ISO 27001 or SOC 2 when the customers are in Europe: costs, timelines and which one a German or Dutch buyer asks for

A customer in Munich or Utrecht asks for your security certificate. If you have read anything written for American startups, you will reach for SOC 2. Before you sign that engagement letter, look at what European buyers actually write down.

We did that. The EU's public tender database lets anyone search the text of procurement notices, so we counted two years of software and IT tenders from German and Dutch buyers, then read the notices themselves. Here is the result, followed by what each option costs a ten-person vendor over three years, how long each takes, and how to run both from one set of controls if you end up needing both.

For what SOC 2 is and how its audit runs, read our piece on SOC 2 for a five-person SaaS. This article is about the choice between the two.

What German and Dutch tenders ask for

We searched TED, the EU's tender journal, through its public API on 5 November 2026: notices published from 1 November 2024 to 31 October 2026, software and IT services only (CPV divisions 48 and 72), with spelling variants of each standard. One purchase often produces several notices, so we counted distinct procedures.

A keyword match is not a requirement, so we read them. We read all 55 SOC 2 procedures, and a random sample of the ISO 27001 ones (30 German, 25 Dutch). The reading changes the picture more than the counts do.

So SOC 2 is usually a door German buyers leave open, not the one they point to. Typical wording: a certificate under "ISO 27001 oder SOC 2 Type I" at the German National Library, or ISO 27001 "or equivalent (e.g. SOC 2)" for a funds data contract. Of the six that ask by name, three buy outsourced security monitoring, such as this managed detection service, one is an online ticket shop, and two are the same cloud purchase for satellite positioning, which wants SOC 1, 2 and 3 alongside C5 and ISO 27001.

One small warning about the word "comparable". Eight of those German notices list "ISAE-2402 (SOC II)" as an acceptable alternative. There is no such standard in common use, and the near match, ISAE 3402, is the financial-reporting report, the SOC 1 family rather than SOC 2. If a form mixes these up, ask in the question round whether your report counts; do not assume.

The ISO sample looks different. Of 30 German notices, 25 put the demand on the bidder or its data centre, and 5 merely had ISO 27001 as the subject of the work (consultants helping someone else get certified). Of those 25, 10 ask for ISO 27001 flat, with no alternative stated, and 15 accept something comparable. A finance software tender shows the ranking neatly: ISO 27001 is a must, and SOC 2 Type 2 earns two bonus points.

The Dutch pattern is different again. Of the five Dutch SOC 2 notices with readable text, one describes a product already bought and one, a municipal content system, wants a SOC 2 or ISAE 3000 statement because it wants proof the measures worked throughout the year. The other three list SOC 2 or an ISAE report next to ISO 27001, not instead of it: a lab software platform, a till system for the national railway and an office IT support contract. Six is a small number, so treat this as a lead, not a law.

What this count cannot tell you. These are public buyers and utilities above EU tender thresholds, not private companies. It reads the notice, not the tender documents behind it, and Dutch notices often just say "see the documents", which is probably why their rates are lower: 1.5 per cent of Dutch IT notices name ISO 27001, against 8.9 per cent of German ones. We did not find a sound survey of private European buyers. Consultancy blogs do say European buyers prefer ISO 27001, but the one we read closely cites no survey or data for it. We would treat public tenders as a reasonable hint about regulated and larger private buyers, and no more than a hint.

Certificate or attestation: the difference a buyer sees

The practical consequence for selling: a procurement officer can tick an ISO certificate in a minute, and can check it on IAF CertSearch, the public register. A SOC 2 report is a long document that a security person has to read. It also tells that person more, including where you failed. That is why the Dutch municipality above asks for a report: it wants to know the controls worked, which a certificate does not say control by control.

A trap on the European side: SOC 2 reports from European firms are often issued under ISAE 3000. Kiwa and Bureau Veritas both offer this in the Netherlands. That is fine for a Dutch buyer. An American customer may want a report signed by a licensed CPA firm, as this auditor directory warns. We found no authoritative statement that US buyers accept the ISAE version, so if you have both markets, get the signing route in writing before you pay.

What the ISO audit costs, and why surveillance is the cheap part

ISO audit fees are built from a day count. The counts below come from the audit-time chart in ISO/IEC 27006, as published by GRC Solutions and High Table. Pounds are converted at the European Central Bank rate of 4 November 2026 (1 euro = 0.8346 pounds = 1.1267 dollars).

