Compliance frameworks confuse people because they overlap heavily and are aimed at different audiences. The fastest way to sort them out is to ask who is demanding it and what they want proof of.
Nearly all of them require broadly the same underlying security work. The difference is the audience and the evidence format.
SOC 2
An attestation report produced by a certified public accounting firm, used mainly by technology companies to answer customer security questions. It is not a certification and there is no certificate.
It is built around Trust Services Criteria. Security is mandatory, and availability, confidentiality, processing integrity, and privacy are optional additions depending on what you are claiming.
Type I says your controls were designed appropriately on a specific date. Type II says they operated effectively over a period, usually 3 to 12 months. Type II is the one customers actually want, and it takes time by definition because it requires a period of evidence.
The most important thing to know when reading someone else's report is that scope is chosen by the company. A SOC 2 covering a different product than the one you are buying is common and is the single most useful thing to check.
ISO/IEC 27001
An international standard for an information security management system, and unlike SOC 2 it is a genuine certification with a certificate and a defined three year cycle including surveillance audits.
It is more about the management system than about specific technical controls: scope, policy, risk assessment, a statement of applicability, internal audit, management review, and continual improvement. Annex A lists the controls, and the 2022 revision reorganized them into four themes.
It is more recognized internationally than SOC 2, and it is often the answer when a European or Asian customer asks for proof.
CMMC
Cybersecurity Maturity Model Certification applies to the United States defense industrial base. If you handle Federal Contract Information or Controlled Unclassified Information under Department of Defense contracts, this is not optional.
It is built on NIST SP 800-171 and has tiered levels, with the higher levels requiring third party assessment rather than self attestation.
For small suppliers this is frequently the hardest compliance problem they face, because the requirements were written for organizations with real security functions. It is covered specifically in Week 5 of the mentorship because it matters a great deal to companies in the defense supply chain.
PCI DSS
The Payment Card Industry Data Security Standard applies if you handle payment card data. It is enforced through contracts with card brands and acquiring banks rather than by law.
It is the most prescriptive of the common standards. It tells you specifically what to do, which some teams find refreshing and others find rigid.
The most valuable move in PCI is scope reduction. Every system that touches card data is in scope, so tokenization, network segmentation, and outsourcing the payment page shrink the problem dramatically. That is one of the strongest practical arguments for segmentation in any environment.
HIPAA and GDPR
HIPAA is United States law covering protected health information. The Security Rule is deliberately flexible, with required and addressable implementation specifications, which means there is no certificate and no checklist that ends the conversation.
GDPR is European Union law covering personal data of people in the EU, and it applies based on whose data you process rather than where your company is. Its security requirement is short and principle based, requiring appropriate technical and organizational measures.
What GDPR adds beyond security is a set of obligations around lawful basis, data subject rights, breach notification within 72 hours, and records of processing. Those are legal obligations that security work supports rather than replaces.
How to Not Do Everything Twice
Build one internal control set, ideally based on the CIS Controls or NIST SP 800-53, then map it to each standard you need. CIS and NIST both publish mappings.
Collect evidence continuously rather than assembling it before each audit. Evidence produced by the process is cheap. Evidence reconstructed for the auditor is expensive and often incomplete.
Keep one scope definition and one asset inventory, because scope disputes are where audits actually get expensive.
The Sentence Worth Repeating
Compliance is a floor, not a ceiling. Every one of these standards is a generic minimum written to be assessable across thousands of different organizations.
Companies that build a real program find audits straightforward, because the evidence already exists. Companies that build for the audit produce controls that pass tests and fail attackers. The difference shows up in exactly one place, which is when something actually goes wrong.
Learn This at HackRange
Week 5 of the mentorship covers the framework landscape and then makes you produce real audit evidence, which is where the theory stops being theory.