Roundups that compare several compliance frameworks for one kind of organization or one sector: which apply, what proof each produces, how they overlap and which to do first.
For SaaS founders and security leads deciding which framework to pursue first: SOC 2, ISO 27001, HIPAA, PCI DSS and the GDPR compared by who asks for each, what proof it produces, audit cycle, published cost figures and overlap, with a scenario table for US-only, EU-facing, health and payments customers.
For hospitals, health plans and health tech vendors: HIPAA, HITRUST, SOC 2, ISO 27001 and the NIST CSF compared by legal status, certificate or report, cycle and fit, including recognized security practices under the 2021 HITECH amendment and the proposed Security Rule changes that would add yearly testing.
For banks, payment institutions and fintechs mapping their obligations: PCI DSS, SOX ITGCs, the Swift CSCF, DORA and TIBER-EU compared by who imposes each, scope, assessment and testing cadence, with a scenario table for card issuers, listed banks, Swift users and EU entities identified for threat-led testing.
For companies working out which EU laws apply: NIS2, DORA, the Cyber Resilience Act, the EU AI Act and the GDPR compared by what they regulate (entities, financial ICT risk, products, AI systems, personal data), application dates, conformity assessment or supervision, reporting and maximum fines, plus how DORA overrides NIS2 for financial entities.
For AI product teams and risk leaders choosing a governance approach: the binding EU AI Act, the certifiable ISO/IEC 42001 management system and the voluntary NIST AI RMF compared by legal force, scope, proof, cost signals and how they combine, with scenarios for EU high-risk providers, enterprise AI vendors and US-only builders.
For contractors and agencies sorting out NIST SP 800-53, NIST SP 800-171, CMMC and the NIST CSF: which applies to federal systems, CUI in contractor systems, DoD contracts or voluntary programs, how the control sets derive from each other, the Rev. 2 versus Rev. 3 question and the current CMMC phase.
For organizations choosing a framework to run their security program on when no regulator dictates one: NIST CSF 2.0, the CIS Controls, ISO 27001, NIST SP 800-53 and the Essential Eight compared by structure, prescriptiveness, certification, licensing and size fit, with scenarios for small teams, regulated enterprises and Australian organizations.
For utilities and energy companies on both sides of the Atlantic: NERC CIP, NIS2 and the NIST CSF compared by legal force, which assets and entities are in scope, incident reporting clocks, audits and penalties, and how the voluntary CSF ties the two mandatory regimes together.
For software makers and SaaS providers selling into the EU: what the Cyber Resilience Act asks of products, what NIS2 asks of cloud and managed service providers and passes down through supply chain clauses, what DORA asks of ICT third-party providers to banks, what the AI Act asks of AI system providers and what the GDPR asks of processors.
For MSPs and MSSPs deciding what to certify against: NIS2 brings managed service providers directly into scope, CMMC treats them as external service providers, DORA reaches ICT providers to financial entities, and customers ask for SOC 2 or ISO 27001. Compares what each requires of the provider and which proof to invest in first.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.