---
key: "assurance-frameworks"
title: "ISO 27001, SOC 2, NIST CSF or FedRAMP: choose the framework by the question it answers"
url: "https://softwaresecurity.com/frameworks/choosing-assurance-frameworks/"
api: "https://softwaresecurity.com/api/v1/articles/assurance-frameworks.json"
domain: "governance"
topic: "Governance \u0026 frameworks"
type: "Guide"
identifiers: []
tags: ["Compliance and assurance evidence","Regulation"]
stages: ["govern"]
roles: ["security-leader"]
license: "CC-BY-4.0"
license_url: "https://creativecommons.org/licenses/by/4.0/"
code_license: "MIT"
---

# ISO 27001, SOC 2, NIST CSF or FedRAMP: choose the framework by the question it answers

Distinguish management systems, technical controls, risk outcomes, independent reports and government cloud requirements before reusing evidence.

Canonical URL: https://softwaresecurity.com/frameworks/choosing-assurance-frameworks/

## In short

Pick the framework by the question you must answer. ISO/IEC 27001 certifies a management system within a stated scope; a SOC 2 report gives an auditor’s opinion on a named service’s controls, at a point in time or over a period; NIST CSF 2.0 describes outcomes; SP 800-53 is a control catalog; FedRAMP decides whether a specific cloud offering may serve US federal agencies. None covers anything outside its stated scope, so read the scope first.

- ISO/IEC 27001:2022 certifies an information security management system. Annex A lists 93 controls in four themes, selected through a Statement of Applicability.
- SOC 2 reports on a named system against the AICPA Trust Services Criteria. Type 1 covers design at a point in time; Type 2 adds operating effectiveness over a period.
- NIST CSF 2.0 (February 2024) has six functions, adding Govern to Identify, Protect, Detect, Respond and Recover. Nobody is certified against it.
- SP 800-53 Revision 5 is at release 5.2.0 (27 August 2025); cite the release, not only the revision.
- FedRAMP 20x Classes A, B and C are available under finalized rules, and FedRAMP plans to stop accepting new Rev5 certifications on 11 June 2027.

## Verify it

1. Compare each certificate’s or report’s scope statement with the exact service being bought.
2. Check that the SOC 2 report period covers the time you rely on, and read every exception and complementary user-entity control.
3. Confirm that any SP 800-53 mapping names its release.
4. Look up the exact service offering’s current status in the FedRAMP Marketplace.

## What you will learn

- Match management-system, service-report and control evidence to distinct questions.
- Avoid treating NIST profiles and crosswalks as certifications.
- Verify current FedRAMP rules and exact offering scope before relying on status.

Audience: Engineers and buyers deciding which assurance evidence answers a customer or procurement question

Before you start:

- Distinguish product verification, organizational controls, maturity and lifecycle practices.

Time: About 26 minutes: 6 to read and 20 for the exercise

## Which assurance question do you need answered?

A framework is useful when its subject matches the decision. An organization may need to show a managed security program, operating controls for a hosted service, a selected system-control baseline or eligibility for a government cloud use. Those are different questions with different evidence. A certificate or report can be valuable and still fail to answer the question being asked. Record product/system scope, assurance audience, required period and the decision authority before choosing the assessment route.

The fictional buyer Juniper needs assurance for a hosted case-management service handling agency information. The seller supplies an ISO certificate for its corporate office, a SOC report for a different service and a claim that it follows NIST. Each deserves a scope comparison. None should be dismissed merely for being different, but none authorizes the buyer to infer coverage of the proposed service. The worked dossier below teaches evidence selection rather than ranking frameworks from weakest to strongest.

## How do the five frameworks compare?

Each row produces different evidence, and none of them is a security warranty for a product. What engineering builds and keeps for each is in /frameworks/soc2-for-engineering-teams/, /frameworks/iso-27001-secure-development/ and /frameworks/nist-csf-2-for-product-teams/.

| Framework | What it is | Current edition or status | Evidence it produces |
| --- | --- | --- | --- |
| ISO/IEC 27001 | Requirements for an information security management system | 2022 edition, with Amendment 1 of 2024 on climate change | A certificate from an accredited body with a scope statement |
| SOC 2 | An auditor’s examination of a service organization’s controls against the Trust Services Criteria | 2017 criteria with points of focus revised in 2022 | A Type 1 or Type 2 report, with exceptions and complementary user-entity controls |
| NIST CSF | Cybersecurity outcomes, organized into current and target profiles | 2.0, February 2024 | A profile; there is no certification |
| NIST SP 800-53 | A catalog of security and privacy controls | Revision 5, release 5.2.0 of 27 August 2025 | A selected, tailored baseline with assessment results (SP 800-53A) |
| FedRAMP | The US government program for cloud services used by federal agencies | Rev5 baselines; 20x Classes A–C available, Class D planned; new Rev5 certifications end 11 June 2027 | The status of one cloud service offering in the FedRAMP Marketplace |

## What does an ISO 27001 certificate or a SOC 2 report cover?

ISO/IEC 27001:2022 specifies requirements for an information security management system. A certificate is meaningful within its stated organization, activities and scope; it is not a product security warranty. Its Annex A lists 93 controls in four themes (organizational, people, physical and technological), and the Statement of Applicability records which apply and why. Check the issued certificate’s scope, status, certification body and relationship to the offered service. The licensed standard contains the normative requirements; a public summary is explanatory material and cannot substitute for a full conformity assessment.

