Comparing frameworks: questions and answers.

ISO 27001 is an international standard for an information security management system; an accredited certification body issues a certificate that is valid for three years, with annual surveillance audits. SOC 2 is an attestation report by an independent CPA firm against the AICPA Trust Services Criteria, common with North American customers. Much of the control content overlaps.

Both are certifiable management system standards with the same structure. ISO 27001 is about information security; ISO 42001 is about the responsible development and use of AI, including the impact of AI systems on people. Organisations that use AI substantively often run both.

Start with what your customers, supervisors and risks ask for. For most European organisations that is ISO 27001, because it is widely requested and gives a base for NIS2, DORA and ISO 42001. If AI is central to your product or processes, plan ISO 42001 on top of it.

The GDPR protects personal data. NIS2 sets cybersecurity risk management and incident reporting obligations for essential and important entities. DORA sets ICT risk management requirements for financial entities and takes precedence over NIS2 where both cover the same topic for those entities.

Not automatically. An ISMS covers much of the risk management measures that NIS2 asks for, but NIS2 also has its own obligations, such as incident reporting deadlines and management accountability. You address those explicitly on top of your ISO 27001 controls.