SOC 2
Comparisons anchored on SOC 2, the AICPA attestation report on a service organization's controls: against HIPAA, PCI DSS, the GDPR, SOX, the NIST CSF, NIST SP 800-53, ISO 42001, the CIS Controls, NIS2 and DORA.
Compliance frameworks
Head-to-head comparisons of security and compliance frameworks, regulations and certifications: who each one applies to, what proof it produces (certificate, attestation report, regulator supervision or none), where official mappings exist, and which to do first.
ISO 27001
Comparisons anchored on ISO/IEC 27001:2022, the certifiable information security management system standard: against HIPAA, PCI DSS and the EU Cyber Resilience Act.
GDPR
Comparisons anchored on the GDPR, the EU's data protection regulation: against HIPAA, ISO 27001 and PCI DSS. EU law pairings with NIS2, DORA and the EU AI Act sit under those anchors.
NIST CSF 2.0
Comparisons anchored on the NIST Cybersecurity Framework 2.0, NIST's voluntary outcome framework with no certification: against NIST SP 800-53, HIPAA, PCI DSS, the NIST AI RMF and NERC CIP.
CMMC
Comparisons anchored on CMMC, the DoD's Cybersecurity Maturity Model Certification program under 32 CFR Part 170: against NIST SP 800-171, NIST SP 800-53, ISO 27001, SOC 2 and the NIST CSF.
NIST SP 800-171
Comparisons anchored on NIST SP 800-171, the requirements for protecting controlled unclassified information in nonfederal systems: against the NIST CSF, ISO 27001 and SOC 2. CMMC and SP 800-53 pairings sit under those anchors.
HIPAA Security Rule
Comparisons anchored on the HIPAA Security Rule (45 CFR Part 164 Subpart C) for electronic protected health information: against HITRUST, PCI DSS and NIST SP 800-53. HIPAA pairings with SOC 2, ISO 27001, the GDPR and the NIST CSF sit under those anchors.
HITRUST CSF
Comparisons anchored on the HITRUST CSF and its e1, i1 and r2 certifications: against ISO 27001 and the NIST CSF. HIPAA vs HITRUST sits under the HIPAA anchor.
PCI DSS
Comparisons anchored on PCI DSS v4.0.1, the payment card industry data security standard: against SOX IT general controls and the CIS Controls. PCI DSS pairings with SOC 2, ISO 27001, HIPAA, the GDPR and the NIST CSF sit under those anchors.
NIS2
Comparisons anchored on the NIS2 Directive, Directive (EU) 2022/2555: against the Cyber Resilience Act, the GDPR and the NIST CSF.
DORA
Comparisons anchored on DORA, Regulation (EU) 2022/2554 on digital operational resilience for the financial sector: against ISO 27001 and the GDPR.
EU AI Act
Comparisons anchored on the EU AI Act, Regulation (EU) 2024/1689 as amended in 2026: against the NIST AI RMF, the GDPR and the Cyber Resilience Act.
Essential Eight
Comparisons anchored on ASD's Essential Eight mitigation strategies and maturity model: against ISO 27001, the NIST CSF, the CIS Controls and SOC 2.
CIS Controls
Comparisons anchored on the CIS Critical Security Controls v8.1 and their Implementation Groups: against ISO 27001 and NIST SP 800-53.
SOX ITGC
Comparisons anchored on SOX IT general controls, the technology controls public companies test for Section 404 internal control over financial reporting: against ISO 27001, the NIST CSF, HIPAA and the GDPR.
SWIFT CSCF
Comparisons anchored on the Swift Customer Security Controls Framework, the mandatory annual attestation for institutions connected to Swift: against PCI DSS, ISO 27001, the NIST CSF, SOC 2 and DORA.
NERC CIP
Comparisons anchored on the NERC CIP Reliability Standards, the mandatory cybersecurity standards for the North American bulk electric system: against NIST SP 800-53, ISO 27001, NIS2 and the CIS Controls.
Compliance requirements compared
Single-requirement comparisons across frameworks: incident reporting deadlines, penetration testing, fines, log retention, MFA, patching, third-party risk, management accountability, audit frequency, published costs and the kind of proof each framework produces.
Compliance frameworks compared
Roundups that compare several compliance frameworks for one kind of organization or one sector: which apply, what proof each produces, how they overlap and which to do first.
