What Do SOC 2 Type II And ISO 27001 Prove About A Video Infrastructure Vendor?
A SOC 2 Type II report and an ISO/IEC 27001 certificate are the two documents enterprise security reviewers ask for most often. Each one proves something the other does not, which is why procurement teams increasingly ask for both. SOC 2 Type II is an attestation report written by a CPA firm. It describes how a defined set of controls are operated across a defined window. ISO/IEC 27001 is a certification issued by an accredited body. It confirms that an organization runs a governed information security management system.
The rest of this post covers what each credential establishes, what neither one establishes, and how both apply to the software a customer buys, whether it’s run inside their perimeter or a vendor-provided SaaS service.
You’ve probably seen ISO 27001 and SOC 2 Type II on software provider websites and security questionnaires. But what do they actually mean, and how much should they matter when you evaluate software?
With AI-assisted development and vibe-coding making it easier to turn an idea into working software, SOC 2 Type II and ISO 27001 deserve renewed attention. Making software functional is one milestone, but reviewing changes, managing access, addressing vulnerabilities, and maintaining it over time are ongoing responsibilities that demand rigorous discipline.
That matters even more when you run software entirely on your own infrastructure. Someone else is developing the code, shipping the updates, and responding when vulnerabilities surface. ISO 27001 certification and SOC 2 Type II attestation can help you assess your software supplier’s security practices.
What Is A SOC 2 Type 2 (Type II) Report?
A SOC 2 Type II report (System and Organization Controls 2, also written SOC 2 Type 2) is the output of an attestation process, performed under the American Institute of Certified Public Accountants attestation standards (AT-C section 105 and AT-C section 205). A licensed CPA firm examines a service organization’s controls, tests them, and issues a formal opinion. The AICPA issues no certificate for SOC 2, and no body certifies organizations against it. The deliverable is the report itself, which typically runs to dozens of pages of testing detail and travels under a nondisclosure agreement.
SOC 2 Type I evaluates whether controls were suitably designed as of a single date. Type II goes further and tests whether those same controls are operated effectively across a defined period, commonly 3-12 months. Where Type 1 documents design, Type 2 documents performance.
An unqualified opinion is the strongest outcome an attestation engagement can produce. It means the auditor concluded that, in all material respects, the description of the system was fairly presented, the controls were suitably designed, and across the period they operated effectively.
What Are The SOC 2 Trust Services Criteria?
SOC 2 organizes controls under five Trust Services Criteria:
- Security
- Availability
- Processing Integrity
- Confidentiality
- Privacy
Security functions as the common criteria and appears in every SOC 2 engagement. The other four are elective, and the scope section of the report names exactly which criteria the auditor tested.
What Is ISO/IEC 27001 Certification?
ISO/IEC 27001 is the international standard for information security management systems. ISO and IEC publish it jointly, and the current edition dates to October 2022.
An Information Security Management System (ISMS) is a governance system that requires an organization to:
- Define its scope
- Identify and assess risk
- Select controls proportionate to that risk
- Assign ownership
- Measure whether the controls work
- Run internal audits
- Put the results in front of leadership on a defined cycle
Certification confirms that security is governed and improved over time, not that a checklist was completed once. Annex A of the 2022 edition lists 93 controls organized by organizational, people, physical, and technological. Organizations select from those controls based on their own risk assessment and record every inclusion and exclusion in a Statement of Applicability.
A Stage 1 audit reviews documentation, a Stage 2 audit examines the management system in operation, surveillance audits follow, and a full recertification audit takes place before the term ends. Every certificate names the activities, services, and locations the ISMS covers.
How Are SOC 2 Type II And ISO 27001 Different?
| SOC 2 Type II | ISO/IEC 27001:2022 | |
|---|---|---|
| Who Issues It | A licensed CPA firm | An accredited certification body |
| Who Governs It | AICPA attestation standards AT-C 105 and AT-C 205 | ISO/IEC 27001:2022, with certification bodies governed by ISO/IEC 17021-1 and ISO/IEC 27006-1 |
| What Is Delivered | An examination report containing an opinion | A shareable certificate and a confidential audit report |
| What Gets Tested | Selected controls, tested individually | The management system as a whole |
| How Long It Spans | A defined reporting period | A point-in-time audit inside a three-year cycle |
| How Often It Renews | Annually | Surveillance in years one and two, recertification in year three |
| How It Is Distributed | Under NDA | The certificate is shareable but the audit report is not |
What Does An Auditor’s Accreditation Add?
A certificate carries only as much weight as the body that issued it. An accreditation authority assesses certification bodies against ISO/IEC 17021-1, monitors their audits, and withdraws accreditation when standards slip.
