Should a SaaS company get ISO 27001 or SOC 2 first?

Start with the one your buyers ask for. ISO 27001 ends in a certificate, and SOC 2 ends in an auditor’s report on how you protect customer data. Much of the work for one counts towards the other.

Does NIS2 apply to software companies?

Only in some cases. Selling software alone doesn’t bring you under NIS2. Your type of service, company size and national rules decide it.

What can a bank customer ask for under DORA?

Contract terms on incident notices, audit rights, recovery arrangements and supplier information. Banks can also ask how they would leave your service.

Does the Cyber Resilience Act cover our software?

Standalone SaaS delivered solely as an online service is generally outside the CRA’s scope. The CRA can cover software customers install. It can also cover remote data processing that a product needs to perform one of its functions, such as a mobile app’s online service. That applies when the processing is developed by or under the responsibility of the product’s manufacturer. Our free CRA check gives a first answer for one product.

Can one set of documents answer every buyer?

Mostly. Policies, access reviews, supplier checks and test results answer many repeat questions. Each standard still has its own audit and report format.

ISO 27001 and SOC 2 support for SaaS companies

Relevant regulations and standards

What applies to your software business

Some requirements come from your buyers and some from EU law. Your services and your customers decide which ones you face.

Your business	What usually applies	Where to start
SaaS company selling to larger businesses	ISO 27001 and SOC 2 are voluntary. Buyers may ask for one of them before signing.	ISO 27001 Certification Consultancy
Software or IT supplier to banks and other financial firms	DORA reaches you through your customers’ contracts, with terms on incidents, audits, recovery and exit.	DORA Compliance & ICT Risk Assessment
Cloud, data-centre or managed IT service provider	NIS2 can apply, depending on your size and national rules.	NIS2 Compliance
Company selling software or connected devices in the EU	The Cyber Resilience Act can cover standalone software. Its reporting duties have applied since 11 September 2026.	The free CRA check
Company with AI features in its product	The EU AI Act sets duties by your role and the risk of the use. Most of its rules have applied since 2 August 2026.	AI Governance

Work done for ISO 27001 also helps with SOC 2, though SOC 2 needs its own description of your service.

StandardISO 27001An international standard for managing information security risks, with independent certification of your management system.
Audit reportSOC 2An independent assurance report assessing a service provider’s controls for protecting customer data.
EU lawNIS2An EU directive on cybersecurity risk management and incident reporting for organisations in specified critical sectors.
EU lawDORAEU rules for financial institutions on IT risk, incident response, recovery, resilience testing and IT suppliers.
EU lawCyber Resilience ActEU cybersecurity requirements for connectable software and hardware products, including security updates and vulnerability handling.
EU lawEU AI ActEU rules for developing and using AI. Your obligations depend on your role and the risks of the AI system.

Common challenges

Security requests alongside product releases

A buyer sends a security questionnaire
Sales needs answers backed by current policies and test reports before the contract can move.
A release changes what was tested
Features shipped since your last penetration test are not in the old report.
Buyers ask for different reports
One customer wants ISO 27001, another wants a SOC 2 report, and you need to choose which to prepare first.
A bank adds DORA contract terms
The contract asks for incident notices, audit rights and a plan for leaving your service.

How we help

Security support for your product and your customers

Common questions

Cybersecurity and audit readiness for software and SaaS companies

What applies to your software business

Security requests alongside product releases

A buyer sends a security questionnaire

A release changes what was tested

Buyers ask for different reports

A bank adds DORA contract terms

Security support for your product and your customers

Common questions

Meet your next customer security requirement