Standards & frameworks

Information security, cyber & cloud: information security standards and frameworks

Information security standards define how an organisation protects the confidentiality, integrity and availability of its information and systems. This family covers ISO/IEC 27001 and its cloud and sector extensions, SOC 2, PCI DSS, the NIST and CIS frameworks, and cyber regulations from the EU, the Gulf, the UK, Australia, Singapore and India.

About this family

What information security, cyber and cloud standards cover

The standards here fall into four kinds, and the difference matters more than the names. Management system standards such as ISO/IEC 27001 lead to certification by an accredited body, with ISO/IEC 27017 and ISO/IEC 27018 adding cloud controls and the wider 27000 series giving guidance on controls, risk, incidents and supplier relationships. SOC 2 and SOC 3 are attestation reports issued by a licensed CPA firm. Industry schemes carry their own assessors: a Qualified Security Assessor for PCI DSS, an ENX-approved audit provider for TISAX, an External Assessor for HITRUST, and a self-assessment or an authorised C3PAO for CMMC, depending on the level. Laws and regulator frameworks, from NIS2 and DORA in the EU to the UAE IA Standard, NCA ECC and SAMA CSF in the Gulf, APRA CPS 234 in Australia and MAS TRM in Singapore, set obligations that supervisory authorities enforce. Frameworks such as NIST CSF 2.0 and CIS Controls v8 are implemented, not certified.

Requests arrive through due diligence: an enterprise client’s security questionnaire, an acquiring bank, a cloud procurement team, a vehicle manufacturer or a regulator’s circular. Because the controls overlap heavily, the efficient route is one information security management system that answers several of them. An ISO/IEC 27001 ISMS supplies the risk assessment, policies, incident process and internal audit that SOC 2, PCI DSS, NIS2 or a Gulf regulator’s framework also expect, with each scheme’s specific controls added on top. Product and industrial security, covered by ISO/SAE 21434, UNECE R155 and IEC 62443, applies the same logic to vehicles and operational technology. Sterling engages through Design™, where Sterling’s consultants develop the controls and your team implements them under their supervision, or Drive™, where Sterling designs and builds them for you under your approval. ISMS engagements include a vulnerability assessment, and Effivity is included at no additional cost to hold the risk register, Statement of Applicability, evidence and audit trail. The certification body, CPA firm, assessor or regulator reaches its own conclusion; Sterling prepares you for it.

The standards

48 standards, frameworks and schemes in this family

Certification standards, attestation reports, industry schemes, regulations and frameworks, each with its own page.

Each card opens the page for that standard or framework. Where the outcome is a report, an assessment or regulatory compliance rather than a certificate, the page says so and names who carries out the assessment.

60+countries where Sterling has delivered certification
21countries with a Sterling office, eight regions, one coordinated team
2003the year the group began implementing ISO management systems; the same method, refined, since
8,100+client engagements across the group, from single-site SMEs to multinationals

FAQs

Questions about information security standards

Family-level answers; each standard’s page covers its own route in detail.

Which information security standard should we start with?

Start with the one your customers, acquirer or regulator asks for by name. Where nobody specifies, ISO/IEC 27001 is usually the widest base, because its risk assessment and controls map to SOC 2, PCI DSS, NIST CSF and most regional cyber regulations. A United States client base may still ask for SOC 2 specifically, and an organisation that stores, processes or transmits cardholder data is within PCI DSS whatever else it holds.

Can ISO/IEC 27001 and SOC 2 be achieved together?

Yes, from one set of controls and evidence, though the outcomes stay separate. ISO/IEC 27001 ends in a certificate from an accredited certification body; SOC 2 ends in a report from a licensed CPA firm, and a Type 2 report covers how controls operated over a period, so that period has to be planned. The same shared base extends to PCI DSS, ISO/IEC 27017, ISO/IEC 27018 and regional frameworks.

What does the certification body or assessor check?

It depends on the route. A certification body audits the ISMS in Stage 1 and Stage 2 against ISO/IEC 27001 and your Statement of Applicability. A CPA firm tests the controls in your SOC 2 system description. A QSA assesses PCI DSS and issues a Report on Compliance, or you complete a self-assessment questionnaire where your acquirer allows it. Under laws such as NIS2 and DORA, supervisory authorities check compliance and no certificate is issued. Sterling does not certify, attest or assess.

Talk to a consultant

Plan your information security certification, report or compliance programme

Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.

hello@sterling-grc.com

+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page

What would you like to achieve?

Choose a starting point. The enquiry form takes about a minute.

Get certified to a standard for the first timeUnderstand cost, scope and timingCertify several sites or countries in one programmeAdd a standard, or integrate the systems we have

Book my free discovery call

Continue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice

End to end, from one team

On every engagement, in every country

Multi-country programmes

100% success guarantee · 8,100+ client engagements in 60+ countries · since 2003