Decision guide
Which framework do I need?
Start with what your customers ask for. Use this guide to find the right starting point, then book a call to confirm.
Quick answers
| If this sounds like you… | Start with |
|---|---|
| You sell software or services to US companies and they ask for a security report | SOC 2 |
| A hospital or payer sent you a business associate agreement and a security questionnaire | HIPAA |
| Health customers want independent certification that you protect PHI | HITRUST |
| Your customers are international or in Europe, or ask for a certification | ISO 27001 |
| You process personal data of people in the EU, or EU customers send you a DPA | GDPR |
| You build or use AI and customers ask how you govern it | ISO 42001 |
| You handle FCI or CUI on a Department of War contract or subcontract | CMMC |
| A federal agency wants to buy your cloud product | FedRAMP 20x |
| You need someone to own security strategy and compliance ongoing | vCISO |
Compare the frameworks
| SOC 2 | HITRUST | ISO 27001 | ISO 42001 | |
|---|---|---|---|---|
| Type | Attestation report | Certification | Certification | Certification |
| Issued by | Licensed CPA firm | HITRUST (via authorized assessor) | Accredited certification body | Accredited certification body |
| Main market | United States | US healthcare | Global | Global, AI |
| Validity | Report covers a period; renewed annually | Depends on level (e1/i1 annual, r2 two years) | Three years with annual surveillance | Three years with annual surveillance |
| Focus | Controls for customer data | Harmonized controls incl. HIPAA | Information security management system | AI management system |
Do I need more than one?
Often, yes, eventually. The good news: these frameworks overlap heavily. We implement controls once and map them to every framework you need, so the second one costs a fraction of the first.
Bring your next audit into the light.
Book a free 30-minute consultation. We will map where you are, what your customers need and the fastest path to get there.