SOC reports are examination reports within AICPA’s assurance framework, not a generic SOC-certified product label. SOC 1 focuses on controls relevant to user entities’ financial reporting; SOC 2 examines a defined system against the Trust Services Criteria, where the common criteria always apply and Availability, Processing Integrity, Confidentiality and Privacy add criteria when they are chosen. Type 1 addresses design at a point in time, while Type 2 includes operating effectiveness over a stated period. Read the opinion, exceptions, complementary customer controls and subservice treatment. A favorable report on a payroll product cannot be transferred to a newly acquired case-management platform merely because the parent company is the same.

## What do NIST CSF 2.0 and SP 800-53 give you, and what don't they?

NIST CSF 2.0 provides cybersecurity outcomes, grouped under six functions (Govern, Identify, Protect, Detect, Respond and Recover), for organizing current and target profiles. SP 800-53 Revision 5 provides a control catalog whose releases need explicit versioning; release 5.2.0 of 27 August 2025 added guidance on secure software updates and patches in response to Executive Order 14306. Neither a self-declared CSF alignment nor a spreadsheet of selected 800-53 controls is by itself an independent assessment of implementation. A control selection must be tailored to the system, organization and applicable requirements.

For Juniper, an outcome such as managing access needs an implementation: identity lifecycle, role constraints and access revocation in the actual service. Evidence can include a configured policy plus a test showing a revoked user loses access within the stated target. A design diagram alone cannot establish operating effectiveness. Mapping outcomes to controls helps organize evidence requests, but broad crosswalks do not make ISO, SOC, CSF, 800-53 and FedRAMP interchangeable. The implementation must still be examined in the proper scope.

## How do you check a FedRAMP route and status in 2026?

FedRAMP is changing, so stale pilot summaries can mislead procurement. On 10 October 2026 the official 20x overview states that Classes A, B and C are available under finalized rules, links the Consolidated Rules for 2026, and plans Class D for a later phase. It also states that FedRAMP will stop accepting new Rev5 certifications on 11 June 2027. Use the current official rules, important dates and offering-specific status, rather than projecting an old pilot timetable into a current purchasing decision. Do not infer that one class or a provider’s corporate status covers every agency use case.

The decisive question is the exact cloud service offering, boundary and current status relevant to the agency’s intended use, followed by the agency’s own responsibilities and authorization decision. The fixture supplies a Marketplace record for a different service, not the newly proposed one. That mismatch remains unresolved even if the seller has good ISO and SOC evidence. Engineering can prepare boundary diagrams, machine-readable controls and operating evidence while the acquisition and security roles establish the correct route. No guide or sample record can grant a FedRAMP status or an agency authorization.

## How do you record what each artifact tells you?

Keep the decision as data: one row per artifact with what it covers, its period or validity, and whether an independent party produced it, next to the service you are buying. Then a certificate for another product or a self-assessed profile can't quietly count as assurance for this one. The 365-day limit on report age is a buyer's policy, not an AICPA rule; set your own.

```json
{
  "service": "Ledgerline HR",
  "decided_on": "2026-10-10",
  "max_report_age_days": 365,
  "artifacts": [
    {
      "id": "A1",
      "kind": "ISO/IEC 27001:2022 certificate",
      "covers": ["Ledgerline HR", "Ledgerline Payroll"],
      "valid_until": "2028-02-28",
      "independent": true
    },
    {
      "id": "A2",
      "kind": "SOC 2 Type 2 report",
      "covers": ["Ledgerline HR"],
      "period_end": "2026-06-30",
      "exceptions": 2,
      "independent": true
    },
    {
      "id": "A3",
      "kind": "NIST CSF 2.0 profile",
      "covers": ["Ledgerline HR"],
      "independent": false
    },
    {
      "id": "A4",
      "kind": "SP 800-53 control mapping",
      "covers": ["Ledgerline HR"],
      "release": "",
      "independent": false
    }
  ]
}
```

