The frameworks people ask you about
Most compliance conversations start with an acronym somebody else chose. Here is what each one actually is, and who tends to ask for it — in a paragraph, not a whitepaper.
Worth knowing before you read on: these are not nine separate projects. Some are laws that apply to you whether or not anyone audits you, some are audits your customers demand, and some are structures you adopt by choice. They also overlap far more than their names suggest.
SOC 2
An independent auditor’s report on how you handle security, availability, and confidentiality — not a certificate you hang on a wall. A Type I describes your controls at a point in time; a Type II tests whether they actually operated over a period, usually three to twelve months. It exists because your customers’ procurement teams need someone other than you to vouch for you, which is why the request almost always arrives from a deal rather than a regulator.
ISO 27001
A certification against an international standard for running an information security management system — the governance around your controls as much as the controls themselves. An accredited body audits you, certifies you for three years, and comes back annually to check you have not drifted. European and multinational customers tend to ask for this where US customers ask for SOC 2, and the two overlap heavily.
HIPAA
US law, not a framework you get certified against. If you handle protected health information — as a provider or health plan, or as a vendor to one — the Security, Privacy, and Breach Notification Rules apply to you directly, enforced by HHS’s Office for Civil Rights. There is no official audit that clears you. What exists instead is a Business Associate Agreement obligating you to safeguards, and an investigation if something goes wrong.
CMMC / NIST SP 800-171
The Department’s mechanism for verifying that its supply chain protects federal contract information and controlled unclassified information. Level 1 covers fifteen basic safeguards; Level 2 covers all 110 NIST SP 800-171 controls, with your score posted in SPRS and affirmed annually by a named executive. Phase 1 self-assessment has been in force since November 2025, and it applies to most new solicitations.
PCI DSS
Not law and not government — a contractual standard the card brands impose through your acquiring bank. How you prove compliance scales with volume: smaller merchants complete a self-assessment questionnaire, larger ones get a full on-site report from a qualified assessor. Scope is the whole game here, because anything that touches cardholder data pulls itself into the assessment.
NIST CSF
A voluntary framework organized around six functions — govern, identify, protect, detect, respond, recover — that gives a security program a shape and a shared vocabulary. Nobody certifies you against it. Its value is as scaffolding: boards, insurers, and regulators increasingly want to see a recognized structure behind your program, and CSF is the one most often named.
GDPR & state privacy laws
A different axis from the security frameworks above: these govern personal data — what you may collect, why, how long you keep it, and what rights the individual has to see or delete it. GDPR reaches any organization handling EU residents’ data regardless of where you sit, and a growing patchwork of US state laws does something similar. Strong security controls do not satisfy them; they are a separate obligation.
CIS Controls
A prioritized set of technical safeguards, grouped into three implementation levels by organization size and risk. Where most frameworks tell you what outcome to achieve, CIS tells you what to configure — which makes it a common answer to "we know we need asset inventory and MFA, but what exactly do we do Monday morning?" Often the layer underneath a SOC 2 or CSF program rather than a target of its own.
SCF
The Secure Controls Framework is a meta-framework: one consolidated control set mapped to hundreds of authoritative sources, so a single control can satisfy its SOC 2, ISO 27001, HIPAA, and CMMC equivalents at once. It is the reason a second framework costs a fraction of the first. COPA.cloud is built on it — you maintain controls once, and the framework mappings follow.
How much do they overlap?
More than most people expect. Access control, encryption, logging, vulnerability management, vendor review, incident response, training — nearly every framework asks for these, in its own vocabulary and with its own evidence expectations. SOC 2 and ISO 27001 in particular cover much of the same ground with different governance wrapped around it, and HIPAA’s Security Rule reads as a subset of what either already requires.
The differences that matter are usually not the controls. They are scope (whose data, which systems), proof (self-attested, audited, or certified), and cadence (annual, three-year cycle, continuous). That is why running a separate program per framework is so expensive: you are re-documenting the same controls three times to satisfy three different proof standards.
Handled the other way — one control library, mapped outward — the second framework is largely a mapping exercise plus a short gap list. See why multi-framework compliance is the new normal for how that plays out in practice.
Start with the one you are being asked for
You do not need a nine-framework strategy. You need the framework standing between you and a contract — built on a control library that makes the next one cheap instead of starting over.