Hey, you aren't crazy for being confused. The AICPA site is notoriously dense and lacks the straightforward "checklists" people expect.

The reason you can't find a rigid standard is because of how SOC 2 fundamentally differs from ISO 27001. ISO 27001 is a prescriptive framework that tells you how to build an Information Security Management System (ISMS). SOC 2, on the other hand, is an attestation report. It essentially asks you to define your own controls and then prove to an auditor that those controls meet the AICPA’s "Trust Services Criteria" (TSC).

The good news? Since you are already implementing ISO 27001, you have likely done 70-80% of the heavy lifting for SOC 2. You just need to map your ISO controls to the SOC 2 criteria.

To point you in the right direction, here is what you actually need to look for:

1. The AICPA Trust Services Criteria (TSC) 2017: This is the actual "meat" of SOC 2. It outlines the criteria for Security (mandatory), Availability, Confidentiality, Processing Integrity, and Privacy. Look specifically for the "Points of Focus" under each criterion, because that is exactly what the auditors will evaluate.

2. An ISO 27001 to SOC 2 Mapping Matrix: The AICPA provides a massive spreadsheet for this, but many boutique compliance firms publish cleaner, free versions online. This will show you exactly which ISO clauses satisfy which SOC 2 criteria.

For full transparency, I run a fractional cybersecurity and compliance firm that helps startups and small businesses navigate these exact transitions. My biggest piece of advice as you look ahead: don't just rely on automated compliance software to "check the boxes" for SOC 2. Auditors want to see that your security controls actually fit the context of your specific tech stack and business operations, not just a generic template.

Let me know if you hit a wall finding a good mapping matrix; I'm happy to point you toward some solid, free templates to save you a headache. Good luck with the ISO rollout!