Both rates are from those guides: £1,250 is their standard working figure, and High Table says £1,500 a day in 2026, a 20 per cent rise it puts down to auditor shortages. Three things move your number. Freelancers in scope now count as people under the December 2024 edition of the standard, so a five-person company with five contractors is a ten-person company. The same edition changed how shared, identical work can lower the count, and accredited bodies had until 31 March 2026 to adopt it, so ask which method your quote uses. And GRC Solutions says a certifier can go as low as 70 per cent of the recommended days.

Published figures from the German market sit in the same area. SECJUR, a German compliance software company, gave these for a 10-50 person company in September 2026:

SECJUR sells the platform in that table, so read the total as an upper-middle estimate. Note the shape of the certificate: three years, with an audit each year. Stage 1 reviews your documents, Stage 2 tests whether you do what they say, then come surveillance audits in years one and two and a full recertification in year three. High Table puts surveillance at about a third of the initial fee and recertification at £6,000 to £8,000 in 2026 ($8,100 to $10,800). Its own page isn't consistent on these figures, so we use SECJUR's low figure for surveillance and our own estimate of €7,000 for recertification below.

SOC 2 has no cheap year. The whole audit comes round every twelve months. Drata's March 2026 figures for a small company are $7,500 to $15,000 for a Type 1 and $12,000 to $20,000 for a Type 2. The same directory puts Type 2 in Germany between about €14,000 at specialist firms and €224,000 at the largest.

A three-year budget for a ten-person vendor

Assumptions: ten people in scope, one product on a major cloud, an annual compliance platform, no consultant, security category only for SOC 2. Platform prices are the small-company end of Vendr's figures, which report a $20,000 median for Vanta. Vendr says each framework is priced separately and gives no figure for a two-framework deal at this size, so the $18,000 is our estimate. The internal audit line is the low end of High Table's £3,500 to £10,000; ISO 27001 requires one, and at ten people the person who built the system cannot credibly audit it. Penetration test as in our pen test piece. Staff hours are our estimates, not published figures, valued at $100 an hour.

Years 2 and 3 swap the ISO audit for surveillance ($3,400, from €3,000) and recertification ($7,900, from €7,000). Hire a consultant and add $16,900 to $28,200 in year one on SECJUR's figures, though you should save some staff hours. If you start with no written policies and no platform, SECJUR's half to one and a half people for the build is closer to the truth than our 250 hours.

Three readings. First, the two certificates cost about the same: $9,500 over three years separates A and B, inside the error of any of these estimates. Do not choose on price. Choose on who is buying. Second, the second standard adds about $21,000 a year, mostly the extra audit, or 40 to 60 per cent on top of the ISO-only total over three years. Third, waiting saves money: path C costs $21,000 less than path D, and you buy the second standard only once a named customer has asked. The cost of waiting is a deal that needs it sooner than you can deliver.

How long it takes

The ranges come from Consilien (6 to 10 months for most, 3 for a small company with a tight scope and controls already running) and Orbiq (9 to 15 for a German SME certifying for the first time) for ISO, and Drata for SOC 2; the split by stage is our reading of how those steps fit together. ISO has no fixed window, which helps if a date is pressing. And one Dutch notice shows what to ask for meanwhile: Leiden University widened its reservation-system tender so that the supplier could obtain the ISO 27001 certificate within a year.

Doing both from one set of controls

The overlap figures you will see are vendor estimates: 65 to 70 per cent in one place, about 80 per cent in others, sometimes credited to the AICPA's published mapping between the two. We could not confirm a percentage from the mapping itself. What is clear is where the work is shared and where it is not.

Four habits keep it to one system. Write one control list and tag each control with its Annex A number and its SOC 2 criterion. Align the calendars, so the SOC 2 window ends just before the ISO surveillance visit and one evidence push serves both. Put the same scope in both, because a certificate covering "head office" and a report covering the product helps nobody. And ask for one price: some firms do both, which saves meetings, but we found no published figure for a combined discount, so treat any saving as something to negotiate.

Which buyer wants what

German NIS2. The law took effect on 6 December 2025 and covers roughly 30,000 companies, up from about 4,500, from 50 staff or €10 million in turnover. Section 30 of the BSI Act lists supply chain security among the required measures and tells companies to take European and international standards into account, but it names no certificate. So you are not legally required to hold ISO 27001. Your customer is required to show it looked at you, and a certificate is the shortest way to answer.

