ISO 27001, SOC 2, NIST CSF or FedRAMP: choose the framework by the question it answers

A framework is useful when its subject matches the decision. An organization may need to show a managed security program, operating controls for a hosted service, a selected system-control baseline or eligibility for a government cloud use. Those are different questions with different evidence. A certificate or report can be valuable and still fail to answer the question being asked. Record product/system scope, assurance audience, required period and the decision authority before choosing the assessment route.

The fictional buyer Juniper needs assurance for a hosted case-management service handling agency information. The seller supplies an ISO certificate for its corporate office, a SOC report for a different service and a claim that it follows NIST. Each deserves a scope comparison. None should be dismissed merely for being different, but none authorizes the buyer to infer coverage of the proposed service. The worked dossier below teaches evidence selection rather than ranking frameworks from weakest to strongest.

Each row produces different evidence, and none of them is a security warranty for a product. What engineering builds and keeps for each is in /frameworks/soc2-for-engineering-teams/, /frameworks/iso-27001-secure-development/ and /frameworks/nist-csf-2-for-product-teams/.

ISO/IEC 27001:2022 specifies requirements for an information security management system. A certificate is meaningful within its stated organization, activities and scope; it is not a product security warranty. Its Annex A lists 93 controls in four themes (organizational, people, physical and technological), and the Statement of Applicability records which apply and why. Check the issued certificate’s scope, status, certification body and relationship to the offered service. The licensed standard contains the normative requirements; a public summary is explanatory material and cannot substitute for a full conformity assessment.

SOC reports are examination reports within AICPA’s assurance framework, not a generic SOC-certified product label. SOC 1 focuses on controls relevant to user entities’ financial reporting; SOC 2 examines a defined system against the Trust Services Criteria, where the common criteria always apply and Availability, Processing Integrity, Confidentiality and Privacy add criteria when they are chosen. Type 1 addresses design at a point in time, while Type 2 includes operating effectiveness over a stated period. Read the opinion, exceptions, complementary customer controls and subservice treatment. A favorable report on a payroll product cannot be transferred to a newly acquired case-management platform merely because the parent company is the same.

NIST CSF 2.0 provides cybersecurity outcomes, grouped under six functions (Govern, Identify, Protect, Detect, Respond and Recover), for organizing current and target profiles. SP 800-53 Revision 5 provides a control catalog whose releases need explicit versioning; release 5.2.0 of 27 August 2025 added guidance on secure software updates and patches in response to Executive Order 14306. Neither a self-declared CSF alignment nor a spreadsheet of selected 800-53 controls is by itself an independent assessment of implementation. A control selection must be tailored to the system, organization and applicable requirements.

For Juniper, an outcome such as managing access needs an implementation: identity lifecycle, role constraints and access revocation in the actual service. Evidence can include a configured policy plus a test showing a revoked user loses access within the stated target. A design diagram alone cannot establish operating effectiveness. Mapping outcomes to controls helps organize evidence requests, but broad crosswalks do not make ISO, SOC, CSF, 800-53 and FedRAMP interchangeable. The implementation must still be examined in the proper scope.

FedRAMP is changing, so stale pilot summaries can mislead procurement. On 10 October 2026 the official 20x overview states that Classes A, B and C are available under finalized rules, links the Consolidated Rules for 2026, and plans Class D for a later phase. It also states that FedRAMP will stop accepting new Rev5 certifications on 11 June 2027. Use the current official rules, important dates and offering-specific status, rather than projecting an old pilot timetable into a current purchasing decision. Do not infer that one class or a provider’s corporate status covers every agency use case.

The decisive question is the exact cloud service offering, boundary and current status relevant to the agency’s intended use, followed by the agency’s own responsibilities and authorization decision. The fixture supplies a Marketplace record for a different service, not the newly proposed one. That mismatch remains unresolved even if the seller has good ISO and SOC evidence. Engineering can prepare boundary diagrams, machine-readable controls and operating evidence while the acquisition and security roles establish the correct route. No guide or sample record can grant a FedRAMP status or an agency authorization.

Keep the decision as data: one row per artifact with what it covers, its period or validity, and whether an independent party produced it, next to the service you are buying. Then a certificate for another product or a self-assessed profile can't quietly count as assurance for this one. The 365-day limit on report age is a buyer's policy, not an AICPA rule; set your own.

{
  "service": "Ledgerline HR",
  "decided_on": "2026-10-10",
  "max_report_age_days": 365,
  "artifacts": [
    {
      "id": "A1",
      "kind": "ISO/IEC 27001:2022 certificate",
      "covers": ["Ledgerline HR", "Ledgerline Payroll"],
      "valid_until": "2028-02-28",
      "independent": true
    },
    {
      "id": "A2",
      "kind": "SOC 2 Type 2 report",
      "covers": ["Ledgerline HR"],
      "period_end": "2026-06-30",
      "exceptions": 2,
      "independent": true
    },
    {
      "id": "A3",
      "kind": "NIST CSF 2.0 profile",
      "covers": ["Ledgerline HR"],
      "independent": false
    },
    {
      "id": "A4",
      "kind": "SP 800-53 control mapping",
      "covers": ["Ledgerline HR"],
      "release": "",
      "independent": false
    }
  ]
}

For the register above it marks the certificate and the SOC 2 report relevant, with the report's two exceptions to read, and the CSF profile and the SP 800-53 mapping as context only: both are self-assessed, and the mapping names no release.

"""Say what each assurance artifact actually tells you about the service you are buying.

Usage: python3 check_assurance.py assurance-register.json
"""

import json
import sys
from datetime import date

with open(sys.argv[1], encoding="utf-8") as f:
    register = json.load(f)
service = register["service"]
today = date.fromisoformat(register["decided_on"])

for a in register["artifacts"]:
    notes = []
    if service not in a["covers"]:
        notes.append(f"does not name {service} in its scope")
    if "valid_until" in a and date.fromisoformat(a["valid_until"]) < today:
        notes.append("expired")
    if "period_end" in a:
        age = (today - date.fromisoformat(a["period_end"])).days
        if age > register["max_report_age_days"]:
            notes.append(f"period ended {age} days ago; ask for a newer report or a bridge letter")
        if a.get("exceptions"):
            notes.append(f"{a['exceptions']} exceptions: read them and the user entity controls")
    if "release" in a and not a["release"]:
        notes.append("names no SP 800-53 release; ask which one, such as 5.2.0")
    if not a["independent"]:
        notes.append("self-assessed: a claim, not an independent assessment")
    status = "relevant" if service in a["covers"] and a["independent"] else "context only"
    print(f"{a['id']} {a['kind']}: {status}" + "".join(f"\n   - {n}" for n in notes))

Sources & further reading

The standards, specifications and documentation behind the guidance above. Each is the evidence for a claim on this page; consult it for detail beyond the defaults and versions listed here.

1. ISO/IEC 27001:2022. Edition 3 (October 2022), with Amendment 1 (2024).
2. AICPA: SOC suite of services
3. AICPA: 2017 Trust Services Criteria (with revised points of focus, 2022)
4. NIST Cybersecurity Framework (CSF) 2.0. CSWP 29 (February 2024).
5. NIST SP 800-53 Rev. 5 and release updates. Rev. 5, with the release 5.2.0 note of 27 August 2025.
6. FedRAMP 20x current overview
7. FedRAMP Consolidated Rules for 2026

Reference information

Tags

Compliance and assurance evidenceRegulation

SDLC phase

Security program

Role

Security leaders

Download this guide as Markdown

Continue exploring