Which Security Framework Does Your Business Actually Need?

The entire framework decision begins with a question that most companies think they can answer quickly: do you handle personal data of customers or employees? The practical reality is that almost every company operating in 2025 handles personal data in some form , employee records, customer contact information, website analytics, payment details, or user-generated content. The question is less whether you handle personal data and more whether you have thought carefully about what categories of personal data you process, where it originates, where it is stored, and what regulatory jurisdiction governs it. Companies that answer no to this question and stop thinking about compliance almost always discover later that they were wrong, typically during a customer security questionnaire or a vendor due diligence process that asks specifically about data protection policies and practices.

For companies that handle personal data , which, again, is the majority of operating businesses , the first branch is whether they have customers or operations in the EU. This question triggers one of the most consequential compliance obligations in the modern regulatory landscape: GDPR paired with ISO 27001. GDPR Article 3 establishes extraterritorial scope with unusual breadth. A company incorporated in Singapore with no EU employees and no EU offices is subject to GDPR if it offers goods or services to EU residents or monitors the behavior of EU residents, regardless of where the processing occurs. The combination of GDPR and ISO 27001 that this branch produces is not arbitrary , ISO 27001 provides the information security management system framework that operationalizes GDPR Article 32 security requirements and Article 25 data protection by design obligations, and the two standards together create a compliance posture that satisfies both the regulatory and contractual security expectations of EU enterprise clients.

The EU branch produces a clean two-framework answer: GDPR and ISO 27001. What makes this branch deceptively simple is that GDPR compliance is not a certification , there is no GDPR audit that produces a certificate. GDPR compliance is a continuous operational state demonstrated through documented processing activities under Article 30, data protection impact assessments under Article 35, data subject rights fulfillment workflows, and data breach notification procedures that meet the 72-hour reporting requirement to supervisory authorities under Article 33. ISO 27001:2022 certification, which an accredited certification body awards after a two-stage audit, provides the external validation of the security management system that GDPR requires organizations to maintain. Companies frequently make the mistake of treating ISO 27001 certification as proof of GDPR compliance , it is evidence of security control maturity, not a substitute for the legal compliance analysis that GDPR requires.

For companies that handle personal data but do not have EU customers or operations, the decision tree routes to a second question: do you process credit card or payment data? The compliance obligation that this branch triggers , PCI DSS and ISO 27001 , is notable for a specific reason that separates it from most other framework requirements. PCI DSS is not a regulatory requirement in the sense that GDPR or HIPAA are statutory obligations enforced by government bodies. It is a contractual requirement embedded in merchant agreements and payment processor contracts, enforced by the card brands through fines, increased transaction fees, and ultimately the termination of payment processing privileges. A company that processes payment data and is not PCI DSS compliant is not just at regulatory risk , it is in breach of its payment processing contracts, which creates immediate commercial liability.

PCI DSS v4.0.1 , the current and only valid version since March 2024 , pairs naturally with ISO 27001 because the two frameworks share significant control overlap and ISO 27001 provides the governance structure that PCI DSS requires but does not fully specify. PCI DSS Requirement 12 mandates information security policies, risk assessment processes, and security awareness training , areas where ISO 27001 Annex A controls provide a more mature implementation framework than PCI DSS alone prescribes. Organizations pursuing both certifications simultaneously can reduce their combined audit effort by mapping controls to both frameworks during the design phase rather than completing each assessment independently. The 64 new PCI DSS v4.0.1 requirements , all of which are now mandatory following the March 2025 deadline , include several that have no direct ISO 27001 analog, particularly in the areas of targeted risk analysis methodology and the specific technical requirements for protecting payment pages against web-based attacks under Requirement 6.4.1.

For companies that do not handle personal data at all , a genuinely narrow category that includes infrastructure providers, certain B2B industrial companies, and some professional services firms , the decision tree routes to the federal government question. NIST 800-53 and CMMC 2.0 represent the compliance stack for organizations working in or with the US federal government or defense sector, and this branch produces the most technically demanding and procedurally complex compliance program of any path in the decision tree. CMMC 2.0 Level 2, which applies to defense contractors handling Controlled Unclassified Information, corresponds to the 110 security requirements in NIST SP 800-171 Rev 2, and the CMMC final rule published in October 2024 formalized the requirement for third-party C3PAO assessments for most Level 2 contractors. NIST 800-53 Rev 5, which underlies both CMMC and FedRAMP, contains 20 control families and over 1,000 individual controls at the high baseline , an assessment scope that routinely requires 12 to 24 months of implementation effort for organizations without prior federal compliance experience.

