Services
The growing number of security standards out there, each with their own acronyms and jargon, can seem overwhelming—but they don't have to be. We want to help provide some clarity. Here's an overview of five of the most common security standards.
These standards aren’t targeted towards small organizations, but many provide a useful framework for a small business to transform its IT security policy into a robust security program, allowing it to swim in a bigger customer pool. Others apply to specific industries. Read on to get an understanding of each standard's purpose, structure, to whom it applies, and what it means to be "certified."
ISOISO (International Organization for Standardization) is an independent, non-governmental international organization that develops and publishes standards for various industries and sectors, including cybersecurity. 27001 is a set of processes and guidelines any organization can use to develop its information security management system (ISMS). It's broad and flexible enough to work for organizations of any size, industry, or stage of information security maturity. ISO 27001 helps organizations step through each phase of setting up an ISMS. ISO 27001 is widely used by companies with an international footprint and is desirable for U.S.-based companies looking to expand to the EU and beyond.
The ISO 27001 standard opens with eleven clauses, the first four of which provide the standard's foundation and definitions. The last seven specify the phases and policies required for certification—everything from initial assessment to implementation to continuous improvement.
The second part of ISO 27001 is Annex A. Annex A contains 114 controls divided into 14 categories. While each organization needs to implement only those controls that make sense for its specific threat model, it needs to document why it's made the choices it has. The ISO 27001's approach to its control list adds to its prescriptive yet adaptable nature, making it a good starting place for organizations that don't yet have a formal ISMS.
Certification isn't required. An organization can use the ISO 27001 guidelines to create an initial ISMS framework to build upon and improve its security maturity.
As with other security frameworks, there are specific steps to obtain validation to the standard (which requires an audit by an approved third-party). Obtaining the standard from the ISO governing body costs about $150. Preparing for and navigating the formal audit process can be complicated and time-consuming, as you need to address each control with supporting documentation and evidence. Obtaining an ISO 27001 certification requires engaging with an ISO-approved auditing firm.
In our experience, even with the ability to adapt the applicable controls, ISO 27001 audits require more specific preparation than other audits.
NIST 800-53NIST 800-53 is a special publication by the National Institute of Standards and Technology (NIST) that provides a catalog of security and privacy controls for federal information systems and organizations. The publication outlines security requirements and guidelines for the selection, implementation, and assessment of security controls to protect the confidentiality, integrity, and availability of information systems. is a widely used standard that includes a base of about 200 controls across 18 control areas. It is publicly available and widely used by federal and state governments. Some states and agencies have developed their own audit processes around NIST 800-53, but there is no accredited body that can certify you with NIST 800-53 compliance.
NIST 800-171NIST 800-171 is a set of security requirements published by the National Institute of Standards and Technology (NIST) that applies to non-federal organizations that handle controlled unclassified information (CUI). NIST 800-171 compliance is mandatory for organizations that contract with the US federal government and handle CUI, and failure to comply can result in penalties and loss of business opportunities. is a closely related public standard, with many of the same controls, that applies to federal contractors or subcontractors organizations that handle or generate Controlled Unclassified Information (CUI). CUI is information that requires safeguarding or dissemination controls required by law, regulation, and/or policy but which is not regulated by more stringent requirements such that it is classified. NIST 800-171 is a companion standard to NIST 800-53, which defines a control library and baselines for federal agencies. NIST 800-171 doesn't require external certification. Contractors are expected to self-assess and attest that they meet its standards or report their assessment scores. If you're a contractor, it's also your responsibility to ensure that all your subcontractors with access to CUI comply with NIST 800-171. Usually, you will know if you need to meet NIST 800-171 requirements because your customer or parent vendor will tell you. The Department of Defense must periodically review a DoD contractor's compliance with the standard's security requirements.
NIST 800-171 covers 14 categories (or requirement families) of controls. As is the case with many security standards, these categories/families cover common security areas such as access control, personnel security, and risk assessment. A combined total of 110 security controls are prescribed.
An organization can start by implementing a set of baseline controls, as identified under the standard. From there, it can layer on enhanced controls to achieve a more robust level of security, as outlined in NIST SP 800-172.
While NIST 800-171 and 800-53 provide a helpful framework with which any organization can protect its own information. Like ISO 27001, the assessment and documentation standards published by NIST provide a solid foundation on which an organization can establish an information security program and mature it over time. The standards also provide detailed guidance and methodology for conducting self-assessments and creating action plans.
The NIST Cybersecurity Framework (CSF) can be used build a security program with an eye toward risk across several common security functions. NIST CSFNIST CSF (Cybersecurity Framework) is a set of guidelines and best practices for organizations to manage and reduce cybersecurity risks. The NIST CSF includes five core functions - Identify, Protect, Detect, Respond, and Recover - which serve as a foundation for developing and improving an organization's cybersecurity posture. defines the following functions:
Each of the functions includes a number of categories and subcategories. Something extremely useful about the NIST CSF structure is that you can use different standards in what it calls Informative References to get very specific about a particular risk area. NIST CSF also defines tiers which allow you to self-assess your maturity level within the controls and build a roadmap from your current state to your target. The tiers are:
NIST CSF is used by many states’ Departments of Education as a common standard. However, it isn’t exactly meaningful to audit against NIST CSF. It is more of a useful tool for self-assessing and building a roadmap.
