Start with the commercial need. Is a particular customer waiting for a SOC 2 report? Does a contract require ISO 27001 certification? Are you trying to improve security across the organization or provide assurance about a specific service?
Clarify scope and timing
Ask which services, locations, and systems must be covered, what kind of assurance is accepted, and when it is needed. Check the people and evidence available before committing to a deadline.
Avoid doing two programs by default
Many controls can support both frameworks, but preparing for both immediately is not always necessary. Choose a first program based on the requirement, then design the underlying work so it can be reused if the business later needs the other.