The middle branch of the decision tree , for companies that handle personal data, do not have EU customers, and do not process payment data , routes to a question about business model: do you offer SaaS, cloud, or software services? This question is where market pressure and regulatory obligation converge most visibly. Enterprise clients purchasing SaaS products have standardized on SOC 2 Type II as the minimum security attestation they require before signing contracts, and this commercial expectation is enforced through procurement questionnaires, vendor security review processes, and increasingly through contractual representations and warranties that expose vendors to liability if they overstate their compliance posture.

The SOC 2 and ISO 27001 combination that this branch produces reflects the dual-market reality of most B2B SaaS companies. US enterprise clients primarily want SOC 2 Type II. European and Asian enterprise clients, and an increasing number of US clients with international operations, want ISO 27001 certification. Building one program that satisfies both standards is meaningfully more efficient than building them sequentially, because the SOC 2 Trust Service Criteria and ISO 27001 Annex A controls overlap in approximately 70 percent of their requirements. SOC 2 CC6 Logical and Physical Access Controls maps to ISO 27001 A.9 Access Control. SOC 2 CC7 System Operations maps to ISO 27001 A.12 Operations Security and A.16 Information Security Incident Management. SOC 2 CC9 Risk Mitigation maps to ISO 27001 A.15 Supplier Relationships and A.8 Asset Management. The 30 percent of requirements that do not overlap represents the genuinely incremental work each standard adds , and understanding that boundary before beginning either program is what separates a well-scoped compliance program from one that discovers its gaps during an audit.

For SaaS companies whose enterprise clients or investors do not yet require SOC 2 , typically earlier-stage companies or those serving SMB markets , the decision tree routes to NIST CSF and CIS Controls as the foundational framework combination. NIST CSF v2.0, updated in February 2024 with the addition of the Govern function as a sixth core function, provides the risk management framework that allows organizations to assess and communicate their security posture across the Identify, Protect, Detect, Respond, Recover, and Govern functions without prescribing specific technical controls. CIS Controls v8.1 provides the implementation specificity that NIST CSF lacks , its 18 control groups and implementation group structure allow organizations to prioritize controls based on their actual risk profile and resource capacity. Together, NIST CSF and CIS Controls create a compliance foundation that an organization can build on when SOC 2 or ISO 27001 requirements emerge from customers or investors, because both frameworks have published mappings to SOC 2 and ISO 27001 that identify the incremental gap.

Companies that do not handle personal data and do not work with the US federal government face two final questions that cover the remaining significant compliance obligations in the popular framework landscape. The first is whether the company builds or deploys AI systems or AI-powered products. The EU AI Act and ISO 42001 combination that this branch produces reflects the converging regulatory and standards landscape around artificial intelligence that has developed rapidly since 2023. The EU AI Act, which entered into force in August 2024, applies to providers and deployers of AI systems placed on the EU market or used in the EU, and its risk classification framework , unacceptable risk, high risk, limited risk, minimal risk , determines the conformity assessment obligations, documentation requirements, and post-market monitoring mandates that apply to each system.

ISO 42001:2023, the artificial intelligence management system standard published in December 2023, provides the governance framework that organizations implement to demonstrate systematic AI risk management. The standard follows the same Annex SL high-level structure as ISO 27001 and ISO 9001, which means organizations with existing ISO management system certifications can integrate ISO 42001 into their existing management system structure rather than building a parallel governance program. For companies that build AI-powered features into existing software products , which describes a growing majority of SaaS companies , the critical compliance question is whether those features trigger high-risk AI system classification under EU AI Act Annex III. Annex III covers AI systems used in biometric categorization, critical infrastructure, education, employment, essential services, law enforcement, migration, and administration of justice. Most horizontal SaaS AI features fall outside these categories, but the analysis must be conducted for each AI system individually rather than assumed at the company level.

