Choosing an online voting provider isn’t just about features anymore. Security has become one of the biggest deciding factors for organisations running elections, AGMs, enterprise agreement ballots and member votes.

Committee members, directors and company secretaries are asking tougher questions than they were even a few years ago.

How is our voting data protected?
Has the provider been independently audited?
What evidence do they have that their security controls actually work?
Are they following recognised international standards?

They’re the right questions to ask.

Two terms you’ll increasingly come across are ISO/IEC 27001 and SOC 2 Type II. They often appear together on software providers’ websites, yet many people aren’t entirely sure what each one means—or whether having both actually makes a difference.

The short answer?

Yes, it does.

Although both demonstrate a strong commitment to information security, they serve different purposes and provide different types of assurance. Understanding the distinction can help your organisation make a far more informed decision when selecting an online voting platform.

Why Security Certifications Matter for Online Voting

When people participate in an election or AGM vote, they’re trusting the platform with far more than a simple yes-or-no response.

Depending on the election, the system may contain:

Protecting this information isn’t simply good practice—it supports good governance.

Australian organisations are also facing increasing expectations around cyber security, privacy and operational resilience. Boards are asking more detailed questions about third-party providers, while procurement teams often include security assessments as part of their vendor selection process.

Independent certification provides evidence that a provider’s security isn’t just self-declared. It has been reviewed by qualified external auditors against recognised standards.

What Is ISO/IEC 27001?

ISO/IEC 27001 is the world’s leading international standard for Information Security Management Systems (ISMS). It is jointly developed by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).

Rather than focusing on a single technical control, ISO 27001 requires organisations to establish a comprehensive management system for identifying, assessing and managing information security risks.

This includes areas such as:

Certification is only awarded after an accredited external certification body confirms that the organisation meets the requirements of the standard.

Importantly, certification doesn’t end there.

Organisations undergo regular surveillance audits and periodic recertification to demonstrate ongoing compliance.

What Is SOC 2 Type II?

SOC 2 stands for System and Organisation Controls 2.

Unlike ISO 27001, SOC 2 was developed by the American Institute of Certified Public Accountants (AICPA) and focuses on how organisations protect customer data through operational controls.

SOC 2 reports assess controls against one or more of the Trust Services Criteria, including:

For cloud software providers, Security is the mandatory criterion.

A SOC 2 audit examines whether appropriate controls exist—and whether those controls actually operate effectively over an extended period.

That’s where Type II becomes particularly valuable.

What’s the Difference Between Type I and Type II?

This is one of the most common questions organisations ask.

SOC 2 Type I

A Type I report looks at the design of security controls at a specific point in time.

Think of it as a snapshot.

The auditor confirms that the controls have been designed appropriately on the assessment date.

SOC 2 Type II

A Type II report goes significantly further.

Instead of reviewing a single day, auditors evaluate how those controls perform over a defined monitoring period—commonly several months.

Evidence is collected to determine whether controls consistently operated as intended throughout that period.

For organisations comparing providers, a Type II report generally provides stronger assurance because it demonstrates operational effectiveness rather than simply documenting control design.

SOC 2 vs ISO 27001: Are They the Same Thing?

No.

Although both focus on protecting information, they assess different aspects of security.

Many leading software companies pursue both because they complement one another.

ISO 27001 demonstrates that security is embedded into the organisation’s management processes.

SOC 2 Type II provides independent assurance that those controls actually function effectively in practice.

Together they provide stronger confidence than either standard alone.

Why Organisations Increasingly Look for Both

Cyber security expectations continue to mature.

Procurement teams, boards and governance professionals are asking suppliers for objective evidence rather than relying solely on security questionnaires.

Having both ISO 27001 certification and a SOC 2 Type II report demonstrates that an organisation has invested in:

This can significantly simplify vendor due diligence, particularly where organisations must assess third-party technology providers before engaging them.

Does Having These Certifications Mean a Platform Is Completely Secure?

No certification can guarantee that any organisation will never experience a cyber incident.

That’s an important distinction.

Security standards are designed to reduce risk, strengthen governance and encourage continual improvement—not eliminate every possible threat.

Cyber security requires ongoing investment, monitoring, testing and adaptation.

Certifications should therefore be viewed as strong indicators of a mature security program rather than absolute guarantees.

When evaluating any online voting provider, organisations should also consider:

Security is always a combination of technology, people and processes.

Why This Matters for Online Voting

Online voting systems handle highly sensitive governance processes.

For many organisations, a compromised election could have significant consequences, including:

That’s why security should be considered alongside usability and functionality—not afterwards.

A provider with recognised independent assurance demonstrates that protecting customer information forms part of its everyday operations rather than being treated as an afterthought.

How Vero Voting Supports Secure Governance

Security has always been central to how Vero Voting designs and operates its online voting platform.

Vero Voting is:

These independent assessments complement Vero Voting’s broader approach to election integrity, including secure voter authentication, comprehensive audit trails, Australian data hosting, encryption in transit and at rest, and governance-focused voting workflows designed for AGMs, member ballots, enterprise agreements and organisational elections.

For organisations conducting important governance decisions, these certifications provide additional confidence that security is embedded throughout the platform—not simply added as a feature.

Key Takeaways

SOC 2 Type II and ISO/IEC 27001 are often mentioned together because they address different but complementary aspects of information security.

ISO 27001 demonstrates that an organisation has implemented a structured, risk-based Information Security Management System that is independently certified against an internationally recognised standard.

SOC 2 Type II provides evidence that security controls have been independently tested and shown to operate effectively over time.

Neither replaces the other.

Together, they provide stronger assurance that a provider has invested in governance, risk management and operational security.

When selecting an online voting platform, asking whether a provider holds recognised independent certifications is no longer simply a “nice to have”. Increasingly, it’s becoming part of responsible governance and prudent supplier due diligence.

Sources

The following official and authoritative resources were referenced when preparing this article:

International Standards
ISO/IEC 27001:2022 – Information security management systems
https://www.iso.org/standard/27001.html
ISO – Information Security Management
https://www.iso.org/isoiec-27001-information-security.html

SOC 2
American Institute of Certified Public Accountants (AICPA) – SOC for Service Organisations
https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2
AICPA Trust Services Criteria
https://www.aicpa-cima.com/resources/article/trust-services-criteria

Australian Government & Authorities
Australian Cyber Security Centre (ACSC)
https://www.cyber.gov.au
ACSC Essential Eight
https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight
Office of the Australian Information Commissioner (OAIC)
https://www.oaic.gov.au
Privacy Act 1988
https://www.legislation.gov.au/Series/C2004A03712

Governance
Australian Institute of Company Directors (AICD) – Cyber Security Governance Principles
https://www.aicd.com.au