IT Compliance Hub

Information Security

The security standards and audit reports customers ask software and IT service companies for: ISO 27001, ISO 27002, SOC 2, TISAX and the risk methods behind them.

  • 5 guides in this area
  • Mandatory and voluntary clearly labelled
  • Official sources in every guide
Where to start

Which one do you need?

Find the line that matches your situation. Many companies need more than one; the guides explain how they overlap.

If this is youStart withType
Enterprise customers in Europe, India, the Middle East or APAC ask for a certificateISO 27001 Certifiable standard
US enterprise customers send security questionnaires or ask for an audit reportSOC 2 Independent attestation
You need detailed guidance on how to implement each controlISO 27002 Framework / guidance
All guides

Information Security guides

Certifiable standard Global

ISO 27001

ISO/IEC 27001: Information security management systems. Requirements

ISO/IEC 27001 is the international standard for an information security management system (ISMS). It is voluntary, but enterprise customers and tenders often require it. You build a risk-based system that meets clauses 4 to 10, choose controls from the 93 in Annex A, and an accredited certification body audits you. The certificate lasts three years, with yearly surveillance audits.

Voluntary: Voluntary, often required by customers

Quick facts
What it covers
Information security risk management, governance, people, physical and technical controls, supplier security, incident handling and continual improvement.
Who needs it
SaaS, IT services, BPO, any firm selling to enterprises
Why it matters
It is the security certificate customers ask for most often outside the US, and it gives independent proof that security is managed, not improvised.
Key requirements
  • Define the ISMS scope and context (clauses 4.1 to 4.4)
  • Leadership commitment, an information security policy and assigned roles
  • Risk assessment and risk treatment, with a Statement of Applicability
  • Controls chosen from the 93 in Annex A, with exclusions justified
  • Competence, awareness and documented information
  • Monitoring, internal audit and management review
  • Corrective action and continual improvement
Where it applies
Global
Category
Information Security
Read the ISO 27001 guide
Framework / guidance Global

ISO 27002

ISO/IEC 27002: Information security, cybersecurity and privacy protection. Information security controls

ISO/IEC 27002 is the companion guidance to ISO 27001. It describes the same 93 security controls listed in ISO 27001 Annex A, and for each one explains its purpose and how to implement it. It is voluntary and you cannot be certified to it. IT teams use it to design controls, write policies and prepare for an ISO 27001 audit.

Voluntary: Voluntary guidance; not certifiable

Quick facts
What it covers
Guidance for 93 organisational, people, physical and technological security controls, each tagged with attributes such as control type and cybersecurity concept.
Who needs it
Teams implementing ISO 27001 Annex A
Why it matters
Annex A of ISO 27001 gives each control in one sentence. ISO 27002 is where you find what the control is for and what good implementation looks like.
Key requirements
  • 37 organisational controls (policies, roles, suppliers, cloud, incidents, continuity, legal)
  • 8 people controls (screening, terms of employment, awareness, remote working)
  • 14 physical controls (perimeters, entry, equipment, clear desk, media)
  • 34 technological controls (access, cryptography, logging, secure development, configuration)
  • Five attributes per control to filter and map them
  • Implementation guidance you adapt to your own risks
Where it applies
Global
Category
Information Security
Read the ISO 27002 guide
Independent attestation USA, Global

SOC 2

System and Organization Controls 2 (AICPA SOC for Service Organizations: Trust Services Criteria)

SOC 2 is an attestation report in which an independent CPA firm gives its opinion on a service organisation's controls, measured against the AICPA Trust Services Criteria. It is voluntary, but US enterprise customers routinely ask SaaS and IT vendors for it. A Type 1 report covers control design at a point in time; a Type 2 report also tests how the controls operated over a period, usually 3 to 12 months.

