SOC 2 vs ISO 27001 vs Singapore's Cyber Essentials: What a Security Certification Actually Proves to a Buyer in Hong Kong or Singapore

The short version: SOC 2 vs ISO 27001 is not a contest between two badges. ISO/IEC 27001 certifies a management system within a stated scope. A SOC 2 report is an auditor's attestation that the buyer has to read. NIST CSF is a framework, not a certificate. Ask for the scope, the period and evidence from your own tenant.

"Are you certified?" is now one of the first questions in an IT provider conversation. It is a reasonable question, and it usually gets a one-word answer. That answer hides most of what the buyer needs to know: which certification, issued by whom, covering which part of the business, valid for which period, and testing what. The SOC 2 vs ISO 27001 question is where that confusion usually starts, so this report starts there too.

It sets out what the main schemes actually are, using the published documents and pages that define them. It covers ISO/IEC 27001, SOC 2, Singapore's Cyber Essentials and Cyber Trust marks, and two United States frameworks that are often mistaken for certificates, the NIST Cybersecurity Framework and CMMC. It then reads the published certificate counts with their caveats, and says plainly where Hong Kong has no equivalent to Singapore's national marks. Every external fact below was re-checked against a source we could open on 30 October 2026; where we could not open a source, we say so and make no claim.

A disclosure. Brocent is an IT provider that gets asked for these certificates, so we are on the supplier side of this question. Brocent's About page states that the company is "ISO/IEC 27001 certified" and "SOC 2 Type II compliant"; we quote the page as written and did not audit those statements for this report, and nothing below relies on them. The test described here is one a buyer should apply to us as readily as to anyone else.

Key findings

• Three different things wear the same word. ISO/IEC 27001 is a certification against a standard, SOC 2 is an attestation report by a CPA firm, and the NIST Cybersecurity Framework 2.0 is guidance that, in NIST's own words, "does not prescribe how outcomes should be achieved." A framework cannot be held, and a report is not a pass mark.
• A certificate proves the management system, not the strength of any one control for you. ISO's own "Certification" page says ISO does not perform certification; independent certification bodies do, and ISO's advice is to check that the body is accredited. What the body audits is the organisation's information security management system against the standard's requirements, within the scope the organisation itself defined.
• Scope decides everything. ISO/IEC 27001:2022 makes the organisation determine the scope of its management system (clause 4.3) and record which controls it has chosen, and why, in a Statement of Applicability (clause 6.1.3 d). A certificate for a narrow scope is genuine and may be irrelevant to the service you are buying, so the scope statement and the Statement of Applicability are the two documents to ask for.
• Singapore has a tiered national scheme, and Hong Kong does not. The Cyber Security Agency of Singapore (CSA) runs Cyber Essentials and Cyber Trust, assessed by certification bodies CSA appoints, with Cyber Trust published as Singapore Standard SS 712:2025. In our search we found no Hong Kong organisation-level equivalent, only a vetted provider directory launched in October 2025.
• The published counts show a large rise that cannot be read as a clean trend. The ISO Survey 2024 infographic reports 96,709 valid ISO/IEC 27001 certificates for 2024 against 47,291 for 2023, and ISO's own Survey page says that from 2025 the Survey is compiled directly from IAF CertSearch. The series changed how it is collected, so the jump is not purely organic growth.
• United States frameworks are not general-purpose certificates. NIST CSF 2.0 is voluntary guidance, and CMMC is a Department of Defense contracting regime for firms handling Federal Contract Information or Controlled Unclassified Information, whose third-party assessment phase was suspended in July 2026.
• The buyer's job is to ask for three things. Ask for the certificate, the evidence for your own tenant, and the contractual commitment, and treat them as three separate assurances.

SOC 2 vs ISO 27001: three different things wearing the same word

The confusion starts with vocabulary. People say "ISO certified", "SOC 2 compliant" and "NIST aligned" as if they were the same kind of claim. They are not.

