Management systems and control sets that protect the confidentiality, integrity and availability of information. 9 entries, 5 with a full guide.
Information security compliance is the evidence a customer asks for before trusting you with their data. Most enterprise procurement teams send a security questionnaire, and the fastest way to answer it is to point to an independent report or certificate.
The two most requested are ISO/IEC 27001, an international certifiable standard for an information security management system (ISMS), and SOC 2, an attestation report from a US CPA firm. Both are voluntary, but in B2B software they often decide whether you can sign a contract. Control catalogues such as NIST SP 800-53 sit underneath, describing the individual safeguards in detail.
Start with one management system, then map other standards to the same controls. One risk assessment, one set of policies and one evidence library can support ISO 27001, SOC 2 and customer questionnaires together.
ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection: Information security management systems (ISMS) requirements
Certifiable standardVoluntaryGlobal
ISO/IEC 27001 is the international standard for an information security management system (ISMS). It requires you to define a scope, assess information security risks, choose controls from Annex A (93 controls in four themes) or elsewhere, and run a cycle of monitoring, internal audit, management review and improvement. It is voluntary, but an accredited ISO 27001 certificate is the most widely recognised proof of security for IT companies worldwide.
Covers, who needs it and key requirements
What it covers
Governance of information security: scope, risk assessment and treatment, policies, Annex A controls (organisational, people, physical, technological), internal audit, management review and continual improvement.
Who needs it
IT service providers, software and SaaS companies, data centres, BPOs, fintechs and any organisation whose clients ask for independent proof of information security.
Why it matters
It answers most security questionnaires with one certificate, is recognised in every market and is often a precondition for enterprise, banking and government contracts.
System and Organization Controls 2 (SOC 2) report on controls relevant to security, availability, processing integrity, confidentiality or privacy
Attestation reportVoluntaryUS / global
SOC 2 is an independent attestation report, produced by a licensed CPA firm under AICPA standards, on how a service organisation's controls meet the Trust Services Criteria for security and, optionally, availability, processing integrity, confidentiality and privacy. A Type I report tests control design at a point in time; a Type II report tests operating effectiveness over a period, usually 6 to 12 months. It is the security report most US enterprise customers ask SaaS vendors for.
Covers, who needs it and key requirements
What it covers
Security (the mandatory common criteria CC1 to CC9: control environment, risk assessment, monitoring, logical and physical access, system operations, change management, risk mitigation) plus optional availability, processing integrity, confidentiality and privacy criteria.
Who needs it
SaaS, cloud, data and managed service providers that store or process customer data, especially those selling to US enterprises.
Why it matters
It is the default evidence enterprise security and procurement teams request, and a clean Type II report shortens security reviews.
Applies in
United States origin; used worldwide by companies selling to US-based customers
ISO/IEC 27701:2025 Information security, cybersecurity and privacy protection: Privacy information management systems (PIMS) requirements and guidance
Certifiable standardVoluntaryGlobal
ISO/IEC 27701 sets requirements for a privacy information management system (PIMS) that governs how an organisation processes personally identifiable information (PII), as a controller, a processor or both. The 2025 edition is a standalone standard that no longer has to sit on top of ISO 27001, with controls for PII controllers and processors that map well to the GDPR and similar laws. It is voluntary and certifiable.
Covers, who needs it and key requirements
What it covers
Privacy governance, roles of PII controller and processor, privacy risk assessment, lawful basis and consent records, data subject rights, privacy by design, transfers, sub-processors, breach handling and records of processing.
Who needs it
SaaS and cloud providers, IT service providers and BPOs that process client personal data, and any company that wants independent proof of privacy controls for GDPR, DPDP or customer audits.
Why it matters
Enterprise clients and regulators look for evidence of privacy accountability. A certified PIMS answers privacy due diligence questions and supports processor obligations in data processing agreements.
Payment Card Industry Data Security Standard, version 4.0.1
Industry standardContractually requiredGlobal
PCI DSS is the security standard for any business that stores, processes or transmits payment card data, or can affect its security. Version 4.0.1 has 12 principal requirements, from network security controls and protecting stored account data to vulnerability management, access control, logging and testing. Compliance is validated annually through a QSA's Report on Compliance or a Self-Assessment Questionnaire, depending on your merchant or service provider level.
Covers, who needs it and key requirements
What it covers
The cardholder data environment and connected systems: network security, secure configurations, protection of stored and transmitted account data, malware protection, secure software, access control, MFA, logging, security testing and security policies.
Who needs it
Merchants, payment service providers, payment gateways, e-commerce and SaaS platforms that handle card payments, and IT service providers with access to cardholder data environments.
Why it matters
Acquiring banks require it, and a breach without compliance exposes you to fraud liability, fines and losing card acceptance.
NIST Special Publication 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations
FrameworkMandatory if in scopeUS federal
NIST SP 800-53 Revision 5 is the US government's catalogue of security and privacy controls, organised into 20 families from Access Control to Supply Chain Risk Management. Federal agencies must select controls from it using the Low, Moderate or High baselines in SP 800-53B, and FedRAMP builds on it for cloud services. Private companies use it as the most detailed public control library. Release 5.2.0 in August 2025 strengthened software update and patching controls.
