Do I need SOC 2 if I already have ISO 27001?
Short answer
Frequently yes. ISO 27001 and SOC 2 overlap heavily on controls, but US buyers often ask for SOC 2 by name, while international buyers lean toward ISO 27001. Holding one makes the other faster, not redundant.
Why buyers ask for a specific one
Procurement teams standardize on what they know. If your target customers are US enterprises, SOC 2 is usually the expected artifact regardless of your ISO status.
Using the overlap
Much of your ISO evidence maps to SOC 2's Trust Services Criteria, so a combined or follow-on engagement is far less work than starting cold.