Compliance Controls Overlap: How SOC 2, ISO 27001, and HIPAA Share Ground

Every compliance framework sounds unique until you read them. Then you realize they're all asking for the same things: encryption, access control, logging, incident response, and vendor management. This guide maps the exact controls that overlap across SOC 2, ISO 27001, and HIPAA—showing you where you get leverage from one framework when building the next.

The headline: 60% overlap between SOC 2 and ISO 27001

If you've built SOC 2 Type II controls, you're already 60% of the way to ISO 27001. HIPAA reuses most of both. This isn't wasted effort; it means the second framework costs less and moves faster.

Control-by-control mapping

Access Control & Authentication

Effort to build both: If you've implemented RBAC + MFA + recertification for SOC 2, ISO 27001's access controls are ~90% complete. HIPAA adds "minimum necessary" (don't give someone access to all patient data if they only need one patient's data), which refines the policy, not the technical system.

Encryption

Effort to build both: Nearly identical. TLS on all data in transit, AES-256 at rest, keys managed in HSM or KMS—all three want the same implementation. ~98% overlap.

Audit Logging & Monitoring

Effort to build both: 95% overlap. The main difference: HIPAA wants 6-year retention for PHI (vs. 90 days for SOC 2 general logs). If you're running one logging stack, it's simpler to keep all logs for 1+ year anyway.

Incident Response

Effort to build both: ~85% overlap. The main delta: HIPAA mandates breach notification (if >500 PHI records), while SOC 2 and ISO 27001 only require incident response. If you have SOC 2 incident procedures, HIPAA's breach notification is policy + communication templates, not a new technical capability.

Vulnerability Management

Effort to build both: ~90% overlap. Same scanning tools (Qualys, Tenable, Rapid7), same patch cadence, same penetration testing firm. One program serves all three.

Vendor Management & Third-Party Risk

Effort to build both: ~85% overlap. The main difference: HIPAA requires a Business Associate Agreement (BAA) for any vendor touching PHI, while SOC 2 and ISO 27001 just require a data processing agreement (DPA). BAAs are a legal document; technically, they're the same as a DPA, just HIPAA-specific language.

Data Protection & Privacy

Effort to build both: ~80% overlap. HIPAA's "minimum necessary" principle adds specificity around which data fields you need to collect, but the retention/disposal lifecycle is the same.

Physical & Environmental Controls

Effort to build both: ~85% overlap. Most technical teams rely on cloud (AWS, GCP, Azure), so datacenters are outsourced. HIPAA emphasizes portable media (USB drives, laptops) more than SOC 2, because patient data sometimes lives locally—but the control is just "encrypt everything portable," which is standard practice now.

Business Continuity & Disaster Recovery

Effort to build both: ~90% overlap. Same RTO/RPO targets, same backup cadence, same testing schedule.

Where HIPAA diverges (the extra controls)

HIPAA adds these controls that SOC 2 and ISO 27001 don't explicitly require:

• Business Associate Agreements (BAAs) — legal contracts with all vendors who touch PHI
• Minimum necessary — limit access to only the data fields a user needs for their job
• Workforce security training — annual HIPAA training for anyone with PHI access
• Sanctions/disciplinary action — written policy for HIPAA violations (termination, remedial training)
• Breach notification — notify individuals, HHS, and media if >500 records are breached
• Portable media rules — explicit rules for USB drives, laptops, removable media containing PHI

None of these are technical. They're policy, legal, and training—not code, not infrastructure.

How to use this to plan your stack

If you're getting SOC 2 now, ISO 27001 later:

• 60% of your work reuses; 40% is new (mainly documentation, organizational changes)
• Expect 4–6 months of new remediation on top of SOC 2's 8-week baseline

If you're getting SOC 2 and HIPAA:

• 65% of technical controls overlap (encryption, logging, access control, vulnerability scanning)
• HIPAA's extras (BAAs, breach procedures, minimum necessary, workforce training) are policy, not technical
• Expect 12+ months because HIPAA's assessment phase uncovers governance gaps that SOC 2 doesn't touch

If you're getting ISO 27001 and HIPAA:

• Same 65% technical overlap
• ISO 27001's management system (documentation, policy, internal audit cycles) maps cleanly to HIPAA's governance layer

Frequently Asked Questions

Q: If I implement all the SOC 2 controls, am I halfway to HIPAA? Technically, yes—60–65% overlap on technical controls. But HIPAA's governance (BAAs, breach procedures, minimum necessary, workforce training) is another 20–30% of the work. You're about 75% complete, not halfway.

Q: Can one encryption key management system satisfy SOC 2, ISO 27001, and HIPAA? Yes. All three want the same thing: keys encrypted at rest in an HSM or KMS, key rotation policies, access logging. One system satisfies all three.

Q: Do I need separate incident response procedures for HIPAA vs. SOC 2? No. One incident response plan works for both. HIPAA adds breach notification (if >500 PHI records), but your SOC 2 incident procedures already cover detection, containment, and remediation—just add a breach-triggered notification workflow.

Q: Why does HIPAA require 6-year log retention while SOC 2 only wants 90 days? HIPAA is health law; the longer retention is for regulatory audits and litigation. SOC 2 is infrastructure auditing; 90 days is enough to detect anomalies. In practice, most cloud teams keep logs for 1+ years anyway (cheaper than you'd think in S3 Glacier), so you can keep one retention policy for both.

Ready to Map Your Controls?

When you see compliance frameworks as a list of controls rather than separate programs, they become leverage, not overhead. 60% reuse means the second framework is cheaper and faster.

Schedule a scoping call →