• A certification is issued against a standard by an independent body. ISO/IEC 27001 is the example. ISO's "Certification" page is explicit that ISO itself does not certify organisations: certification is carried out by external certification bodies, and ISO's guidance to buyers is to check whether the body is accredited, through the national accreditation body or the International Accreditation Forum's IAF CertSearch database.
• An attestation is a report. A SOC 2 examination is performed by a CPA firm under the American Institute of CPAs (AICPA) attestation standards. The firm examines management's description of a system and the controls within it against the AICPA Trust Services Criteria, and the output is a report with the auditor's opinion. A buyer is meant to read it.
• A framework is guidance. The NIST Cybersecurity Framework 2.0, published as NIST CSWP 29 on 26 February 2024, describes cybersecurity outcomes for organisations of any size, sector or maturity. It "does not prescribe how outcomes should be achieved", and the document sets up no certification mechanism.

The practical consequence is that "we follow NIST" and "we are ISO certified" are answers to different questions. The first describes how an organisation organises its thinking. The second says that a third party has audited a management system against a published standard. Neither says that your data is safe.

What ISO/IEC 27001 tests, and what scope statements quietly exclude

ISO/IEC 27001 specifies requirements for an information security management system (ISMS). An organisation defines the scope of the ISMS, assesses its information security risks, decides which controls to apply, records that decision in a Statement of Applicability, and operates the system. A certification body then audits it. Four points follow directly from the standard's own structure and from the bodies that govern certification, and none of them needs a named commentator.

It is the management system that is certified. The standard is a management-system standard: what the certification body audits is whether the organisation's ISMS meets the standard's requirements. That is a discipline of risk assessment, treatment and review. It is not a technical test of your tenant, and the standard does not require the certification body to run one. A certified company has a working risk process. It has not necessarily reduced its risk to a level you would accept.

Scope is the organisation's choice. Clause 4.3 of ISO/IEC 27001:2022, "Determining the scope of the information security management system", makes the organisation set the boundaries of its own ISMS. A scope statement can cover a whole company, a single data centre, one product line or one office. The certificate will name that scope. Read it before anything else.

The Statement of Applicability says which controls are in play. Clause 6.1.3 d) requires a Statement of Applicability listing the controls the organisation has determined are necessary, with justification for inclusions and exclusions. It is the document that tells you whether the control you care about is even part of the certified system. Ask for it alongside the certificate; a scope statement without its Statement of Applicability is half the picture.

The certificate is not a legal compliance statement. ISO/IEC 27001 is an international standard, so it cannot carry any one country's legal requirements. It can help an organisation meet its obligations under data protection or sector rules; it does not by itself make the organisation compliant with them.

Two housekeeping facts help a buyer read a certificate. First, the transition from ISO/IEC 27001:2013 to the 2022 edition, governed by the IAF's mandatory document IAF MD 26, ended on 31 October 2025; certification bodies state that certificates to the 2013 edition were withdrawn or expired at that date. A certificate that still cites 2013 is out of date. Second, an accredited certificate can be checked. IAF CertSearch is the IAF's global database of accredited management-system certifications, populated by certification bodies accredited under the IAF multilateral arrangement, and it exists so that a buyer can confirm a certificate is genuine and current.

What a SOC 2 report is

SOC 2 is the one most often misdescribed in vendor marketing, so it is worth being precise about what we could and could not confirm. We could not open the AICPA's own SOC 2 pages from this environment on 30 October 2026, so the description below is drawn from the way CPA and audit firms describe the AICPA material, and we treat it as a working description rather than a quotation.

A SOC 2 examination covers controls relevant to one or more of five trust services categories: security, availability, processing integrity, confidentiality and privacy. Security is the category every SOC 2 report includes; the other four are chosen according to what the service does. The benchmark is the AICPA's 2017 Trust Services Criteria, with points of focus revised in 2022. The report is built from management's assertion, a description of the system, and the service auditor's report. A Type 1 report speaks to whether controls were suitably designed at a point in time; a Type 2 report adds testing of whether they operated over a period, whose length varies.