Two accreditation authorities appear most often in enterprise review. The ANSI National Accreditation Board (ANAB) accredits certification bodies in the United States. ANAB maintains a searchable directory of accredited management systems certification bodies. The United Kingdom Accreditation Service (UKAS) does the same in the UK and is widely recognized internationally. UKAS publishes a directory of the bodies it accredits, plus CertCheck, a free database of the certificates those bodies issue.
What Do SOC 2 And ISO 27001 Cover When The Software Runs On-Premises?
Wowza Streaming Engine powers the Wowza Flowplayer OVP SaaS platform, but it can run wherever the deployment requires, including on-premises, in a private cloud, at the edge, or fully air-gapped. In those deployments, the operating organization runs the software, controls the network, manages the hosts, and holds the keys. What a vendor’s credentials cover is everything upstream of the install. This split follows a shared responsibility model where the operator owns the deployment and the vendor’s credentials cover the organization that builds, ships, patches, and supports what gets deployed.
How Do SOC 2 And ISO 27001 Shorten Security Reviews?
A SOC 2 Type II report answers the large majority of the questions in enterprise security reviews, in an independent auditor’s words, with the testing complete and documented. That includes questions about access control, change management, encryption, incident response, vendor management, and business continuity.
Holding a current report and certificate rarely satisfies a questionnaire fully. Rather, they carry a vendor through procurement triage quickly and replace weeks of correspondence with a document review. For regulated and public sector buyers, who cannot evaluate vendors without third-party assurances on file, these are even more critical.
Is Wowza ISO 27001 Certified?
Wowza is certified to ISO/IEC 27001:2022. A-LIGN Compliance and Security, Inc. issued the certificate, which runs from August 20, 2026 through August 20, 2029, with surveillance audits in between. A-LIGN holds ISO/IEC 27001 certification body accreditation from ANAB and UKAS. The certified scope covers the information security management system supporting the design, development, operation, and delivery of Wowza’s streaming software and managed video platforms, together with the supporting corporate functions and cloud infrastructure behind them.
Does Wowza Have A SOC 2 Type II Attestation?
Wowza has completed its 2026 SOC 2 Type II examination, covering the Security and Availability trust services criteria for the period 1 May 2026 through 31 July 2026. A-LIGN issued an unqualified opinion. The SOC 2 Type II report and ISO 27001 certificate are available on request by emailing security@wowza.com. Further details on Wowza’s security practices are on the Corporate Security Measures page.
Frequently Asked Questions
Is SOC 2 a certification?
No, SOC 2 is an attestation, not a certification. A licensed CPA firm examines a service organization’s controls under AICPA attestation standards and issues a report with a formal opinion.
What is the difference between SOC 2 Type 1 and Type 2?
A SOC 2 Type 1 engagement evaluates whether controls were suitably designed, as of a single date. A SOC 2 Type 2 engagement tests whether those controls were also operated effectively across a defined period, commonly three to twelve months. SOC 2 Type 1 documents a design, SOC 2 Type 2 documents performance over time. Enterprise security reviews generally ask for SOC 2 Type 2.
What does an unqualified SOC 2 opinion mean?
A SOC 2 unqualified opinion is the clean result of an attestation engagement. The auditor concluded that the description of the system was fairly presented, the controls were suitably designed, and they were operated effectively throughout the reporting period. An unqualified opinion speaks to the overall result.
What does ISO 27001 certification actually cover?
ISO/IEC 27001 certification covers an information security management system across the activities, services, and locations named in the certificate’s scope statement. It covers how an organization identifies risk, selects and operates controls, handles incidents, manages suppliers, and reviews performance on a defined cycle. It does not cover a product, and the rules governing certification bodies prohibit presenting it as product certification.
How long is an ISO 27001 certificate valid?
An ISO/IEC 27001 certificate is valid for 3 years from the date of issue. Surveillance audits in year 1 and year 2 confirm that the management system continues to operate as certified, and a full recertification audit takes place before the 3-year term expires.
Does a vendor’s SOC 2 report cover its SaaS platform?
Yes, when the platform is named in the report’s scope, a SaaS platform offered by a vendor is covered under their SOC 2 report. The vendor operates the platform, so the report covers how the vendor runs it.
Does a vendor’s SOC 2 report cover software hosted on customer infrastructure?
No, when an organization deploys a vendor’s software in its own environment, that organization operates the software and owns the controls around the deployment. A vendor’s SOC 2 report and ISO 27001 certificate cover the vendor’s own organization, including how the software is developed, reviewed, patched, released, and supported.
How can a certification body’s accreditation be verified?
ANAB publishes a public, searchable directory of accredited management systems certification bodies, and UKAS publishes a directory of the bodies it accredits, plus CertCheck, a free database of the certificates those bodies issue.