C5. This is the German item most foreign vendors miss. It is an attestation from the Federal Office for Information Security's catalogue, audited under ISAE 3000. For patient data in the cloud, section 393 of the German social code requires a current Type 2 since 1 July 2025 (new systems get 18 months on Type 1), and a comparable standard counts only if it is shown to be of a comparable level. Rödl describes ISO 27001 there as a temporary bridge with a gap analysis, and C5 elsewhere as a growing market expectation rather than a legal duty. The new catalogue, C5:2026, has 168 criteria against 121 before and binds audit periods from 1 June 2027. We did not find small-company prices we would trust, so get a quote before you promise one.

Read which layer they mean. At least eight of the German SOC 2 notices ask about the infrastructure and not you: "for the infrastructure components" (C5 Type 2 or SOC 2 Type 2) or the data centre or operating environment. Your cloud provider may already cover this; AWS, for one, publishes its C5 report through AWS Artifact. A sentence in your bid naming the provider and the report can clear a line that looked like a six-month project. It does not cover your own company when the notice says "the bidder".

The Netherlands. BIO2 binds central, provincial, municipal and water authorities, is built on ISO 27001 and 27002, and its measures became mandatory with the Dutch NIS2 law on 15 August 2026. It is a government baseline, not a vendor certificate, but Dutch notices do name it, such as this water authority hosting contract, so expect to be asked how you meet it. An ISO control set is the natural starting point. In healthcare, Kiwa says care organisations must comply with NEN 7510 and that SaaS suppliers can be certified to it. It is close to ISO 27001 with a health layer, and several Dutch notices write the two as one: "ISO 27001, NEN 7510 certificaat". Back-office buyers can want something else again: a payroll contract and a civil registry system both name ISAE 3402. TISAX, the car industry's scheme, appeared in 27 German IT notices, often in lists of comparable options; if you sell to carmakers, look into it separately.

Five things to check before you buy the certificate

1. Accreditation. Dutch notices ask for a certifier accredited by the Dutch body RvA or a periodic check by an accredited institution, and a German one asks for an accredited certification body. A cheap certificate from an unaccredited mill will not pass. Check the certifier's accreditation mark, then look it up on CertSearch.

2. Scope. Buyers read it. A German CRM tender wants the certificate including its scope, and Breda wants a fitting Statement of Applicability. Your product and the people running it have to be inside the wording, or the certificate answers a question nobody asked.

3. Keeping it alive. One German tender requires the certificate for the whole contract term, and another won't take one older than 24 months. Missing a surveillance visit can suspend it, so budget the three years, not the first audit.

4. The question round. Requirements move. In our Dutch sample alone, two tenders dropped the ISO requirement (website work, licence management), one trimmed the extras, and Leiden granted its year. German notices also move: one deleted its SOC 2 requirement outright. We cannot say from a notice why each changed, but a polite question costs nothing, and the first year of a certificate costs about $37,800.

5. The arithmetic. At an 80 per cent gross margin, the first ISO year pays for itself at $47,250 of annual contract value that needs the certificate; running both from year one takes $73,500. Count only deals that truly need it. If one buyer asks, send answers, not a purchase order: what a small vendor can honestly say on a security questionnaire covers that stage.

Our call

If your pipeline is German or Dutch, start with ISO 27001. Nothing in the two years of tenders we read suggests otherwise: it is named many times more often, it is often the fixed requirement where SOC 2 is the accepted alternative, and it costs about the same. If American customers are the larger share, start with SOC 2, confirm it comes from a CPA firm, and expect it to pass where a European notice says "or comparable", not everywhere. Add the second standard when a named deal pays for it. And before either, read the actual sentence in the actual tender or questionnaire, because this count shows how often it says less, or something other, than you feared.

Sources

Our count: TED search API documentation, queried 5 November 2026 for notices published 1 November 2024 to 31 October 2026, buyer country Germany or Netherlands, CPV 48* and 72*; individual notices linked in the text. Audit days and rates: GRC Solutions, 26 November 2025; High Table, updated 28 October 2026. ISO/IEC 27006-1:2024: usd AG; ANAB. German costs: SECJUR, 10 September 2026. SOC 2 costs: Drata, 25 March 2026; soc2auditors.org, 29 October 2026. Platforms: Vendr, February 2026. Timelines: Orbiq; Consilien. Certificate cycle: Secureframe. Law: BSI Act section 30; Freshfields, 6 December 2025; German Social Code V section 393; Rödl, 17 December 2025; A-LIGN on C5:2026; Dutch Cybersecurity Act, Stb. 2026, 187; Dutch government on BIO2, 8 September 2026. Reports and sector rules: Kiwa on ISAE and SOC; Bureau Veritas; Kiwa on NEN 7510; AWS C5. Exchange rates: European Central Bank, 4 November 2026.