Compliance frameworks, plainly.

How to read this hub

The single most common error in compliance purchasing is treating all frameworks as equivalent credentials. They are not. Some produce a certificate with an expiry date. Some produce an auditor opinion with no certificate at all. Some are laws. One is a voluntary scoring benchmark. One is a federal authorization granted by a government official. Mixing these up produces budget errors, contract failures, and genuinely bad procurement decisions. This hub uses the cert-vs-attestation-vs-regulation question as the organizing principle because it is the one question that cuts across all 10 and gives buyers a consistent way to evaluate what they are actually being asked to produce. The card groupings below follow that lens; the analytical sections that follow them go deeper on geography, cost bands, and sequencing.

Cert, attest, or regulation: the question that organizes this page

Every framework covered here falls into one of six categories, and the category determines what a buyer can actually ask a vendor to produce.

Certification (a physical certificate from an accredited body)

ISO 27001, HITRUST, and CMMC (Level 2 and above) each produce a certificate issued by an accredited certification body or authorized assessor organization. ISO 27001 certificates have a three-year validity with annual surveillance audits. HITRUST certificates are issued by the HITRUST Alliance, not by the external assessor firm. CMMC Level 2 certificates are issued after a C3PAO-led assessment.

Attestation (a CPA firm's opinion, no certificate)

SOC 2 Type 1 and SOC 2 Type 2 produce an auditor's report, not a certificate. A licensed CPA firm issues an opinion under AICPA standards. There is no SOC 2 certification body, no certificate document, and no public registry to look up. When a vendor says "we passed our SOC 2," they mean a CPA firm issued a report in their favor. That report is typically shared under NDA, not posted publicly.

Authorization (granted by a US federal Authorizing Official)

FedRAMP produces an Authorization to Operate (ATO). A federal agency Authorizing Official grants the ATO after a Third-Party Assessment Organization (3PAO) assessment. The FedRAMP PMO then lists the service on the Marketplace. There is no FedRAMP certificate.

Regulation (a law, no certificate, no auditor opinion)

HIPAA and GDPR are laws. HIPAA is enforced by HHS Office for Civil Rights. GDPR is enforced by national Data Protection Authorities across the EU. Neither produces a certificate. When someone says "we're HIPAA certified," that phrase has no defined legal meaning. What they usually mean is HITRUST, which is the closest certifiable proxy for HIPAA compliance. Procurement teams that ask for a "HIPAA certificate" are asking for something that does not exist.

Contractual standard (validated by a QSA-issued AOC or ROC)

PCI DSS is a contractual compliance requirement maintained by the PCI Security Standards Council, founded by Visa, Mastercard, Amex, Discover, and JCB. Validation produces an Attestation of Compliance (AOC) or, for Level 1 merchants, a Report on Compliance (ROC) from a Qualified Security Assessor. PCI SSC issues no certificates.

Voluntary benchmark (no issuing body, no certificate)

NIST CSF is a voluntary framework published by the National Institute of Standards and Technology. NIST issues nothing. Third-party assessors can produce a maturity score report, but NIST CSF itself has no certification, no certificate, and no public registry. Organizations use it as a governance baseline and, increasingly, as a cyber insurance underwriting input.

Geography decides the floor before industry does

The framework a vendor needs is determined primarily by where their buyers sit, not by what vertical they are in. Industry adds requirements on top. Geography sets the floor.

This matters because vendors often approach compliance as a product decision ("what should we build toward?") when it is actually a sales decision ("what do our next contracts require?"). The table below maps buyer location to the minimum expected credential. A vendor serving buyers across multiple geographies will typically layer these, starting with the one that opens the most revenue.

US B2B SaaS buyers

SOC 2 Type 2 is the de facto floor. Enterprise procurement teams at Series B and beyond expect it. SOC 2 Type 1 is accepted as a short-term interim credential while the observation period for Type 2 runs. See the SOC 2 audit cost guide for sourced ranges on both types.

European enterprise buyers

ISO 27001 is the expected credential. European procurement teams recognize the ISO/IEC mark globally; many do not accept SOC 2 as a substitute without a supplemental mapping document. Use the SOC 2 vs ISO 27001 selector to decide which to pursue first if serving both markets.

EU resident data (regardless of incorporation)

GDPR applies to any organization that processes personal data of EU or EEA residents, regardless of where the organization is incorporated. A US startup with one EU customer is in scope. GDPR is a legal obligation, not an optional credential, and there is no certificate to show for it.

US federal civilian agencies

FedRAMP authorization is mandatory. No FedRAMP ATO means no federal contract. Roughly 80% of authorizations are at the Moderate impact baseline, covering systems that handle CUI, PII, or agency financial data. The timeline is 12–36 months minimum.

US DoD contractors

CMMC Level 2 (C3PAO assessment) is required for contracts involving Controlled Unclassified Information. Phase 2 contract requirements take effect November 2026. CMMC and FedRAMP are distinct; holding one does not satisfy the other.

