Information security standards are the frameworks a customer, auditor or regulator uses to check that you protect data in a managed, repeatable way. For most IT and SaaS companies the choice is between an ISO/IEC 27001 certificate, a SOC 2 report, or both. Neither is required by law, but enterprise buyers often make one of them a condition of the contract.
5 items in this category
5 related from other categories
Oct 30, 2026 statuses last checked
At a glance
Information security compliance compared
How the items in this category differ on the question that matters first: do you have to, or do you choose to?
Information security management systems: requirements
ISO/IEC 27001 is the international standard for an information security management system (ISMS). It asks you to define a scope, assess information security risks, choose controls to treat them (Annex A lists 93), and keep improving through internal audits and management review. Accredited certification bodies audit against it and issue a three-year certificate with yearly surveillance audits. It is voluntary, but enterprise and public sector buyers often require it.
What it covers, who needs it and why
What it covers
Governance of information security: risk assessment and treatment, policies, roles, people, physical and technical controls, supplier security, incident management, continuity and continual improvement.
Who needs it
Software and SaaS companies, IT service and managed service providers, data centers and any organization whose customers ask for independent proof of security.
Why it matters
It is the most widely recognized security certificate in tenders and vendor questionnaires outside the US, and its risk-based structure is the base that ISO 27701, 27017, 27018 and 42001 build on.
Key objectives
Identify and treat information security risks in a defined scope
Select and justify controls in a Statement of Applicability
Prove the system works through internal audit and management review
Improve continually and correct nonconformities
Mandatory or voluntary
Voluntary, with independent certification.
Owner
ISO and IEC (JTC 1/SC 27)
Current version
ISO/IEC 27001:2022 with Amendment 1:2024. Certificates to the 2013 edition expired on 31 October 2025.
ISO/IEC 27002 is the companion guidance to ISO 27001. It describes each of the 93 information security controls in detail: the purpose, how to implement it and what to consider. The 2022 edition groups the controls into four themes (organizational, people, physical and technological) and adds attributes so you can sort them by purpose. You cannot be certified to ISO 27002; you use it to implement the Annex A controls of ISO 27001 well.
What it covers, who needs it and why
What it covers
Implementation guidance for 37 organizational, 8 people, 14 physical and 34 technological controls, including threat intelligence, cloud services, secure coding and data masking.
Who needs it
Teams implementing ISO 27001, security leads writing policies, and anyone mapping controls between frameworks.
Why it matters
Auditors read Annex A controls with ISO 27002 in mind, so it tells you what a reasonable implementation of each control looks like.
Key objectives
Explain the intent of each control
Give practical implementation guidance
Let organizations filter controls by attribute (control type, security property, concept)
System and Organization Controls 2 report on controls relevant to security, availability, processing integrity, confidentiality or privacy
SOC 2 is an independent report, issued by a licensed CPA firm, on the controls a service organization runs to meet the AICPA Trust Services Criteria. Security is always in scope; availability, processing integrity, confidentiality and privacy are added when relevant. A Type I report covers the design of controls at one date. A Type II report also tests whether they operated effectively over a period, usually 3 to 12 months. It is an attestation, not a certificate.
What it covers, who needs it and why
What it covers
Controls over the system that delivers your service: governance and risk, access, change management, operations and monitoring, incident response, vendor management and any additional criteria you choose.
Who needs it
SaaS and cloud companies, IT service providers and data processors that sell to US and enterprise customers.
Why it matters
US enterprise buyers often require a current SOC 2 Type II report before they sign or renew, and it replaces many custom security questionnaires.
Key objectives
Describe the system and its boundaries
Show controls meet the selected Trust Services Criteria
Prove controls operated over time (Type II)
Give customers and their auditors independent assurance
Mandatory or voluntary
Voluntary, with an independent CPA report.
Owner
AICPA (American Institute of Certified Public Accountants)
Current version
Trust Services Criteria (2017), with points of focus revised in 2022. Reports follow the AICPA SOC 2 guide.
