Compliance Frameworks

Compliance means meeting the security requirements set by laws, regulations, or industry standards. Frameworks give organizations a structured, recognized set of controls to implement and prove.

Compliance is not the same as security, but a good framework drives real improvements.

ISO/IEC 27001 is an international standard for an ISMS (Information Security Management System). It is risk-based: you identify risks, select controls (from Annex A), and continuously improve.

• Certification is issued by accredited auditors.
• Emphasis on management process, not just technology.

SOC 2 (System and Organization Controls) is an attestation report, common for SaaS providers, based on the AICPA Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy.

• Type I: controls designed at a point in time.
• Type II: controls operating effectively over a period.

PCI DSS (Payment Card Industry Data Security Standard) applies to any organization that stores, processes, or transmits cardholder data. It is prescriptive, with concrete requirements.

• Encrypt cardholder data and use network segmentation.
• Restrict access on a need-to-know basis.
• Regularly test and monitor.

You will also encounter:

• GDPR: EU data protection and privacy.
• HIPAA: US healthcare data.
• NIST CSF / 800-53: US framework and control catalog.

Many overlap, so controls can be mapped across frameworks.

Frameworks fall on a spectrum:

• Risk-based (ISO 27001): you choose controls proportional to your risks.
• Prescriptive (PCI DSS): specific mandatory requirements regardless of context.

Knowing the type tells you how much room you have to tailor controls.

Defining scope is the first practical step. Scope sets which systems, data, and processes the framework applies to.

For PCI DSS, segmentation can shrink scope (and cost) by isolating cardholder systems from the rest of the network.

Frameworks organize requirements into controls, often grouped into families such as access control, cryptography, logging, and incident response.

Each control needs an owner, an implementation, and evidence that it works.

Outputs differ by framework:

• Certification (ISO 27001): a pass/fail certificate from an accredited body.
• Attestation (SOC 2): an auditor opinion report shared under NDA.
• Validation (PCI DSS): an AOC and/or ROC from a QSA.

Compliance is not a one-time event. Standards expect ongoing operation, periodic reassessment, and improvement.

• ISO 27001 requires surveillance audits.
• SOC 2 Type II covers a window of months.
• PCI DSS requires quarterly scans and annual assessment.

Most organizations face several frameworks at once. Build a control mapping so one well-implemented control (e.g. MFA) satisfies the matching requirement across ISO 27001, SOC 2, and PCI DSS at the same time, avoiding duplicate work.

Match the framework to its nature.

Compliance frameworks structure and prove security:

• ISO 27001 = risk-based ISMS certification.
• SOC 2 = Trust Services attestation for service providers.
• PCI DSS = prescriptive standard for cardholder data.
• Define scope, assign control owners, and map overlapping controls for efficiency.