US healthcare buyers

HIPAA compliance is a legal floor for any vendor signing a Business Associate Agreement. HITRUST r2 or i1 is increasingly expected as the certifiable proof layer on top of HIPAA, particularly when onboarding with health systems or large payers.

Payment card flows (worldwide)

PCI DSS is contractually required by card brands for any entity that stores, processes, or transmits cardholder data. The validation path (SAQ vs. ROC) depends on annual transaction volume. Level 1 merchants (6M+ transactions/year) require an annual QSA-led assessment.

Board governance / cyber insurance

NIST CSF is increasingly used as the shared language between security teams and boards, and as an underwriting input for cyber insurance carriers. It does not open a contract on its own, but it signals maturity in contexts where a formal certification is not required.

The cost axis spans from $1K to $3M+

Compliance costs across these 10 frameworks span roughly two orders of magnitude. The ranges below group the frameworks into three bands based on total first-year spend, using sourced figures from each framework's explainer page. All figures are total program cost, not just auditor fees.

One number that matters more than most vendors advertise: the auditor invoice is typically the smallest line item in a compliance program. For SOC 2 Type 2, the total first-year cost often splits roughly 30% audit fees, 40% readiness tooling, and 30% internal engineering time. That 30/40/30 split, documented in our SOC 2 Type 2 data, holds approximately across ISO 27001 and HITRUST as well. Budget for the program, not just the audit fee.

Full sourced breakdowns for SOC 2 are in the SOC 2 audit cost guide. Each framework's explainer page cites its own source for the cost range shown on its card above.

The next contract decides the next framework

A common question from early-stage SaaS founders is: "Which framework should we start with?" The correct answer is almost always the same: whichever one is written into the next contract you need to close.

Compliance programs are not built in the abstract toward a future that may or may not materialize. They are built to open specific revenue. SOC 2 Type 2 is the credential US enterprise procurement asks for. ISO 27001 is what European enterprise procurement expects. HIPAA plus HITRUST is the combination most health systems require. FedRAMP is mandatory for federal agency contracts. CMMC Level 2 is mandatory for DoD contracts involving CUI. PCI DSS is forced by card processing volume. GDPR is forced by EU resident data, regardless of what else you are pursuing.

Sequencing follows revenue, not abstract maturity. For a US-based B2B SaaS company, the standard progression looks like this: SOC 2 Type 1 (fast proof-of-concept for first enterprise deals) followed by SOC 2 Type 2 (required for procurement at most large enterprises), then ISO 27001 (when European deals start closing), then HITRUST (when health systems enter the pipeline). FedRAMP and CMMC are pursued only when federal or DoD contracts are specifically on the table, because the cost and timeline are too high to pursue speculatively.

The sequencing has a second implication: do not optimize for control overlap before validating that both frameworks are needed. SOC 2 and ISO 27001 share significant control coverage, and a well-run SOC 2 program positions an organization to pursue ISO 27001 more efficiently. But running both simultaneously in year one, before either is complete, splits attention and typically delays both. Build one clean, then extend. See the SOC 2 vs ISO 27001 selector for a structured way to decide which comes first given your specific buyer mix.

For buyers evaluating vendors rather than vendors pursuing compliance: the framework a vendor presents tells you who their customers are. SOC 2 Type 2 means US enterprise customers. ISO 27001 means European or multinational customers. HITRUST means healthcare. FedRAMP means federal agencies. A vendor with SOC 2 and no ISO 27001 is telling you their buyer base is US-centric. That context matters when evaluating whether their security program is calibrated to your risk environment. The buyer-question guides in the buyer-question guides library cover specific vendor evaluation scenarios in more detail.

One last note on sequencing and cost: the frameworks in the heavy band above are not options for early-stage companies. FedRAMP Moderate at $1M–$2M+ and CMMC Level 2 at $100K–$500K total are viable only when there is confirmed federal or DoD revenue on the other side. Pursuing them speculatively burns capital that would produce faster returns in SOC 2 Type 2 or ISO 27001. The directory includes auditors experienced in federal-track programs for when that moment does arrive. Find them in the SOC 2 auditor directory, filtered by specialization.

How these explainers were built

Each of the 10 framework explainers linked above uses the same four-question structure. What it is. Certification or attestation or something else. Who actually needs it. What it costs and how long it takes, with the source named and linked. The cost ranges are sourced to published price pages, issuing-body documents, or third-party surveys, and dated when last checked. We do not round to round numbers or produce point estimates; every figure is a range that reflects real variability by organization size, scope, and starting posture. The evidence-weighting model behind the sourced ranges is in our four-tier source weighting methodology; the underlying math for the SOC 2 figures is on our SOC 2 sources page. For broader reading on how these frameworks interact in practice, the insights library covers the SOC 2 vs. ISO 27001, SOC 2 vs. HIPAA, SOC 2 vs. FedRAMP, and related comparison long-reads.