System and Organization Controls 1 report on controls relevant to user entities' internal control over financial reporting
A SOC 1 report tells a customer's financial auditor whether a service provider's controls can be relied on for the customer's financial reporting. It matters when your system processes transactions, payroll, billing or other data that ends up in a customer's financial statements. Like SOC 2, it comes as Type I (design at a date) or Type II (operating effectiveness over a period) and is issued by a CPA firm. It is not a security report and does not replace SOC 2.
What it covers, who needs it and why
What it covers
Control objectives you define around transaction processing and the IT general controls that support them (access, change management, operations).
Who needs it
Payroll, billing, payment, fund administration, ERP hosting and other providers whose output affects customers' financial statements, often at the request of SOX-regulated customers.
Why it matters
Without one, a customer's auditor may have to test your controls directly, which is slow and disruptive for both sides.
Key objectives
Describe the service and control objectives
Show controls are designed to meet them
Test operating effectiveness over a period (Type II)
UK government-backed certification of five basic technical security controls
Cyber Essentials is a UK government-backed scheme that certifies five technical controls against common internet attacks: firewalls, secure configuration, user access control, malware protection and security update management. The basic level is a verified self-assessment. Cyber Essentials Plus adds a hands-on technical audit by an assessor. Certificates last 12 months. Many UK central government contracts that handle personal or sensitive information require it.
What it covers, who needs it and why
What it covers
Internet-connected devices, servers, cloud services and user accounts within the scope you define, against five technical control areas.
Who needs it
Any organization selling to UK government, and UK businesses whose customers or insurers ask for a baseline security certificate.
Why it matters
It is cheap and quick compared with ISO 27001, and for some UK public contracts it is a bid requirement.
Key objectives
Block common, low-skill internet attacks
Set a verifiable security baseline
Give buyers a simple yes or no check
Mandatory or voluntary
Voluntary, with independent certification.
Owner
UK National Cyber Security Centre (NCSC), delivered through IASME
Current version
Requirements for IT Infrastructure v3.3 with the "Danzell" question set, used for assessments from April 2026.
Privacy information management systems: requirements and guidance
ISO/IEC 27701 sets requirements for a privacy information management system (PIMS) for organizations that act as PII controllers, PII processors or both. The 2019 edition was an extension of ISO 27001; the 2025 edition can be certified on its own, though many companies still combine the two. It translates privacy principles into management system clauses and controls that map to laws such as the GDPR. Certification is voluntary and done by accredited bodies.
What it covers, who needs it and why
What it covers
How you govern personal data as a controller or processor: roles, records of processing, privacy risk, rights requests, processor obligations, transfers and breach handling.
Who needs it
SaaS companies, data processors and IT service providers that want an auditable, international proof of privacy management.
Why it matters
It gives customers and regulators a structured way to see privacy accountability, and its mapping to GDPR helps in procurement.
Key objectives
Run privacy as a managed system
Define controls for controllers and processors
Demonstrate accountability under privacy laws
Mandatory or voluntary
Voluntary, with independent certification.
Owner
ISO and IEC (JTC 1/SC 27)
Current version
ISO/IEC 27701:2025, now a standalone management system standard instead of an extension that required ISO 27001.
Code of practice for information security controls for cloud services
ISO/IEC 27017 adds cloud-specific guidance to the ISO 27002 controls and seven extra controls for cloud services, for both cloud service providers and cloud customers. It covers shared responsibilities, removal of customer assets at contract end, segregation in virtual environments, virtual machine hardening, administrator operations, monitoring and network alignment. It is a code of practice, so organizations are certified to ISO 27001 with 27017 controls in the Statement of Applicability rather than to 27017 alone.
What it covers, who needs it and why
What it covers
Cloud provider and customer responsibilities, multi-tenancy, virtualization, admin access, logging and contract-end data return or deletion.
Who needs it
SaaS, PaaS and IaaS providers, and companies running significant workloads in public cloud.
Why it matters
It answers the cloud-specific questions that a plain ISO 27001 certificate leaves open for buyers.
Cloud Security Alliance Security, Trust, Assurance and Risk registry
CSA STAR is a public registry where cloud providers publish their security posture against the Cloud Controls Matrix (CCM), a cloud-specific control framework. Level 1 is a self-assessment using the CAIQ questionnaire, free to publish. Level 2 adds third-party assurance, either STAR Certification (with ISO 27001) or STAR Attestation (with SOC 2). Buyers use the registry to pre-screen vendors, and the CCM maps to ISO 27001, NIST and PCI DSS.
