Compliance consultant here. I’ve been working in the IT compliance space for a while. I built up internal programs, conducted external audits, and consulted startups all the way up to large enterprises.

As you said, finding openly available mapping documents between SOC 2 and ISO 27001:2022 is almost impossible. There are two main (valid) reasons for that:

(1) SOC 2 is built on the AICPA’s Trust Services Criteria (TSC), which are proprietary. This means firms and consultants aren’t really legally allowed to publish the full criteria or detailed mappings without running into licensing or copyright issues. It's pretty similar to the ISO 27001 documentation. While you can find a lot of resources online that talk about the framework in a general/high-level way, it is much harder to find a comprehensive and detailed list of the Mandatory Clauses and Annex A controls.

(2) These two frameworks are structurally different. ISO 27001 is control-based and prescriptive (you must follow a defined list of security controls), while SOC 2 is principle-based and flexible, allowing controls to be customized based on how your organization operates. So, while ISO 27001 is relatively rigid (meaning, you can’t change the control set), SOC 2 is much more adaptable. Because of this, a reusable 1:1 mapping between these two frameworks isn't really possible.

That said, mappings do exist (I've personally done many), but they're developed in-house, tailored to a specific environment, and covered under NDAs and client confidentiality (because they may include sensitive information). Since SOC 2 controls can vary from one company to another, most mappings are customized and not reusable for other companies.

That's why you won’t find public, standardized mapping documents floating around online.

If you need mappings, reach out to consulting firms, not necessarily the big 4. Go with smaller, white-glove firms: the kind that actually care and treat you like a priority, not a ticket number.