ISO and GRC standards for financial services and fintech: where to start: video

What financial services and fintech firms are asked for

Financial firms answer to several audiences at once: bank partners onboarding a fintech, enterprise clients choosing a payments provider, card schemes and acquirers, and regulators. The standards they ask for follow from that. ISO/IEC 27001 for information security is the usual foundation, then PCI DSS wherever cardholder data is stored, processed or transmitted, SOC 2 for service assurance, ISO 22301 for business continuity and ISO 37301 for compliance management, alongside regulatory frameworks such as DORA in the EU, SAMA CSF in Saudi Arabia and BSP circulars in the Philippines.

The film makes one point above all: the order of work matters, because one well-built control set can answer many of these requests at once.

The pressures, and why ISO/IEC 27001 usually comes first

Most firms feel several pressures in the same quarter. A bank or corporate client sends a security questionnaire before the first call, and an ISO/IEC 27001 certificate or a SOC 2 report answers most of it. Anyone handling card data validates against PCI DSS v4.0.1 every year. Regulators expect evidence: DORA has applied to EU financial entities since 17 January 2025, SAMA sets maturity expectations for its Cyber Security Framework, and the BSP sets IT risk and continuity rules for supervised institutions.

The usual starting point is ISO/IEC 27001, because its risk assessment and controls can be reused as evidence for PCI DSS, SOC 2 and the regulatory frameworks a firm answers to. PCI DSS validation, a SOC 2 examination or a continuity system then follow in the order the next client, acquirer or supervisor requires. The free Select the Standard™ tool sets out the usual order for banks, payment firms and fintechs. PCI DSS is validated by a QSA or self-assessment, SOC 2 is an attestation by a CPA firm, and DORA and SAMA CSF are supervised by regulators, not certified.

Sterling's consultants build the system and the evidence with risk, IT and compliance teams under one all-inclusive proposal for a defined scope, including Effivity, Sterling Academy access and internal auditor training as applicable.