What it covers, who needs it and why
What it covers
Cloud controls across 17 domains, including application security, data security, identity and access, infrastructure, logging and supply chain.
Who needs it
SaaS and cloud providers that want a public, cloud-specific trust signal.
Why it matters
A published CAIQ answers many security questionnaires in advance, and Level 2 combines with audits you may already have.
Key objectives
Make cloud security transparent
Give a cloud-specific control set
Reuse existing ISO and SOC audits
Mandatory or voluntary
Voluntary, with independent certification.
Owner
Cloud Security Alliance (CSA)
Current version
Cloud Controls Matrix (CCM) v4.1, with a published transition timeline from v4.0.
PCI DSS is the security standard for any organization that stores, processes or transmits payment card data, or can affect the security of that environment. It has 12 principal requirements, from network security and secure configuration to access control, logging, testing and policy. It is not a law; it is required by contracts with the card brands, acquirers and payment partners. Depending on volume and role you validate with a self-assessment questionnaire or a report on compliance by a QSA.
What it covers, who needs it and why
What it covers
The cardholder data environment and every system connected to it or able to affect it, including service providers such as hosting, payment and SaaS vendors.
Who needs it
Merchants, payment processors, and IT and SaaS providers whose systems touch card data or the cardholder data environment.
Why it matters
Non-compliance can mean fines from the acquirer, higher fees or losing the ability to take cards, plus liability after a breach.
Key objectives
Protect stored and transmitted card data
Maintain secure systems and software
Restrict and monitor access
Test security regularly and keep a security policy
Mandatory or voluntary
Mandatory once a contract, card brand or government buyer requires it.
Owner
PCI Security Standards Council; enforced by the card brands and acquiring banks
Current version
PCI DSS v4.0.1 (June 2024). The future-dated requirements of v4.0 became mandatory on 31 March 2025.
Certifiable standard United States, used internationally
HITRUST CSF
HITRUST Common Security Framework and assessment program
The HITRUST CSF is a certifiable framework that combines requirements from HIPAA, NIST, ISO, PCI DSS and other sources into one control set, scaled by risk factors. HITRUST offers three assessment levels: e1 (essential, 1 year), i1 (implemented, 1 year) and r2 (risk-based, 2 years). Assessments are done by authorized external assessors and quality-checked by HITRUST before certification. Many US health systems and payers ask vendors for HITRUST certification.
What it covers, who needs it and why
What it covers
Information security and privacy controls across 14 control categories, tailored to the organization's size, systems and regulatory factors.
Who needs it
Health tech, SaaS and IT vendors selling to US hospitals, health plans and pharmacy benefit managers.
Why it matters
One certification can satisfy many healthcare customers' security reviews and maps to HIPAA requirements.
Key objectives
Harmonize multiple frameworks
Scale controls to risk
Give a reliable, centrally reviewed certification
Mandatory or voluntary
Voluntary, with independent certification.
Owner
HITRUST Alliance
Current version
HITRUST CSF v11.x, updated several times a year; the current release is re-checked at every review.
Train your team on information security requirements
Most of these frameworks expect trained staff and records to prove it. LMS Advisor assigns the right courses by role, sends reminders, renews certificates on schedule and keeps an audit trail you can export.
Due dates, reminders and overdue reports for mandatory courses
Certificates that expire and renew on your retraining cycle
CSV, Excel and PDF exports of who completed what, and when
LMS Advisor is our product. It runs your training and keeps the records. It does not certify you against any standard.
Book a demo before Dec 1, 2026 and your quote comes with 30% off your first year of LMS Advisor: courses, proctored exams, certificates and AI authoring in one platform, in our cloud or on your own server.
Offer ends Dec 1, 2026, 11:59 PM ET
Cloud or self-hosted, proctoring included
The discount is applied in your written quote
We use cookies to see how visitors use this site and to measure our ads. Choose Continue to allow them, or Reject to browse without them. Privacy policy
LMS Advisor AI
AI product consultant
You're chatting with an AI. Answers can be wrong, so please don't type personal data here. Privacy ·
