hello@sterling-grc.com +1 201 263 4443 New York ISO & GRC consulting in 60+ countries
Contact Sterling Academy login
SterlingInternational Consulting Talk to a consultantTalk to us
← All videos

Integrated programme

ISO/IEC 27001, PCI DSS, SOC 2 and HIPAA together: four frameworks, one control set: video

A film on preparing large BPOs and service providers for four frameworks at once, so teams prepare once a year rather than four times.

  • Integrated programme
  • 3 min 14 s

Key takeaways

  • Four frameworks, four different judges, one control set.
  • No single audit can formally cover all four.
  • Card data and health data are scoped deliberately.
  • One evidence base serves the certification body, the QSA, the CPA firm and HIPAA documentation.
  • One calendar lets teams prepare once a year instead of four times.

When healthcare, payments and enterprise clients all ask

Large BPOs and service providers serving US healthcare, payments and enterprise clients can be asked for four frameworks at once: an ISO/IEC 27001 certificate, PCI DSS validation, a SOC 2 report and documented HIPAA compliance. Each has its own judge. The certificate comes from an accredited certification body, PCI DSS from a Qualified Security Assessor or the acquirer's self-assessment route, the SOC 2 report from a licensed CPA firm, and HIPAA compliance is demonstrated through documentation, because HIPAA is a law with no certificate.

This short film walks through how one programme handles all four, with each control written once and every assessment planned on one calendar.

Large BPOs and service providers serving US healthcare, payments and enterprise clients are the organisations that can be asked for all four.

Evidence once, used four ways

No single audit can formally cover all four frameworks, because each outcome comes from a different independent party under its own rules. What the programme does instead is build one control set mapped to ISO/IEC 27001 Annex A, the PCI DSS requirements, the SOC 2 Trust Services Criteria and the HIPAA safeguards, with card data and health data scoped deliberately so each framework applies where it should.

One evidence base then serves the certification body, the QSA and the CPA firm, and supports the HIPAA documentation. The certificate's audits, the PCI DSS assessment, the SOC 2 report period and the HIPAA risk reviews are planned together, so teams prepare once a year rather than four times. Security questionnaires from any client can be answered from the same source.

The programme runs under one all-inclusive proposal with one engagement team and a single Effivity workspace in place of four projects. Sterling prepares and supports; the certification body, the QSA and the CPA firm decide, and HIPAA compliance is documented rather than certified.

ISO/IEC 27001 at a glance

Purpose
Information security management: protecting the confidentiality, integrity and availability of information through assessed risks and chosen controls
Relevant to
Any organisation holding client, personal or business-critical information, from technology and BPO to financial services, healthcare and public-sector suppliers
Edition
ISO/IEC 27001:2022 with Amendment 1:2024; 2013-edition certificates lapsed on 31 October 2025
Certification
Assessed and decided by an independent certification body accredited to ISO/IEC 17021-1 and ISO/IEC 27006-1
Sterling's role
Consulting with your team, Effivity, training, vulnerability assessment, internal audit and certification readiness, then Sustain™
Cost and timing
Total investment for an ISO/IEC 27001 ISMS depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 4 to 8 months

ISO/IEC 27001: the complete guide →

ISO/IEC 27001: questions people ask

Is ISO/IEC 27001 only for IT companies?

No. It applies to any organisation that holds information worth protecting, which is every organisation with clients, employees or a bank account. IT firms, BPOs and financial services feel the demand first because their clients ask; law firms, healthcare providers and public bodies certify for the same reasons.

What is the difference between ISO/IEC 27001 and SOC 2?

ISO/IEC 27001 is an international management system standard; an accredited certification body audits it and issues a certificate with a defined scope. SOC 2 is an attestation report on a service organisation's controls against the AICPA Trust Services Criteria, issued by a CPA firm and expected mainly by US clients. They overlap heavily in the controls examined, so one evidence base can serve both, but neither replaces the other; ask your clients which they accept.

How many controls does ISO/IEC 27001 have, and do we need all of them?

Annex A of the 2022 edition lists 93 reference controls in four themes: 37 organisational, 8 people, 14 physical and 34 technological. You are not required to implement every one. You must select controls from your risk treatment, compare the selection with Annex A so nothing necessary is missed, and record in the Statement of Applicability which controls apply, why, and whether they are implemented, with a justification for any you exclude.

Do we need a penetration test to get certified?

The standard requires you to manage technical vulnerabilities and assess risks; it does not prescribe a particular test. A vulnerability assessment is included in a Sterling ISMS engagement, and its findings feed the treatment plan. Whether a deeper penetration test is warranted depends on your risks, your clients' contracts and your regulator.

Does Sterling issue the ISO/IEC 27001 certificate?

No. Sterling consults, trains and prepares. An independent certification body accredited to ISO/IEC 17021-1 and ISO/IEC 27006-1 audits the ISMS in two stages and decides. A provider offering consulting and the certificate on one invoice is selling paper.

More ISO/IEC 27001 questions and answers →

Keep exploring

Related to this video

Read next

Services

Next steps

The complete guide

Everything on ISO/IEC 27001

Start with the ISO/IEC 27001 page · PCI DSS · SOC 2 · HIPAA, or go straight to the guide you need.

On the ISO/IEC 27001 page

Guides

By country

By industry

Often combined with ISO/IEC 27001

More videos: Integrated programmes

All videos

Talk to a consultant

Plan your ISO/IEC 27001 certification with confidence.

Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.

hello@sterling-grc.com

+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page

What would you like to achieve?

Choose a starting point. The enquiry form takes about a minute.

Your goal
Book my free discovery call

Continue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice