Browse
Security Compliance Frameworks
What SOC 2, ISO 27001, and similar frameworks actually require, and why compliance isn't the same as security.
What it is
Compliance frameworks define a baseline set of controls an organization must demonstrate — often required for enterprise sales or regulatory reasons.
Key points
- SOC 2 focuses on trust service criteria (security, availability, confidentiality, etc.) and is common for SaaS vendor due diligence.
- ISO 27001 is a broader international standard for an organization's information security management system as a whole.
- Compliance is a floor, not a ceiling — passing an audit demonstrates a baseline of controls, not that the system is actually secure against a determined attacker.
- Frameworks matter architecturally because they constrain design decisions (e.g. data residency, audit logging, retention policies) that need to be built in, not retrofitted.