The final branch in the decision tree , for companies that handle no personal data, do no federal government work, and build no AI systems , produces the HIPAA and NIST CSF combination for organizations that handle patient records or health data. HIPAA remains one of the most actively enforced US healthcare regulations, with HHS Office for Civil Rights settlements regularly reaching seven and eight figures for failures to implement the required administrative, physical, and technical safeguards. The 2024 HIPAA Security Rule NPRM, published in December 2024, proposes mandatory multi-factor authentication, enhanced audit logging, and network segmentation requirements that will substantially increase the technical control burden for covered entities and business associates when finalized. NIST CSF pairs with HIPAA in this branch because the HHS itself has published guidance recommending NIST CSF as the risk management framework for healthcare organizations, and because NIST CSF Subcategory mappings to HIPAA Security Rule safeguards provide a practical implementation pathway for organizations building their HIPAA compliance program.

Across the entire decision tree, ISO 27001 appears as a component of nearly every compliance outcome , paired with GDPR, with PCI DSS, with SOC 2, and as the standalone recommendation for companies that offer non-SaaS software services without enterprise client pressure. This prevalence is not coincidental. ISO 27001:2022 Annex A contains 93 controls across four domains , organizational, people, physical, and technological , that provide a comprehensive security management baseline that maps to the requirements of virtually every other framework in the decision tree. Organizations that implement ISO 27001 as their foundational security framework first, before addressing any additional regulatory or standards requirements, consistently reduce the incremental effort required to achieve subsequent certifications because they have already addressed the control implementation work that represents 50 to 70 percent of most other framework requirements.

ISO 27002:2022 , which appears alongside ISO 27001 in the decision tree outcome for non-EU, non-payment, non-SaaS companies , provides the implementation guidance that ISO 27001 references but does not prescribe. Where ISO 27001 Annex A specifies what controls an organization must have, ISO 27002 provides the how , detailed implementation guidance, example approaches, and contextual information for each control. The two standards are designed to be used together: ISO 27001 provides the management system framework and the Annex A control requirements, and ISO 27002 provides the implementation guidance that compliance teams use to design the actual controls. Organizations that implement ISO 27001 without referencing ISO 27002 frequently produce controls that satisfy the Annex A requirement at a surface level but lack the implementation depth that auditors look for and that actual risk reduction requires.

The decision tree identifies the correct framework destination. What it cannot do is scope the implementation program, quantify the gap between current controls and framework requirements, or sequence the remediation work to maximize efficiency. Those outputs require a formal gap analysis , a systematic assessment that maps current security controls against each applicable framework requirement, identifies the specific gaps, and produces a remediation roadmap that sequences control implementation based on risk priority and cross-framework leverage. Companies that skip the gap analysis and proceed directly to implementation consistently discover that they have invested in controls that address lower-priority requirements while leaving higher-risk gaps unaddressed, because the gap analysis is the only mechanism that makes the risk-priority relationship visible before the audit.

The Control Maturity Chart, which maps each gap against a maturity scale from non-existent to optimized, provides a different but equally important output. Framework requirements do not specify what maturity level a control must achieve , they specify what the control must do. An access control policy that exists in a shared document but is not enforced, not reviewed, and not communicated to employees satisfies the documentation requirement but fails the operational effectiveness requirement that auditors test. The Control Maturity Chart makes this distinction visible by separating the existence of a control from its actual operational maturity, which allows remediation efforts to be directed at the controls that are documented but not functioning rather than the controls that are simply undocumented.

The Evidence Checklist translates the gap analysis output into the specific artifacts that auditors will request for each framework requirement , access review logs, penetration test reports, risk assessment documentation, vendor security assessments, security awareness training completion records, and incident response test results. Building this checklist before beginning implementation ensures that the compliance program generates the right evidence artifacts as a byproduct of operational security work rather than scrambling to reconstruct evidence documentation in the weeks before an audit. The combination of gap analysis, control maturity assessment, and evidence checklist represents the preparation infrastructure that separates compliance programs that pass their first audit from those that require remediation periods and second assessments.