Covers, who needs it and key requirements
What it covers
Twenty control families: AC, AT, AU, CA, CM, CP, IA, IR, MA, MP, PE, PL, PM, PS, PT, RA, SA, SC, SI and SR, covering technical, operational, management, privacy and supply chain safeguards.
Who needs it
US federal agencies, federal contractors and cloud providers pursuing FedRAMP, plus organisations that want a detailed control catalogue for high-assurance systems.
Why it matters
It is the control foundation for FISMA, FedRAMP and many state and sector programmes, and the reference most other frameworks map to.
Applies in
United States (federal); used worldwide as a reference catalogue
Categorise the system (FIPS 199) and select a Low, Moderate or High baseline (SP 800-53B)
Tailor controls and document them in a System Security and Privacy Plan
Implement controls across the 20 families
Assess controls using SP 800-53A procedures
Obtain authorization (ATO) based on residual risk
Continuously monitor controls and update plans of action and milestones (POA&M)
ISO 27017
ISO/IEC 27017:2015 Code of practice for information security controls based on ISO/IEC 27002 for cloud services
Certifiable standardVoluntaryGlobal
ISO/IEC 27017 adds cloud-specific guidance to the ISO 27002 controls and seven extra controls for cloud service providers and customers, such as shared roles and responsibilities, removal of customer assets, segregation in virtual environments, virtual machine hardening and monitoring of cloud services. It is usually assessed as an extension to an ISO 27001 certification and shows customers how a cloud or SaaS provider splits security responsibilities with them.
Covers, who needs it and key requirements
What it covers
Cloud-specific implementation guidance for ISO 27002 controls and additional controls on shared responsibility, customer asset removal, tenant segregation, administrator operations and cloud monitoring.
Who needs it
Cloud service providers, SaaS vendors and managed hosting providers, and enterprise cloud customers.
Why it matters
It answers the shared-responsibility questions cloud customers ask and strengthens an ISO 27001 certificate for cloud services.
Document shared roles and responsibilities between provider and customer
Segregate customer environments in shared virtual infrastructure
Harden virtual machines and protect administrative operations
Return or securely remove customer assets at contract end
Give customers the ability to monitor relevant cloud activity
NIST SP 800-171
NIST SP 800-171 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
FrameworkMandatory if in scopeUS federal contracts
NIST SP 800-171 defines the security requirements contractors must meet to protect Controlled Unclassified Information (CUI) in their own systems. Revision 3 (May 2024) has 97 requirements in 17 families, but US defence contracts continue to assess against the 110 requirements of Revision 2 under a class deviation, including for CMMC Level 2. It is required through DFARS 252.204-7012 and other federal contract clauses.
Covers, who needs it and key requirements
What it covers
Access control, awareness, audit, configuration, identification and authentication, incident response, maintenance, media, personnel, physical, risk, security assessment, system and communications protection, and system integrity for CUI.
Who needs it
US federal and defence contractors and subcontractors that store, process or transmit CUI.
Why it matters
It is a contractual condition for handling CUI and the basis of CMMC Level 2.
Implement the 800-171 requirements (Rev. 2 for current DoD assessments)
Document a System Security Plan and plans of action
Report a self-assessment score in SPRS where DFARS 252.204-7019 applies
Report cyber incidents to DoD within 72 hours (DFARS 252.204-7012)
HITRUST CSF
HITRUST Common Security Framework and e1, i1 and r2 assessments
Certifiable standardVoluntaryUS healthcare
HITRUST is a certifiable security and privacy framework widely used by US healthcare organisations and their vendors. The HITRUST CSF harmonises requirements from HIPAA, NIST, ISO and others, and offers three assessment levels: e1 (essential, one year), i1 (implemented, one year) and r2 (risk-based, two years). Assessments are performed by authorised external assessors and quality-checked by HITRUST before certification.
Covers, who needs it and key requirements
What it covers
A harmonised control framework covering information protection, access control, risk management, endpoint and network protection, incident management and privacy, mapped to HIPAA and other standards.
Who needs it
Health tech, healthcare SaaS, revenue cycle and IT vendors serving US hospitals and payers.
Why it matters
Many US health systems and payers ask vendors for HITRUST certification as proof of HIPAA-aligned security.
Applies in
United States origin; used mainly in US healthcare
TISAX is the automotive industry's assessment and exchange mechanism for information security, run by the ENX Association on behalf of the German automotive association VDA. Suppliers are assessed by accredited audit providers against the VDA ISA catalogue, which is based on ISO 27001 with automotive extensions for prototype protection and data protection, and receive labels they share with OEMs through the ENX portal. Car makers commonly require it from IT and engineering suppliers.
Covers, who needs it and key requirements
What it covers
Information security, prototype protection and data protection controls from the VDA ISA catalogue at assessment levels 1 to 3.
Who needs it
IT, software and engineering suppliers to automotive OEMs and Tier 1 suppliers.
Why it matters
Automotive customers often make a TISAX label a contract condition.
Applies in
Worldwide, mainly suppliers to European (especially German) automotive companies