## What does the register check print?

For the register above it marks the certificate and the SOC 2 report relevant, with the report's two exceptions to read, and the CSF profile and the SP 800-53 mapping as context only: both are self-assessed, and the mapping names no release.

```python
"""Say what each assurance artifact actually tells you about the service you are buying.

Usage: python3 check_assurance.py assurance-register.json
"""

import json
import sys
from datetime import date

with open(sys.argv[1], encoding="utf-8") as f:
    register = json.load(f)
service = register["service"]
today = date.fromisoformat(register["decided_on"])

for a in register["artifacts"]:
    notes = []
    if service not in a["covers"]:
        notes.append(f"does not name {service} in its scope")
    if "valid_until" in a and date.fromisoformat(a["valid_until"]) < today:
        notes.append("expired")
    if "period_end" in a:
        age = (today - date.fromisoformat(a["period_end"])).days
        if age > register["max_report_age_days"]:
            notes.append(f"period ended {age} days ago; ask for a newer report or a bridge letter")
        if a.get("exceptions"):
            notes.append(f"{a['exceptions']} exceptions: read them and the user entity controls")
    if "release" in a and not a["release"]:
        notes.append("names no SP 800-53 release; ask which one, such as 5.2.0")
    if not a["independent"]:
        notes.append("self-assessed: a claim, not an independent assessment")
    status = "relevant" if service in a["covers"] and a["independent"] else "context only"
    print(f"{a['id']} {a['kind']}: {status}" + "".join(f"\n   - {n}" for n in notes))
```

## Guided practice

Juniper is reviewing CaseHub Cloud for an agency use. Match each offered assurance artifact to the actual question.

### Supplied material

```text
Proposed service: CaseHub Cloud, newly acquired by supplier Pine; stores agency case records; final agency impact/use classification pending.
E1 ISO/IEC 27001:2022 certificate: Pine corporate IT office operations; CaseHub development/hosting not named in supplied scope.
E2 SOC 2 Type 2: Pine Payroll Cloud, Jan–Dec 2025; not CaseHub; customer must configure MFA.
E3 CSF 2.0 profile: self-assessed, includes target access-management outcomes; no tests attached.
E4 800-53 Rev5 mapping: selected controls, release unspecified; no assessment results.
E5 official Marketplace extract supplied in fixture: Pine Payroll Cloud record; no CaseHub record supplied.
E6 CaseHub test proposal: disable test user; require new API calls denied within 5 minutes; no test run yet.
Roles: buyer engineer Esme; acquisition lead Finn; agency security authorizer role Gray. All fictional.
```

### 1. Define the decision

State the offering and unresolved user-side classification.

Worked answer: The decision concerns CaseHub Cloud handling the intended agency case data, not Pine in general or Payroll Cloud. Finn/Gray must establish the applicable acquisition/agency route and use classification.

### 2. Read ISO and SOC scope

Decide whether E1/E2 establish assurance of CaseHub.

Worked answer: They do not from the supplied scopes. E1 covers corporate IT; E2 covers Payroll and a past period. They may inform supplier context, but CaseHub coverage needs explicit evidence. MFA remains a customer responsibility where applicable.

### 3. Interpret the NIST artifacts

Describe E3/E4 without calling them certifications.

Worked answer: E3 is a self-assessed outcome profile; E4 is a control-selection mapping with incomplete release identification. Neither provides implementation/effectiveness results. Request exact adopted release, scope and supporting observations.

### 4. Assess the federal offering claim

Evaluate E5 and the supplier inference.

Worked answer: A record for Payroll does not establish CaseHub status. Verify the exact offered service and applicable current FedRAMP rules/status, then the agency decision. Do not copy a parent-company or unrelated-offering label.

### 5. Create one concrete evidence request

Turn E6 into an acceptance observation and assign responsibility.

Worked answer: Esme requests a scoped test record with CaseHub artifact/configuration, user disable time and denied API attempts no later than five minutes afterward, plus repeat/session-token conditions. Record test pending now. Finn/Gray resolve route/scope; no approval is implied.

Deliverable: An assurance-source selection record with five scope limitations and one testable service-specific evidence request.

Scope: This is a fictional procurement analysis; the supplier, services, certificates and Marketplace records are invented.

Articles and teaching material: CC BY 4.0. Original executable code: MIT. Attribution: Software Security.

## Sources

- [ISO/IEC 27001:2022](https://www.iso.org/standard/27001). Edition 3 (October 2022), with Amendment 1 (2024).
- [AICPA: SOC suite of services](https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services)
- [AICPA: 2017 Trust Services Criteria (with revised points of focus, 2022)](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022)
- [NIST Cybersecurity Framework (CSF) 2.0](https://csrc.nist.gov/pubs/cswp/29/the-nist-cybersecurity-framework-csf-20/final). CSWP 29 (February 2024).
- [NIST SP 800-53 Rev. 5 and release updates](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final). Rev. 5, with the release 5.2.0 note of 27 August 2025.
- [FedRAMP 20x current overview](https://www.fedramp.gov/20x/)
- [FedRAMP Consolidated Rules for 2026](https://www.fedramp.gov/2026/)