For customers looking to provide certification from an audit;

1. ISO 27001: ISO 27001 empowers organizations to manage the security of assets like financial information, intellectual property, and employee details. It provides a risk-based approach to information security management systems (ISMS) and is widely recognized globally.
   • Better known worldwide for global customers
   • To become ISO 27001 certified, internal audits will be performed based on an ISMS and an external auditor will conduct the Certification Audit. Surveillance audits will be then conducted annually thereafter each year for two years to ensure ongoing compliance.
2. SOC 2 Type II: SOC 2 focuses on trust services criteria (TSC) related to security, availability, processing integrity, confidentiality, and privacy. It’s relevant for service/product organizations and assesses controls-based compliance.
   • Typically more focused on US based SaaS providers.
   • While there are many SOC versions (SOC1, SOC2, SOC3) as well as types (Type 1 is a point in time, Type 2 is a longer-term assessment) a SOC2 Type II is preferred when reviewing a company’s ability to protect your organizations data.
3. NIST 800-171/CMMC: NIST 800-171 protects Controlled Unclassified Information (CUI) in nonfederal systems. Organizations can incorporate it into ISO 27001 or SOC 2 programs.
   • If your organization receives CUI, you NIST 800-171 guides how the data is to be handled.
   • All DOD contractors will eventually be required to obtain a CMMC certification. This includes all suppliers at all tiers.
4. UK Cyber Essentials: Cyber Essentials is a United Kingdom certification scheme designed to demonstrate an organization’s minimum level of protection in cybersecurity. It involves annual assessments to maintain certification and is backed by the UK government and overseen by the National Cyber Security Centre (NCSC). The scheme offers two certification types:
   • Cyber Essentials: A self-assessment option that protects against common cyber attacks. It ensures your defenses guard against basic threats, making you less likely to be targeted by cybercriminals.
   • Cyber Essentials Plus: Similar to the basic version, but with a hands-on technical verification
5. HITRUST: HITRUST is an acronym for the Health Information Trust (HITRUST) Alliance. The Alliance is an independent testing organization. HITRUST offers what is known as the “HITRUST CSF®,” a security framework that provides organizations with a comprehensive and flexible approach to HIPAA compliance and risk management. 

Frameworks for better Information Security Governance;

1. CIS (Center for Internet Security): CIS provides security best practices and benchmarks for various technologies and platforms.
   • Provides a standard list of Controls for best practices in cybersecurity.
   • Benchmarks provide configuration guidelines.
2. COBIT (Control Objectives for Information and Related Technologies): COBIT focuses on IT governance and management. It helps align business goals with IT processes and controls.

We hope this article offers some clarity to the various standards and frameworks. If you are still unsure of where to start, information regarding implementation and scope are widely available and consultants can also offer insight into what is the best way to protect your organization.