of each term in your window. The exact query, the script and a CSV of the monthly series are on the research page, and if your numbers differ from ours, yours are the more recent.

This is the kind of thing the product does for you.

StandardOS builds the management system behind an ISO 27001 certificate, and publishes its own limits the same way this page publishes its sources.

Start your compliance system Work out your audit cost

Or have it done with you: ISO 27001 gap assessment, €1,200, 10 working days