Four consequences for a buyer follow from that structure.

• The system scope is management-defined. The report describes a system the provider chose to put in scope, so the first question is whether the service you are buying is that system.
• Only the categories in scope are covered. A report states which of the five categories it addresses, so check that the one you care about, confidentiality for example, is among them.
• The report carries the auditor's opinion, and it may note exceptions. Exceptions are not the same as a failed report. They are often what a buyer most needs to read.
• It is not a badge. A logo saying "SOC 2" is a pointer to a document. The assurance is in the document, which has to be read against your own risk.

Singapore's tiered national scheme: Cyber Essentials and Cyber Trust

One disambiguation first. "Cyber Essentials" is also the name of the UK National Cyber Security Centre's scheme, a different programme with different controls and its own certification route. This section is about Singapore's mark only. For the UK scheme as it applies to a Microsoft 365 tenant, see our setting-by-setting guide to Cyber Essentials controls in Microsoft 365.

Singapore is the one market of the three with a national, tiered organisation-level scheme, published by the Cyber Security Agency of Singapore (CSA). We re-read CSA's certification pages and the current Cyber Essentials mark document on 30 October 2026.

CSA's Cyber Trust certification page says the mark is published as Singapore Standard SS 712 under the Singapore Standardisation Programme, with SS 712:2025 as the current edition. Cyber Essentials has its own CSA document, the Cyber Essentials mark, in the 2025 edition that CSA announced on 15 April 2025 when it extended both marks to cloud security, artificial intelligence and operational technology. For both marks, certification is undertaken by certification bodies that CSA appoints; CSA's pages say self-certification is not allowed and that an organisation may approach any appointed body.

Cyber Essentials is aimed, in CSA's words, at organisations "embarking on their cybersecurity journey", including SMEs, and the mark document says it is designed for organisations with limited IT and cybersecurity expertise and resources, using the Pareto, or 80/20, principle to prioritise essential measures against common attacks. The organisation completes a self-assessment, which an independent assessor from the appointed certification body reviews and verifies; CSA's page states the certification is valid for two years.

Cyber Trust sits above it. CSA's page describes it as a three-year certification with annual audits, for organisations that have already put good cyber hygiene in place. A CSA press release on raising standards for critical information infrastructure also states that licensed cybersecurity service providers will be required to hold Cyber Trust at Level 3 by the end of 2026, which makes the mark a direct question to put to a Singapore security provider.

Certification bodies appointed by CSA describe a CSA Directory of Certified Organisations in which successful applicants are listed. We could not open the directory itself on 30 October 2026, so this report gives no counts and derives no adoption rate; ask the provider for the certificate and confirm it with the issuing body or CSA.

One accuracy note about what this means for a buyer in Singapore. Both marks are organisation-level assurances against a published standard, with an independent assessment and an appointed certification body behind them. That makes them checkable in a way a bare claim is not. It does not make them equivalent to ISO/IEC 27001 or to a SOC 2 report. They test a different, deliberately proportionate set of controls, aimed at smaller organisations.

For the regulator's side of the same market, our checklist on the MAS Technology Risk Management expectations for outsourced IT is a different instrument for a different purpose. Certification is not regulatory compliance.

The United States: frameworks, a contracting regime, and what CMMC does and does not cover

The United States has no single national organisation-level certification mark. What it has is frameworks, sector regimes and contract-driven requirements, and two of them are routinely mistaken for certificates.

NIST Cybersecurity Framework 2.0 is a framework. Its six Functions, Govern, Identify, Protect, Detect, Respond and Recover, organise outcomes at the highest level. NIST publishes it for organisations of any size, sector or maturity, and states that it "does not prescribe how outcomes should be achieved." A provider that says it is "aligned to NIST CSF" is telling you how it structures its programme. There is no body that certifies alignment.