Voluntary: Voluntary, often required by customers

Quick facts
What it covers
Controls over security (always included) and, if chosen, availability, processing integrity, confidentiality and privacy of the systems used to serve customers.
Who needs it
B2B SaaS, cloud hosting, managed service providers
Why it matters
It is the most requested security report in US vendor reviews, and it replaces many long security questionnaires with one independent report.
Key requirements
  • Security (Common Criteria CC1 to CC9) is always in scope
  • Optional categories: availability, processing integrity, confidentiality, privacy
  • A system description written by management
  • Controls designed to meet each applicable criterion
  • Type 2 only - evidence that controls operated throughout the review period
  • Audit by a licensed CPA firm under AICPA attestation standards
Where it applies
US origin, used globally
Category
Information Security
Read the SOC 2 guide

Also relevant to information security

Certifiable standard Global

ISO 27701

ISO/IEC 27701: Information security, cybersecurity and privacy protection. Privacy information management systems. Requirements and guidance

ISO/IEC 27701 sets the requirements for a privacy information management system (PIMS): a structured way to manage personal data as a controller, a processor, or both. Since the 2025 edition it is a standalone management system standard, so it can be certified without ISO 27001, although many companies certify to both together. It is voluntary, and it provides strong evidence for privacy laws such as the GDPR and India's DPDP Act.

Voluntary: Voluntary, increasingly requested by customers

Quick facts
What it covers
Governance, risk management and controls for processing personally identifiable information (PII), with separate control sets for controllers and processors.
Who needs it
Controllers and processors wanting certifiable privacy governance
Why it matters
Customers increasingly want independent proof that a vendor handles personal data properly, not just securely. ISO 27701 gives that proof in a format auditors and procurement teams recognise.
Key requirements
  • Define the PIMS scope and your role as PII controller, processor or both
  • Leadership commitment, privacy policy, roles and responsibilities
  • Privacy risk assessment and treatment, with a Statement of Applicability
  • Controls for controllers (lawful basis, notices, rights, DPIAs, transfers)
  • Controls for processors (customer instructions, sub-processors, return and deletion)
  • Internal audit, management review and continual improvement
Where it applies
Global
Category
Data Privacy & Protection
Read the ISO 27701 guide
Framework / guidance Global

CIS Controls

CIS Critical Security Controls, Version 8.1

The CIS Critical Security Controls are a prioritised set of 18 security controls and 153 specific safeguards that defend against the most common cyber attacks. They are published free by the Center for Internet Security. Implementation Group 1 (IG1) defines essential cyber hygiene for every organisation; IG2 and IG3 add safeguards for more complex and higher-risk environments. They are voluntary and not certifiable.

Voluntary: Voluntary; referenced by some regulators, insurers and contracts

Quick facts
What it covers
Prioritised technical and process safeguards for assets, software, data, configuration, accounts, access, vulnerabilities, logging, email and web, malware, recovery, network, training, suppliers, application security, incident response and penetration testing.
Who needs it
SMBs to enterprises wanting a prioritised control set
Why it matters
They tell a small or busy IT team exactly what to do first, based on how real attacks happen, which makes them one of the fastest ways to raise security.
Key requirements
  • Inventory of enterprise assets and software (Controls 1 and 2)
  • Data protection and secure configuration (Controls 3 and 4)
  • Account and access control management (Controls 5 and 6)
  • Continuous vulnerability management and audit logs (Controls 7 and 8)
  • Malware defences and data recovery (Controls 10 and 11)
  • Security awareness, service provider and application security (Controls 14 to 16)
  • Incident response and penetration testing (Controls 17 and 18)
Where it applies
Global
Category
Cybersecurity
Read the CIS Controls guide
Other areas

More IT compliance categories

Data Privacy & Protection Cybersecurity IT Governance & Risk Management Cloud Security Secure Software Development Payment & Financial Data Security Healthcare IT AI Governance & Compliance Business Continuity & Disaster Recovery International IT Regulations Indian IT Laws & Regulations All IT compliance guides
IT compliance help

Not sure which information security rules apply to you?

Tell us what you build, where your customers are and what they ask for. We reply with suggested next steps.

  • No obligation
  • NDA on request
  • Reply within one business day
Prefer to talk first? Book a call WhatsApp iamvishavjeet@gmail.com

Get an IT compliance assessment

This form is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Need a custom Tutor LMS solution?

Tell us what you are building or what is broken. A Tutor LMS developer reads every inquiry and replies with next steps and a free estimate.

Get a free consultation Book a call

Get a free Tutor LMS consultation

Tell us what you are building or fixing. A Tutor LMS developer replies with honest advice and next steps.

  • No obligation
  • Tutor LMS and Pro specialists
  • Your details stay private

This form is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.