Compliance Frameworks: SOC 2, ISO 27001, and GDPR
Compliance frameworks give organizations (and their customers, regulators, and auditors) a shared, agreed-upon checklist for "secure and responsible enough." Different frameworks exist because different industries, regions, and data types come with different legal and contractual obligations.
SOC 2
SOC 2 (System and Organization Controls 2) is the framework most B2B SaaS companies in the US get asked about, especially by enterprise customers during procurement. It's built around five Trust Service Criteria, of which Security is mandatory and the rest are chosen based on relevance:
- Security (always required): protection against unauthorized access.
- Availability: the system is available for operation as agreed.
- Processing Integrity: system processing is complete, accurate, and timely.
- Confidentiality: information designated confidential is protected.
- Privacy: personal information is collected, used, and disposed of properly.
A SOC 2 report isn't a pass/fail certificate the way some frameworks are, it's an independent auditor's opinion on whether your controls are suitably designed (Type I, a point in time) and operating effectively over a period, usually 6-12 months (Type II, the one most customers actually want to see).
ISO 27001
ISO 27001 is an international standard for an Information Security Management System (ISMS), a systematic, ongoing process for managing information security risk, rather than a fixed checklist. Getting certified means an accredited auditor confirms your ISMS meets the standard's requirements, and certification is periodically reassessed, it's a process you maintain, not a one-time achievement.
GDPR
The General Data Protection Regulation is EU law governing how organizations handle the personal data of people in the EU, regardless of where the organization itself is based. Unlike SOC 2 or ISO 27001, it isn't something you get "certified" in, it's a legal requirement with real regulatory enforcement (fines up to 4% of global annual revenue), key concepts include:
- Data subject rights: people can request access to, correction of, or deletion of their data.
- Lawful basis: you need a legitimate reason (consent, contract, legal obligation, etc.) to process personal data at all.
- Data breach notification: many breaches must be reported to a regulator within 72 hours of discovery.
NOTE
These frameworks overlap heavily in practice, a strong access control policy, an incident response plan, and encryption at rest and in transit satisfy pieces of all three at once. Most organizations build one solid internal control set and map it to whichever frameworks their customers or regulators actually require.