CMMC, the Cybersecurity Maturity Model Certification, is a real certification regime, but a narrow one. The Department of Defense's final rule establishing the programme at 32 CFR Part 170 was published in the Federal Register on 15 October 2024 and took effect on 16 December 2024. Its purpose is to verify that defense contractors have implemented the security requirements that protect Federal Contract Information and Controlled Unclassified Information. Level 1 and Level 2 can be self-assessments; Level 2 can instead be assessed by a certified third-party assessment organisation (C3PAO); Level 3 is a government assessment. Level 2 is built on the 110 security requirements of NIST SP 800-171.

Two limits matter for readers outside defence contracting. CMMC reaches an IT provider only through the contracts of the defense contractors it serves and the information it handles for them, so whether you are in scope is a question for the contract clause, not for a certificate. And its status is moving: the Department announced on 13 July 2026 that it was suspending Phase 2 of the rollout, which would have required third-party assessments for most Level 2 contractors from 10 November 2026, while self-assessment requirements and the underlying NIST SP 800-171 obligations remain in force. We rely on the law firm Davis Wright Tremaine's July 2026 summary, "Department of Defense Suspends CMMC Phase II", for that status; we could not open the Department's own announcement, so check the current Department of Defense postings before relying on it.

Hong Kong's gap: what buyers use when there is no national mark

Hong Kong is the focus market for much of our readership, so we say this plainly. In our search we found no Hong Kong organisation-level cybersecurity certification mark comparable to Singapore's Cyber Essentials or Cyber Trust. That is a statement about what we found, not proof that none exists, and a buyer should check with the relevant authorities.

What we did find is a provider-vetting programme, not a certificate an organisation earns. The Digital Policy Office and HKCERT launched the Cybersecurity Service Providers Connect Programme on 23 October 2025, mainly for local small and medium enterprises. HKCERT's press release of that date says providers are reviewed on professional qualifications, industry experience, service scope and past performance, and lists four service categories: internet security solutions, cybersecurity assessment services, managed security and incident response services, and cybersecurity training. HKCERT's 2025 annual report says more than twenty providers had joined by the time it was written. It is a vetting list of providers, not a standard an organisation is certified against.

In practice, then, Hong Kong buyers fall back on the international instruments covered above, ISO/IEC 27001 and SOC 2, and on what their sector regulator expects. For the financial sector, that last point is the subject of our report on why Hong Kong companies bundle MSP, MSSP and HKMA C-RAF support into one contract, and we do not restate it here. Nothing in this section is a claim about what any Hong Kong regulator requires.

How far the bar has actually moved

Certificate counts are the only quantitative measure of the assurance bar that is both published and countable, and they need careful handling.

The ISO Survey is ISO's annual census of management-system certifications. The ISO Survey 2024 infographic, which credits IAF CertSearch as its data source, reports 96,709 valid ISO/IEC 27001 certificates covering 179,877 sites for 2024, against 47,291 certificates for 2023. ISO's own Survey page states that from 2025 onwards the Survey is compiled directly from anonymised, aggregated data in IAF CertSearch, and that country-level figures are available only inside that database. We could not retrieve ISO/IEC 27001 counts for Hong Kong, Singapore or any other country, so we give none.

The rise from 47,291 to 96,709 is real in the published data, and it should not be presented as a clean trend. The data source changed: the Survey moved onto IAF CertSearch, a database certification bodies upload to, and ISO itself notes that before 2024 certification bodies submitted Survey data voluntarily. A change in how certificates are counted produces a step in the series that looks like growth. One more sign of the break: a certification body's Spanish-language reproduction of the 2025 edition table lists 125,622 valid ISO/IEC 27001 certificates at 31 December 2025 and restates the 2023 figure as 48,671 rather than 47,291. That is a secondary source, and we cite it only to show that the earlier years are being revised, not to add a 2025 growth rate.

So the honest summary is narrow. The published counts show that ISO/IEC 27001 is now commonplace, with 96,709 valid certificates worldwide in the 2024 edition. They do not support a statement such as "adoption doubled in a year" or any market-specific growth rate.

Certificate, evidence and contract are three different assurances

A certificate answers one question: did an independent party find that a management system, in a stated scope, met a standard at a point in time? Two further questions remain, and a buyer needs all three answered.

