Cloud security standards come in three layers: certifications (SOC 2, ISO 27001), frameworks (NIST CSF, CIS Benchmarks), and regulations (HIPAA, PCI-DSS, GDPR). Pick the ones your customers actually ask about.
Table of contents
- The three layers
- SOC 2
- ISO 27001
- NIST CSF and CIS
- HIPAA, PCI-DSS, GDPR
- What buyers actually ask
- The compliance framework deep dive
- The roadmap for a startup
- FAQ
The three layers
The standards fall into three layers:
- Certifications. Third-party audits that produce a report. SOC 2 Type II, ISO 27001, PCI-DSS.
- Frameworks. Documents that describe how to think about security. NIST CSF, CIS Controls, ISO 27002.
- Regulations. Legal requirements that the team must follow. HIPAA, GDPR, CCPA.
The team that sells to enterprise customers needs certifications. The team that operates uses frameworks. The team that operates in regulated industries follows regulations.
SOC 2
The most common enterprise security certification. SOC 2 is an audit of the team’s controls against five Trust Service Criteria: Security, Availability, Processing Integrity, Confidentiality, Privacy.
Type I covers a point in time. Type II covers a period (typically 6-12 months). Most enterprise customers require Type II.
The team that wants SOC 2 Type II in 6-12 months hires an auditor and a compliance platform (Vanta, Drata, Secureframe). The team that does it manually has a much longer timeline.
ISO 27001
The international standard for information security management. The team that operates globally (especially in Europe) usually wants ISO 27001.
ISO 27001 is more comprehensive than SOC 2 but less specific to SaaS. The team that has ISO 27001 has the right baseline for global enterprise sales; the team that has SOC 2 Type II but no ISO 27001 has gaps in the European market.
NIST CSF and CIS
NIST CSF (Cybersecurity Framework). The right framework for thinking about security across the lifecycle: Identify, Protect, Detect, Respond, Recover. Most large organizations use NIST CSF as the basis for their security program.
CIS Benchmarks. Configuration baselines for specific systems. The CIS Ubuntu Benchmark, CIS Kubernetes Benchmark, CIS PostgreSQL Benchmark. The team that hardens a system uses the CIS Benchmark for that system.
HIPAA, PCI-DSS, GDPR
HIPAA. The US regulation for healthcare data. The team that handles PHI (Protected Health Information) must follow HIPAA. Most cloud providers offer HIPAA-compliant configurations; the team that uses them gets a Business Associate Agreement (BAA).
PCI-DSS. The Payment Card Industry Data Security Standard. The team that processes credit cards must follow PCI-DSS. The team that uses a payment processor (Stripe, Adyen) offloads most of the PCI compliance burden.
GDPR. The EU data protection regulation. The team that handles EU personal data must follow GDPR. The team that operates globally has a GDPR program regardless of where they’re based.
What buyers actually ask
The certifications that come up in enterprise sales calls:
- SOC 2 Type II. The most common. Required by 80%+ of enterprise customers.
- ISO 27001. The second most common. Required by European and global enterprises.
- HIPAA. Required by healthcare customers.
- PCI-DSS. Required by customers who process credit cards directly.
The certifications that don’t matter as much:
- SOC 2 Type I. Almost no customer accepts Type I over Type II.
- ISO 27017/27018. Cloud-specific extensions to ISO 27001; nice to have but rarely required.
- FedRAMP. Only required for US federal government customers.
The compliance framework deep dive
A closer look at each framework:
SOC 2. AICPA’s Trust Services Criteria. Five categories: Security (mandatory), Availability, Confidentiality, Processing Integrity, Privacy. The audit produces a report that customers can request. The team that wants SOC 2 hires an auditor (Big 4 accounting firms or specialized firms like Schellman, A-LIGN, Drata’s auditors).
ISO 27001. International standard from ISO/IEC. Covers information security management systems (ISMS). The audit produces a certificate. The team that wants ISO 27001 implements an ISMS, then hires an accredited certification body (BSI, TÜV, Lloyd’s Register).
HIPAA. US healthcare regulation. Covers Protected Health Information (PHI). There’s no formal HIPAA certification; the team that handles PHI attests to HIPAA compliance and signs Business Associate Agreements (BAAs) with cloud providers.
PCI-DSS. Payment Card Industry Data Security Standard. Covers credit card data. There are four levels of compliance based on transaction volume. Level 1 (6M+ transactions/year) requires a full audit; Level 4 (<20K transactions/year) can self-assess.
GDPR. EU data protection regulation. Covers personal data of EU residents. There’s no formal certification; the team that processes EU personal data appoints a Data Protection Officer (DPO) and implements the GDPR controls.
The roadmap for a startup
The right compliance roadmap for a startup:
Year 0-1. No formal certifications. Focus on security basics: key-based auth, encryption at rest and in transit, audit logging, vulnerability management. The team that has these has a good foundation.
Year 1-2. First SOC 2 Type II. Most enterprise customers will require it by this point. Use a compliance platform (Vanta, Drata, Secureframe) to automate the evidence collection. The team that starts the SOC 2 process in year 1 has it in year 2.
Year 2-3. ISO 27001 if the team has European customers or is considering expansion to Europe. HIPAA if the team starts handling healthcare data. PCI-DSS if the team starts processing credit cards directly (not via Stripe).
The team that follows this roadmap has the right certifications at the right stage. The team that chases every certification simultaneously is overwhelmed and achieves none well.
FAQ
What’s the most important cloud security certification?
SOC 2 Type II for the US enterprise market. ISO 27001 for the European and global market. The team that has both covers the most ground.
How long does it take to get SOC 2 Type II?
6-12 months with a compliance platform (Vanta, Drata). 12-18 months without one. The team that starts now has SOC 2 Type II in a year.
Do I need SOC 2 if I’m a startup?
Depends on the customer. The team that sells to enterprises needs SOC 2. The team that sells to consumers or SMBs doesn’t, usually.
What’s the difference between SOC 2 and ISO 27001?
SOC 2 is US-centric, audit-focused, and SaaS-friendly. ISO 27001 is international, management-system-focused, and broader in scope. The team that has both covers the most ground.
How long does SOC 2 Type II take?
6-12 months with a compliance platform (Vanta, Drata). 12-18 months without one. The Type II period is typically 6-12 months; the audit starts after the controls have been operating for that long.
What’s the difference between SOC 2 and ISO 27001?
SOC 2 is US-centric, audit-focused, and SaaS-friendly. ISO 27001 is international, management-system-focused, and broader in scope. The team that has both covers the most ground; the team that has only SOC 2 has gaps in Europe.
Is there a free compliance framework?
CIS Controls and NIST CSF are free. The team that follows these has a solid security baseline without paying for a formal certification. Formal certifications (SOC 2, ISO 27001) require paid audits.
If you are sizing the infrastructure for the kind of project this post covers, the RunxBuild hosting calculator is the right place to model the line items. The compute, the memory, the storage, the bandwidth, the database - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers. The RunxBuild dashboard is where the team sees the actual usage in one place.
Useful related references: