Security frameworks explained: ISO 27001, SOC 2 and NIST

ISO 27001, NIST and SOC 2 are three widely used frameworks for managing information security. They overlap, but they come from different bodies and suit different needs. This guide gives a plain definition of each and then the practical detail, with a comparison to help teams choose.

What is ISO 27001?

ISO 27001 is the international standard for an information security management system (ISMS). It sets out requirements for how an organization identifies information security risks, chooses controls to treat them and keeps improving. The International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) publish it. The current edition is ISO/IEC 27001:2022.

ISO 27001 is a certifiable standard. An accredited certification body audits the organization and, if it passes, issues a certificate that is valid for three years with annual surveillance audits in between.

What ISO 27001 requires

The main clauses follow the same high-level structure as other ISO management system standards, which makes it easier to combine with ISO 9001 or ISO 14001.

Clause	Area	What it covers
4	Context of the organization	Understanding the organization, interested parties and the scope of the ISMS
5	Leadership	Top management commitment, an information security policy and defined roles
6	Planning	Risk assessment, risk treatment and information security objectives
7	Support	Resources, competence, awareness, communication and documented information
8	Operation	Carrying out the risk assessment and treatment plans
9	Performance evaluation	Monitoring, internal audit and management review
10	Improvement	Nonconformity, corrective action and continual improvement

Annex A controls

Annex A lists 93 reference controls in the 2022 edition, grouped into four themes. The organization compares its own risk treatment against this list and documents which controls apply in a statement of applicability.

Theme	Examples
Organizational	Policies, roles, supplier relationships and incident management
People	Screening, awareness training and remote working
Physical	Secure areas, equipment protection and clear desk rules
Technological	Access control, encryption, logging, backups and secure development

How to prepare for ISO 27001 certification

• Agree the scope: which systems, sites and data the ISMS will cover
• Get top management support and name an owner
• Run a risk assessment and decide how to treat each risk
• Write the statement of applicability and the policies that support it
• Put controls in place and train staff
• Run an internal audit and a management review
• Fix findings, then book the certification audit
• Keep improving, because certification needs ongoing evidence

Organizations that held a certificate to the 2013 edition needed to transition to the 2022 edition by October 31, 2025. Check the current position with your certification body.

What is NIST?

NIST is the National Institute of Standards and Technology, a US government agency that publishes standards, guidelines and frameworks on technology, including cybersecurity. When people say "NIST" in a security context they usually mean the NIST Cybersecurity Framework (CSF) or the NIST Special Publication 800-53 control catalog.

NIST frameworks are voluntary guidance for most private organizations and cannot be certified. US federal agencies and many of their contractors must follow certain NIST publications, such as SP 800-53 and SP 800-171.

The NIST Cybersecurity Framework

The NIST CSF gives organizations a common way to understand and manage cybersecurity risk. Version 2.0 was released in February 2024. It has six core functions.

Function	What it covers
Govern	Setting strategy, roles, policy and oversight for cybersecurity risk
Identify	Understanding assets, suppliers and risks
Protect	Safeguards such as access control, training and data security
Detect	Finding unusual activity and possible incidents
Respond	Acting on detected incidents
Recover	Restoring services and learning from incidents

The framework also uses implementation tiers and profiles. A profile describes the organization's current and target position, so teams can plan how to close the gap.

Other NIST publications teams meet

Publication	What it is
SP 800-53	A catalog of security and privacy controls, used with US federal systems
SP 800-171	Requirements for protecting controlled unclassified information in non-federal systems
SP 800-37	The Risk Management Framework for managing risk to systems
Privacy Framework	A voluntary tool for managing privacy risk

How to start with NIST

• Pick the framework or publication that matches your obligations, such as CSF for general risk management or SP 800-171 for federal contract work
• Assess the current position against it
• Set a target profile based on risk and resources
• Make a plan to close the biggest gaps first
• Assign owners and track progress
• Review as threats and business needs change

What is SOC 2?

SOC 2 is a reporting framework for service organizations that shows how well they protect customer data. The American Institute of Certified Public Accountants (AICPA) created it. An independent CPA firm audits the organization against the AICPA Trust Services Criteria and issues a report. The result is an attestation report, not a certificate.

SOC 2 is common among software and cloud service providers, because customers often ask for a report before they sign or renew a contract.

The Trust Services Criteria

Criteria	What it covers	Required?
Security	Protection against unauthorized access	Yes, always included
Availability	Systems are available as committed	Optional
Processing integrity	Processing is complete, valid and accurate	Optional
Confidentiality	Confidential information is protected	Optional
Privacy	Personal information is collected, used and disposed of properly	Optional

SOC 2 Type 1 and Type 2

Item	Type 1	Type 2
What it tests	Whether controls are designed suitably at a point in time	Whether controls operated effectively over a period, often 3 to 12 months
Evidence	A snapshot	Ongoing evidence across the period
Customer weight	Useful as a first step	Usually preferred by customers

How to prepare for a SOC 2 audit

• Choose the criteria that match customer commitments
• Define the system and its boundaries
• Run a readiness assessment to find gaps
• Write policies and put controls in place
• Collect evidence regularly, because auditors test samples across the whole period
• Select a CPA firm and agree the audit window
• Fix exceptions and keep controls running after the report is issued

ISO 27001 vs NIST vs SOC 2

Item	ISO 27001	NIST CSF	SOC 2
Type	Certifiable standard	Voluntary framework	Attestation report
Issued by	ISO and IEC	US NIST	AICPA
Result	Certificate, valid three years	No certification	Report from a CPA firm
Scope	An information security management system	Cybersecurity risk management outcomes	Controls relevant to a service organization
Common use	Global, any sector	US and global, all sectors	US and global, service providers
Best when	A recognized international certificate is needed	A flexible structure for risk management is needed	Customers ask for an assurance report

Many organizations use more than one. The frameworks share many controls, such as access management, incident response and supplier risk, so work done for one often supports another. Mapping controls once and reusing the evidence saves effort.

Keeping up with security and compliance requirements

Frameworks, laws and customer contracts change. A team may need to follow ISO 27001 for certification, NIST for a federal contract and data protection rules for personal data, all at once. Each brings its own requirements and review cycles.

Ideagen's regulatory compliance solution helps teams track regulatory updates and see which policies and processes they affect. That supports keeping security policies and control mappings current as requirements change. It does not replace a security audit or certification, and people still decide how each requirement applies.

Practical steps for a multi-framework program

• List every framework, law and contract commitment that applies
• Map overlapping requirements to one set of controls
• Assign an owner to each control
• Collect evidence once and reuse it across audits
• Review the register of requirements on a set schedule
• Update policies when a framework or law changes
• Report status to leadership with the same data used for audits

Frequently asked questions

What is ISO 27001 in simple terms?

It is the international standard for running an information security management system, and organizations can be certified against it.

What is NIST in simple terms?

NIST is a US agency that publishes cybersecurity guidance. Its best-known framework, the NIST CSF, helps organizations manage cybersecurity risk.

What is SOC 2 in simple terms?

It is an audit report from an independent CPA firm that shows how an organization protects customer data against the Trust Services Criteria.

Is SOC 2 a certification?

No. It is an attestation report. Organizations receive a report, not a certificate.

Which framework should an organization start with?

Start with what customers, regulators and contracts require. ISO 27001 suits those needing an international certificate. SOC 2 suits service providers whose customers ask for a report. NIST suits those wanting a flexible risk framework or working with US federal bodies.