Comparisons anchored on NIST SP 800-171, the requirements for protecting controlled unclassified information in nonfederal systems: against the NIST CSF, ISO 27001 and SOC 2. CMMC and SP 800-53 pairings sit under those anchors.
Required versus voluntary: SP 800-171 sets 97 Rev. 3 requirements (110 in the Rev. 2 that DoD still enforces) for CUI in contractor systems, while CSF 2.0 sets outcomes for any organization. Covers the CSF 2.0 to SP 800-171 Rev. 3 mapping in NIST's Reference Tool, who decides compliance, and when a contractor needs both.
For suppliers with US government CUI and international customers: SP 800-171 is a fixed requirement set flowed down by contract and assessed against SP 800-171A, while ISO/IEC 27001 is a risk-based ISMS certified by a certification body. Covers what each proves, assessment and evidence rules, cycles, published cost estimates and which to do first.
For IT and SaaS providers to defense and federal contractors: SP 800-171 applies when you handle CUI, while SOC 2 is the attestation commercial buyers expect. Compares requirement sets, who assesses (the contractor, a C3PAO or a CPA firm), scoring and evidence retention, report periods and cost estimates, and when a provider ends up needing both.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.