Introduced in 2020, the CMMC improves and standardizes the cybersecurity requirements for organizations in the Defense Industrial Base (DIB). An organization is part of the DIB if it contracts directly with the DoD or is in the supply chain for another DIB organization. By 2026, any organization that wants to be in the DIB sector must have some level of CMMC certification.
The CMMC model centralizes standards for federal contractors from various sources and then adds some new controls. Where the CMMC is especially interesting is its maturity-based certification model.
An organization can be certified at one of five levels, each requiring a higher level of cybersecurity maturity. CMMC describes each level based on the maturity of its processes and practices. Using CMMC language, a level 1 organization performs basic cyber hygiene. "Perform" describes a level 1 organization's degree of process maturity. "Basic cyber hygiene" represents the maturity level of its practices. The rest of the levels are as follows:
The CMMC includes 171 practices mapped across 17 domains and the five maturity levels. The domains include those found in NIST SP 800-171, plus three more:
Within each domain, the CMMC outlines a set of processes and capabilities required for certification at each maturity level. These are cumulative. Level 1 certification covers 17 practices, while organizations that want a level 5 CMMC compliance certification will need to cover all 171.
The CMMC Certification Accreditation Body (CMMC-AB) has begun certifying the third-party organizations approved to conduct CMMC certifications. Organizations that are or plan to be in the DIB should start preparing for certification now.
We generally recommend that you start with Level 1 and work up to Level 3 as a near-term practical use of CMMC. Level 3 demonstrates a strong but achievable level of security for most small and mid-sized firms. Levels 4 and 5 require dedicated security teams with very advanced capabilities.
SOCService Organization Controls (SOC) are a set of standards developed by the American Institute of Certified Public Accountants (AICPA) to help organizations assess and report on the effectiveness of their internal controls. SOC reports provide assurance to customers and stakeholders that service organizations have appropriate controls in place to protect sensitive data and assets. 2 is a security auditing process defined by the American Institute of CPAs (AICPA) and applies to service organizations. Such organizations often store sensitive organizational and personal data about their customers, either on-premise or in the cloud. SOC 2 audits assess the organization's processes and systems to determine if it's meeting its obligation to keep client and customer data secure.
Certified external auditors conduct SOC 2 audits. The goal is to obtain a SOC 2 report that attests the organization's security program meets its standards for protecting the security, availability, processing integrity, confidentiality, and/or privacy of sensitive information. SOC 2 groups its controls into five Trust Service CriteriaTrust Service Criteria (TSC) are a set of standards developed by the American Institute of Certified Public Accountants (AICPA) to evaluate the effectiveness of controls over information and systems. TSC cover areas such as security, availability, processing integrity, confidentiality, and privacy. These criteria are used in SOC 2 and SOC 3 audits, which assess the controls and processes of service organizations that provide services to other businesses. (TSCs), which each cover the following issues:
There are two types of audits to assess an organization's level of SOC 2 compliance. A SOC 2 Type 1 audit and report assess the processes in place on a given day. A SOC 2 Type 2 audit is conducted over a time interval, typically three to twelve months. The SOC 2 Type 2 report assesses whether the security systems and processes have been followed during the period under audit based on a review of evidence provided. If they are, the SOC 2 report "attests" that the organization's security program implements the controls that satisfy the TSC criteria for which it’s being audited. An organization doesn't need to request an audit of all Trusted Services Criteria. It can start with the TSCs that are most important to its customer base and build from there.
For a more detailed look, read our detailed guide to SOC 2 compliance requirements.
SOC 2 Type 2SOC 2 Type 2 is a type of Service Organization Control (SOC) report that evaluates the effectiveness of an organization's controls related to security, availability, processing integrity, confidentiality, and privacy over a period of time, typically six to twelve months. These reports are based on the Trust Services Criteria (TSC) developed by the AICPA and cover both the design and operating effectiveness of a service organization's systems, processes, and procedures. compliance is extremely beneficial for smaller technology companies. Many larger firms (particularly in North America) have started requiring evidence of SOC 2 compliance as part of their vendor management process.
The CMMC and NIST 800-171 standards are intended for specific types of companies. If you do business with federal agencies or DoD specifically—or if you subcontract with federal contractors—you need to comply with these standards. CMMC compliance can cover much of the NIST 800-171 compliance, depending on the level of CMMC certification you achieve.
If you're a SaaSSaaS stands for Software as a Service, which is a cloud computing model that delivers software applications over the internet as a subscription-based service. With SaaS, users can access software applications and data from anywhere with an internet connection, without the need for on-premise installation or maintenance. SaaS providers manage the infrastructure, security, and maintenance of the software application, freeing users from the burden of software updates, patches, and backups. company or other service provider that manages client data, you don't need to be SOC 2 compliant to operate. However, working from a SOC 2 compliance checklist will go a long way towards a security program that genuinely protects your customers. Since many potential vendors, customers, and partners want to see a level of SOC 2 compliance, getting a SOC 2 audit is almost always worthwhile.
ISO 27001 and NIST CSF both provide well-defined processes and controls to help a company build a security program from the ground up. They also both provide valuable roadmaps to maturing your security program over time.
With securityprogram.io, we build the base controls around NIST 800-53 and map to each of these other standards so that you can identify the work once and track alignment to the other standards automatically. While we will help you design, build, and prepare your program; you still need to have an independent auditor make sure you are prepared for their audit process and perform the audit.