• Certificate: Which scheme, which scope, which version, which issuing body, and valid until when? For ISO/IEC 27001, ask for the scope statement and the Statement of Applicability, and check the certificate in IAF CertSearch. For SOC 2, ask for the full report, not a summary, and note the period it covers and the categories it tests.
• Evidence: Is the control you care about actually operating for your tenant, your data and your users? This is where the certificate and the buyer's own risk meet, and it is the common gap. A provider can hold a valid certificate whose scope excludes the platform that serves you, or whose sampled controls do not include yours. Evidence for your own environment comes from reports, logs, test results and your own review. For a Microsoft 365 tenant, a fixed-price Microsoft 365 security audit (US$450, US$990, US$1,800 or US$2,900 by headcount, report in 5–7 business days) is one way to get that evidence in a form designed to be used as evidence; it does not certify anything, and the insurer or certification body still makes its own decision.
• Contract: What has the provider committed to do, and what happens if it does not? Notification timelines, audit rights and the right to see the report each year belong in the agreement. A certificate is not a promise to you.

On our own experience, which is qualitative and not a sample: when we are asked for assurance during onboarding in Hong Kong and Singapore, the recurring gap is between the certificate that is presented and the control that is evidenced for the buyer's own tenant. The certificate is usually genuine. What is often missing is the link between its scope and the specific service being bought. That is an observation, not a statistic, and we make no claim about how often it occurs.

This report is about the taxonomy and the counts, and it deliberately stops short of the question of why a provider is itself a route into a buyer's environment. For that argument, and for what to write into the contract, see our report on third-party cyber risk from both sides of the IT provider contract.

What to ask for, by market and by buyer size

These are our recommendations, based on the documents above, not a regulatory requirement in any market.

• A small or mid-sized buyer in Singapore. Ask whether the provider holds Cyber Essentials or Cyber Trust, ask to see the certificate and its expiry, and confirm it with the issuing body or CSA. If the provider holds ISO/IEC 27001 or a SOC 2 report, ask for the scope and the report as well. Our guide to choosing a cybersecurity provider in Singapore covers the selection questions around it.
• A small or mid-sized buyer in Hong Kong. There is no national mark to look up, so ask for ISO/IEC 27001 with its scope statement and Statement of Applicability, or a SOC 2 Type 2 report with its period, and ask for the evidence that the scope covers the service you are buying. If you are choosing a security provider, you can also consult the DPO and HKCERT provider listing, bearing in mind that it is a vetting list, not a certification.
• A buyer in the United States. Do not accept "NIST aligned" as an answer to a certification question. Ask for a SOC 2 Type 2 report or an ISO/IEC 27001 certificate with scope, and ask what framework the provider's own programme maps to. If the work touches defense contracts, ask specifically about the CMMC level the contract requires and the current assessment status.
• A larger or regulated buyer in any market. Treat certification as a filter, not an answer. Ask for the report or Statement of Applicability, a control-by-control mapping to your own requirements, and the contractual rights described above. Our cybersecurity service overview and managed IT security services describe what a provider's security scope can look like; our IT assessment and audit service is built for testing a scope against a buyer's own requirements, and the fixed-price Microsoft 365 security audit does the same for one tenant.

For a provider's side of the same exercise, the discipline is symmetrical. Know your own scope statement, keep the certificate, the report and the evidence in step with each other, and be ready to show a buyer how the scope maps to their service.

What this report does not claim

A research report is only as useful as its limits are clear. These are ours.

