A deal stalls. Someone in procurement writes “we’ll need to see your security certification” and the whole company starts pricing ISO 27001. Six months and £40,000 later it turns out the buyer would have accepted a completed questionnaire and a pen test summary. The most expensive mistake in compliance is answering a question nobody asked.

This is a guide to working out what is actually being requested before you spend anything. It is written for the person at a 30–250 person company who has just been handed the problem.

First: ask. It is free and almost nobody does it.

Before any gap analysis, send one email to your contact at the buyer. Not to procurement — to the person who wants your product, because they want the deal to close too.

“To make sure we get you what you need rather than guessing: is a specific certification a hard procurement requirement, or is the security review satisfied by evidence? If it is a hard requirement, which one and by when? If there is flexibility, we can share a completed questionnaire, our penetration test summary and our sub-processor list this week.”

Three things come back from that email, and each changes what you do next. Sometimes it is a named standard with a contractual deadline. Sometimes it is “whatever satisfies our risk team”. And sometimes — more often than you would expect — it is a template requirement that nobody has thought about since it was written.

The four things people mean by “certification”

What they say	What it usually means	Realistic cost
“Are you ISO 27001 certified?”	A UK or EU buyer following a procurement template. Often genuine, often also satisfiable by evidence of a programme in progress.	£35k–£60k first year, all in
“Can we see your SOC 2?”	A US buyer. SOC 2 is an attestation report, not a certificate, and is shared under NDA.	Type I £8k–£20k; Type II more, plus the observation window
“Do you have Cyber Essentials?”	A UK public-sector or public-sector-adjacent contract. Frequently mandatory and frequently the whole answer.	£300–£3,000
“Please complete this questionnaire”	Their risk team wants assurance, not a certificate. No certification required at all.	Your time, plus a pen test if asked

The gap between the cheapest and most expensive answer to the same stalled deal is a factor of a hundred. That is why the email matters.

Geography decides more than anything else

If you remember one rule, make it this one: SOC 2 is what American buyers ask for; ISO 27001 is what British and European buyers ask for.

It is not a quality judgement, it is convention. A US enterprise security team reads SOC 2 reports all day and may not recognise an ISO certificate. A UK public body or a German bank will ask for ISO 27001 and may not accept SOC 2 at all, because the report is confidential and cannot be published, whereas a certificate can.

So the question is not “which is better”. It is where are the next ten customers. If the honest answer is “mostly UK and EU”, start with ISO 27001. If it is “we are chasing US enterprise”, start with SOC 2. If it is genuinely both, start with whichever the deal currently on the table needs, because the second one costs a fraction of the first.

The second framework is far cheaper than the first — if you set up for it. Access control, change management, incident response, supplier management and business continuity appear in both ISO 27001 and SOC 2, phrased differently. Organise your evidence by control with mappings out to each standard and the second framework is a mapping exercise. Organise it by framework and you do the entire thing twice.

When a certificate is genuinely mandatory

Some requirements are not negotiable and no amount of evidence substitutes:

UK public-sector contracts above certain thresholds require Cyber Essentials, and some require Cyber Essentials Plus. This is contractual, not advisory.
NHS work requires the Data Security and Protection Toolkit, completed annually. ISO 27001 does not replace it, though it makes it far easier.
Defence supply chains increasingly require specific schemes — in the US, CMMC; in the UK, often Cyber Essentials Plus as a floor.
Payment card data brings PCI DSS, and the level depends on transaction volume rather than on anyone’s preference.
Some large enterprises have a hard policy: no certificate, no vendor, regardless of evidence. You will know because the answer to your email will be unambiguous.

What satisfies a buyer who has not mandated anything

This is the common case, and the one worth getting good at. A security reviewer with no hard requirement is trying to decide whether you are a risk worth accepting. Four things usually settle it:

A completed questionnaire, answered specifically. Not “we follow industry best practice” — which answer tells a reviewer nothing and signals that nobody has looked. “MFA is enforced on all accounts through Entra ID Conditional Access; privileged access is reviewed quarterly, last reviewed 14 October” settles the question.

A penetration test summary. The letter, not the findings. An annual external test from a recognised firm, with a date in the last twelve months.

A published sub-processor list with regions and transfer mechanisms. Any GDPR-aware buyer will ask; having it on a public page removes a round trip.

A straight answer about what you are not. If you are not certified, say so and say what you are doing instead. Reviewers are not fooled by vagueness and they are measurably more comfortable with a vendor who volunteers the gap than one they have to find it in.

A decision you can actually run

Send the email. Wait two days. Most of the time this ends the exercise.
If a certificate is mandatory: get the name, the deadline, and whether an in-progress programme with a target date is acceptable in the interim. Many buyers will proceed on that basis with a contractual commitment.
If it is not mandatory: assemble the four pieces of evidence above. That is days of work, not months.
Either way, decide which framework you are heading for based on where your next ten customers are — not on the one deal in front of you.
Then set evidence up by control rather than by framework, before you collect anything. This is the decision that determines whether framework number two costs you a fortnight or another six months.

The thing nobody tells you

A certificate does not close deals on its own. It removes an objection. The deals still turn on the product, the price and whether the buyer believes you will still exist in three years.

What it does buy you is speed: the security review stops being a two-week pause while someone chases your engineers for answers. If you can get that speed from a well-built Trust Centre and a good questionnaire library for a tenth of the cost, do that first, and certify when a buyer makes it a condition rather than when a template implies one.

Which Compliance Framework Does Your Customer Actually Want?