ISO 27001 compared with other standards
ISO 27001 is not the only standard or framework for information security. Companies often get the question: “Do you have ISO 27001? Or SOC 2? Or NEN 7510?” This page compares ISO 27001 with the most relevant alternatives. The NEN version is the Dutch publication of the standard.
ISO 27001 is the broadest and most internationally recognised framework for information security. Other standards are often sector-specific (NEN 7510 for healthcare) or regional (SOC 2 for the US). In many cases, ISO 27001 is the foundation you build on.
Overview: ISO 27001 vs other frameworks
| Framework | Type | Scope | Region | Certifiable? | Main target group |
|---|---|---|---|---|---|
| ISO 27001 | Standard (ISO) | Information security, broad | International | Yes (3 years) | All organisations |
| SOC 2 | Attestation (AICPA) | Security controls | US market | No (report) | SaaS, tech, service providers |
| NEN 7510 | Standard (NEN) | Information security in healthcare | Netherlands | Yes | Healthcare organisations |
| NIS2 | EU directive | Cybersecurity | EU | No (legal requirement) | Essential and important entities |
| ISO 9001 | Standard (ISO) | Quality management | International | Yes (3 years) | All organisations |
| ISO 22301 | Standard (ISO) | Business continuity | International | Yes (3 years) | All organisations |
ISO 27001 vs SOC 2
This is the most common comparison, especially among tech companies and SaaS organisations.
| Aspect | ISO 27001 | SOC 2 |
|---|---|---|
| Result | Certificate (valid 3 years) | Report (Type I or Type II) |
| Auditor | Accredited body | CPA / accountant (AICPA ) |
| Focus | Management system (ISMS) | Operational controls |
| Flexibility | 93 Annex A controls, you choose which apply | Trust Services Criteria, you choose which categories |
| Origin | International (ISO) | American (AICPA) |
| Recognition in Europe | Strong | Limited (growing) |
| Recognition in the US | Good | Strong |
| Cost | €15k-€50k+ (certification) | €20k-€60k+ (audit and report) |
When do you need which?
- European clients only: ISO 27001 is usually enough
- US clients only: SOC 2 is the expectation
- Both markets: Start with ISO 27001, then add SOC 2 (there is a lot of overlap)
For a detailed comparison, see ISO 27001 vs SOC 2.
If you process salaries, administrations or pensions for clients, their accountant will usually ask for an ISAE 3402 report rather than a certificate. You can read the difference on ISAE 3402 or ISO 27001.
ISO 27001 vs NEN 7510
NEN 7510 is based on ISO 27001 but focused on the healthcare sector.
| Aspect | ISO 27001 | NEN 7510 |
|---|---|---|
| Basis | Standalone standard | Based on ISO 27001 with healthcare-specific additions |
| Scope | All sectors | Healthcare sector |
| Legal status | None | Yes (via the Wet aanvullende bepalingen verwerking persoonsgegevens in de zorg, the Dutch Supplementary Provisions for Processing Personal Data in Healthcare Act) |
| Additional parts | ISO 27002 (guidance) | NEN 7512 (communication), NEN 7513 (logging) |
| Supervisors | None specific | Inspectie Gezondheidszorg en Jeugd (IGJ, Health and Youth Care Inspectorate) , Autoriteit Persoonsgegevens (AP, Dutch Data Protection Authority) |
When do you need which?
- Healthcare organisation: NEN 7510 (largely covers ISO 27001)
- IT supplier to healthcare: ISO 27001 plus the NEN 7510 additions
- Outside healthcare: ISO 27001
For a detailed comparison, see ISO 27001 vs NEN 7510.
ISO 27001 vs NIS2
NIS2 (the EU Directive on network and information security) is not a standard. It is European legislation for cybersecurity.
| Aspect | ISO 27001 | NIS2 |
|---|---|---|
| Type | Voluntary standard | Legal obligation (EU directive) |
| Introduced | Available since 2005 (current version 2022) | 2024-2025 (implementation into national law) |
| Who | Anyone who wants it | Essential and important entities (energy, transport, health, digital infrastructure, etc.) |
| Penalties | None (loss of certificate) | Yes, fines up to €10M or 2% of turnover |
| Relationship | Not applicable | ISO 27001 helps with NIS2 compliance |
ISO 27001 as a basis for NIS2: If you are ISO 27001 certified, you meet a large part of the NIS2 requirements. NIS2 also requires incident reporting within 24 hours, supply chain security, and direct liability for board members.
ISO 27001 vs ISO 9001
| Aspect | ISO 27001 | ISO 9001 |
|---|---|---|
| Focus | Information security | Quality management |
| Structure | High Level Structure (HLS) | High Level Structure (HLS) |
| Overlap | Clauses 4-7 and 9-10 largely identical | Clauses 4-7 and 9-10 largely identical |
| Specific part | Clause 8 + Annex A (93 controls) | Clause 8 (operational processes) |
Combining them: Because both standards follow the HLS, combining them is efficient. You share the context analysis, management review, internal audit, document control and improvement process. Only the substantive core differs. Many organisations hold both certifications with one integrated management system.
ISO 27001 vs ISO 22301
| Aspect | ISO 27001 | ISO 22301 |
|---|---|---|
| Focus | Protecting information | Keeping the business running |
| Core question | How do I protect information from threats? | How do I keep operating after a disruption? |
| Overlap | Business impact analysis, risk analysis | Business impact analysis, risk analysis |
| Annex A link | A.5.29 and A.5.30: ICT readiness for business continuity | Not applicable (this is the core focus) |
When do you need both? When your organisation depends heavily on IT systems and continuity is critical (data centres, financial service providers, healthcare organisations). ISO 27001 Annex A includes baseline continuity controls, but ISO 22301 goes much further.
Which standard do you need alongside or instead of ISO 27001?
| Situation | Recommendation |
|---|---|
| Tech company, European market | ISO 27001 |
| Tech company, US market | SOC 2 (or both) |
| Healthcare organisation | NEN 7510 |
| IT supplier to healthcare | ISO 27001 plus NEN 7510 additions |
| Essential service provider (subject to NIS2) | ISO 27001 as a basis plus NIS2-specific additions |
| Company that already has ISO 9001 | Add ISO 27001 (a lot of shared structure) |
| Data centre or financial service provider | ISO 27001 plus ISO 22301 |
Do not start several frameworks at once if you have nothing in place yet. Start with ISO 27001 as the foundation. It covers the widest ground and gives you a solid base to add sector-specific or regional frameworks later.
More information
- ISO 27001 vs SOC 2: Detailed comparison
- ISO 27001 vs NEN 7510: Comparison for the healthcare sector
- ISO 27001 vs ISO 27002: Standard versus implementation guide
- NIS2 Directive: What the EU directive requires
- ISO 27001 requirements: All standard requirements by clause
- Annex A controls: The 93 control measures
- Costs and timeline: What does ISO 27001 cost?
- ISO 20000: IT service management: The standard for organisations that deliver IT services and want to certify alongside ISO 27001