What each one actually involves.
SOC 2 Type I & II
Who it binds. Service organisations holding customer data — in practice, any SaaS company selling to a North American enterprise.
What triggers it. A prospect’s security review. SOC 2 is rarely a legal obligation and almost always a commercial one: the deal stalls without it.
What we do. Gap assessment against the Trust Services Criteria, a prioritised remediation plan, control and policy implementation with your team, evidence collection through the observation window, and support through the examination itself.
What you end up holding. An attestation report issued by an independent licensed CPA firm — not a certificate, and not something we can issue. Type I covers design at a point in time; Type II covers operating effectiveness over a period.
ISO 27001
Who it binds. Any organisation electing to certify its information security management system (ISMS) — commonly demanded by European and global enterprise procurement.
What triggers it. A buyer’s requirement, or entering European markets.
What we do. Scope the ISMS, build the Statement of Applicability against Annex A, the risk treatment plan and policy set, run the internal audit and management review, and support you through Stage 1 and Stage 2.
What you end up holding. A certificate from an accredited certification body, valid three years with annual surveillance audits.
NIST CSF
Who it binds. Nobody, legally — it is voluntary.
What triggers it. Choice, or a contract naming it as the reference model.
What we do. Profile your current state against the six Functions — Govern, Identify, Protect, Detect, Respond, Recover — agree a target profile, and close the gap.
What you end up holding. No certificate — a scored current and target profile and a documented improvement plan.
CMMC
Who it binds. Defense contractors and subcontractors handling Federal Contract Information or Controlled Unclassified Information — it flows down the supply chain.
What triggers it. A Department of Defense contract clause.
What we do. Determine level and scope, assess against NIST SP 800-171, build the System Security Plan and POA&M, remediate, and prepare you for assessment.
What you end up holding. Level 1 is an annual self-assessment; Level 2 typically requires certification by an authorised C3PAO — which we are not, and could not be for a client we prepared, because the assessor must be independent.
FedRAMP 20x
Who it binds. Cloud service providers selling to US federal agencies.
What triggers it. An agency wanting to use your service.
What we do. Readiness against the relevant baseline, control implementation and documentation, evidence automation, and sponsor liaison.
What you end up holding. An authorisation, granted via an agency sponsor or the program itself; the assessment is performed by an accredited 3PAO. FedRAMP 20x is GSA’s phased, automation-first modernisation of the program, and the specifics are still moving.
HIPAA
Who it binds. Covered entities — providers, plans, clearinghouses — and their business associates, including vendors that never see a patient.
What triggers it. Handling protected health information at all; it applies by law, not by contract.
What we do. Run the Security Rule risk analysis, put administrative, physical and technical safeguards in place, write policies, train the workforce, paper the business associate agreements, and build the breach response plan.
What you end up holding. No certificate — HIPAA has no certifying body. What you hold is a documented risk analysis and safeguard set, which is precisely what regulators ask for after an incident.
HITRUST
Who it binds. Whoever elects it — typically vendors to health systems that accept it instead of a bespoke questionnaire.
What triggers it. A health system customer’s vendor requirement.
What we do. Scope the assessment type — e1, i1 or r2 — drive readiness, and implement controls and evidence.
What you end up holding. A HITRUST certification issued through an authorised external assessor; e1 and i1 run one year, r2 two years with an interim review.
GDPR
Who it binds. Any organisation processing EU or EEA residents’ personal data, wherever it is based.
What triggers it. Simply handling that data; it is extraterritorial by design.
What we do. Data mapping and records of processing, lawful basis review, data protection impact assessments, the subject rights process, processor agreements, and the breach notification procedure.
What you end up holding. No certificate — a record of processing activities and a demonstrable accountability position.
CCPA
Who it binds. For-profit businesses meeting the statute’s revenue or data-volume thresholds that handle California residents’ personal information.
What triggers it. Crossing a threshold, which many companies do without noticing.
What we do. Build the data inventory, the consumer rights workflow — access, deletion, correction, opt-out of sale and sharing — the privacy notice, and service provider terms.
What you end up holding. No certificate — documented rights-handling processes and a compliant notice.
ISO 42001
Who it binds. Organisations developing, providing or using AI systems, by choice.
What triggers it. Buyers procuring AI asking how it is governed — increasingly a gate rather than a question.
What we do. Scope the AI management system, run the AI risk and impact assessment, put controls over data, model lifecycle and human oversight in place, run the internal audit, and support you through Stage 1 and Stage 2.
What you end up holding. A certificate from an accredited body, on the same three-year cycle as ISO 27001.
PCI DSS
Who it binds. Any entity that stores, processes or transmits cardholder data, and those that can affect its security.
What triggers it. Accepting card payments; your level is set by annual transaction volume.
What we do. Start with scope reduction — the cheapest control is not holding the data — then gap assessment against v4.0.1, control implementation, and evidence.
What you end up holding. A completed Self-Assessment Questionnaire and Attestation of Compliance, or at higher volumes a Report on Compliance produced by a Qualified Security Assessor.
