How does SOC 2 compare with ISO 27001?

Summary

• Two widely recognized security frameworks. SOC 2 and ISO 27001 are both established ways for an organization to demonstrate strong information security to customers, and they serve distinct, complementary purposes.
• ISO 27001. An international standard for an information security management system (ISMS); certification against it shows an organization has a mature security program that is continuously improving.
• SOC 2 Type II. An attestation, based on AICPA criteria, of specific security controls; a Type II report evaluates whether those controls operated effectively over a period of time, not just at a single moment.
• Databricks holds both. Databricks maintains SOC 2 Type II and ISO 27001, alongside additional certifications, across AWS, Azure, and GCP.
• Where to verify. Certifications, a due-diligence package, and the enterprise security guide are available through the Databricks Security and Trust Center.

How does SOC 2 compare with ISO 27001?

SOC 2 and ISO 27001 are two of the most widely recognized frameworks for demonstrating information security. They come from different bodies and take different forms — one is an attestation report on specific controls, the other is certification against an international management-system standard — but organizations commonly pursue both because enterprise customers frequently ask for each. Databricks maintains both, and publishes its compliance posture through the Security and Trust Center.
ISO 27001 is an international standard for an information security management system (ISMS). Certification, performed by an accredited body, demonstrates that an organization has established a mature, systematically managed security program that is continuously improving. It is widely regarded as a benchmark for security certifications and is a common requirement for enterprise customers.
SOC 2 is an attestation performed under criteria defined by the AICPA, focused on a defined set of security controls (the Trust Services Criteria, covering areas such as security, availability, and confidentiality). A Type II report evaluates both the design of those controls and whether they operated effectively across an audit period — a point that distinguishes it from a Type I report, which assesses control design at a single point in time.
In short, ISO 27001 attests to the maturity of the overall security-management program, while SOC 2 Type II attests to the operating effectiveness of specific controls over time. The two are complementary, and holding both gives customers assurance on program maturity and on day-to-day control effectiveness.

How Databricks addresses SOC 2 and ISO 27001

• Both certifications, across clouds. Databricks maintains SOC 2 Type II and ISO 27001, with coverage spanning AWS, Azure, and GCP.
• Additional standards. Databricks also holds further certifications and alignments — including ISO 27017, ISO 27018, HIPAA, PCI-DSS, and FedRAMP, and support for GDPR/CCPA requirements — with the current, authoritative list published in the Security and Trust Center.
• Self-service due diligence. The Security and Trust Center provides a due-diligence package (including ISO certifications and penetration-test confirmation), an enterprise security guide, and compliance status by cloud and region. The SOC 2 Type II report is available on request through your Databricks account team.
• Controls you inherit and configure. Beyond certifications, the platform provides governance and security controls — Unity Catalog access controls, audit logging, and lineage among them — that help customers operate their own workloads in line with these frameworks.

Getting started

• Visit the Databricks Security and Trust Center for the current list of certifications and compliance status by cloud and region.
• Download the due-diligence package and enterprise security guide from the Trust Center.
• Request the SOC 2 Type II report through your Databricks account team.

FAQs

What is ISO 27001?

ISO 27001 is an international standard for an information security management system. Certification against it shows an organization has a mature, continuously improving security program.

What is SOC 2 Type II?

SOC 2 is an attestation, based on AICPA Trust Services Criteria, of an organization's security controls. A Type II report evaluates whether those controls operated effectively over an audit period, not just at a single point in time.

Does Databricks have both SOC 2 and ISO 27001?

Yes. Databricks maintains SOC 2 Type II and ISO 27001 across AWS, Azure, and GCP, along with additional certifications listed in the Security and Trust Center.

Where can I get Databricks' SOC 2 report?

The SOC 2 Type II report is available on request through your Databricks account team; ISO certifications and other due-diligence materials are downloadable from the Security and Trust Center.