• It does not give ISO/IEC 27001 counts for Hong Kong, Singapore or any country. Country data sits inside IAF CertSearch, which we could not open, so we report the global totals only.
• It does not present certificate growth as a trend. The Survey's data collection changed, and the 2025 figure comes from a certification body's reproduction of the table, not from ISO's page.
• The SOC 2 description is not a quotation of AICPA text. We could not open AICPA's pages, so the categories, criteria and report structure are described as audit firms describe them.
• It quotes no named commentators on ISO/IEC 27001. Every point about the standard rests on the standard's own clause structure, ISO's Certification page, IAF MD 26 and IAF CertSearch.
• The Singapore section gives no directory counts. We could not open CSA's Directory of Certified Organisations on 30 October 2026.
• The Hong Kong statement is a search result, not proof of absence, and it makes no claim about regulators, whose pages we did not read.
• The CMMC status rests on a named law-firm summary, and the primary notice should be checked.
• Brocent's own certifications are quoted from its About page as written and are not audited here. The observations about buyer behaviour are qualitative and are not a sample.

Frequently asked questions

What is the difference between SOC 2 and ISO 27001?

ISO/IEC 27001 is a certification: an independent accredited body audits an organisation's information security management system, within a stated scope, against a published standard. A SOC 2 report is an attestation: a CPA firm examines a description of a system and its controls against the AICPA Trust Services Criteria and reports its opinion. A buyer gets a certificate and a scope statement from one, and a report to read from the other.

What does ISO 27001 certification actually prove?

It shows that an accredited certification body found the organisation's management system met the standard's requirements, within the scope the organisation defined under clause 4.3, with the controls it chose recorded in its Statement of Applicability under clause 6.1.3 d). It is an audit of the management system, not a technical test of your tenant, and ISO itself does not issue the certificate; the certification body does.

Is a SOC 2 report a pass or fail?

No. It is a report containing management's assertion, a description of the system and the service auditor's opinion, including any exceptions found. A buyer has to read it for scope, the categories covered and the period tested, and then decide whether it covers the service they are buying.

Is NIST CSF a certification?

No. NIST describes CSF 2.0 as guidance that "does not prescribe how outcomes should be achieved," and the document contains no certification scheme. A provider can say it aligns its programme to the framework, but no body certifies that alignment.

What are Cyber Essentials and Cyber Trust in Singapore?

They are the Cyber Security Agency of Singapore's tiered organisation-level marks, awarded after assessment by certification bodies CSA appoints. Cyber Essentials is aimed at organisations starting their cybersecurity journey and is valid for two years. Cyber Trust, published as Singapore Standard SS 712:2025, is a three-year certification with annual audits.

Is Singapore's Cyber Essentials the same as the UK Cyber Essentials?

No. They share a name and nothing else. Singapore's mark is run by CSA, assessed by CSA-appointed certification bodies and valid for two years. The UK scheme is run by the National Cyber Security Centre with its own control set and certification route. A provider that says it "holds Cyber Essentials" should be asked which one, and a UK-scheme certificate says nothing about Singapore's requirements, or the reverse. Our Microsoft 365 guide to the UK scheme is linked above.

Does Hong Kong have a national cybersecurity certification mark?

We found none comparable to Singapore's marks. The Digital Policy Office and HKCERT launched a vetted provider listing on 23 October 2025, but it vets service providers and is not a certificate an organisation earns. Hong Kong buyers typically rely on ISO/IEC 27001, SOC 2 and sector regulators' expectations. This is a search result, not proof of absence.

How do I check that a certification is genuine and relevant?

For ISO/IEC 27001, ask for the certificate, the scope statement and the Statement of Applicability, confirm the edition is 2022, and check the status in IAF CertSearch. For SOC 2, ask for the full report and read the system description, the categories and the period. For Singapore's marks, ask for the certificate and confirm it with the issuing body or CSA. In every case, check that the scope covers the service you are buying, and ask for evidence from your own tenant where the certificate's scope does not reach it.

Next steps

If you are being asked for assurance, or asking for it, start with the three questions above: scope, period, evidence. If the gap you find is tenant-level evidence for Microsoft 365, the fixed-price Microsoft 365 security audit produces a report and workbook designed to be used as evidence, priced by headcount at US$450, US$990, US$1,800 or US$2,900 and delivered in 5–7 business days. For anything wider, from reading a provider's Statement of Applicability against your own requirements to setting up the contractual rights described here, talk to a Brocent consultant.