Which frameworks?

Which frameworks do we need?

Ten plain questions about your customers, how you take cards, the data you hold and your deadline. You'll see which frameworks apply and why, what to start with, your likely PCI DSS SAQ and whether to get a SOC 2 Type I or Type II.

Your answers stay in this browser: nothing is sent to us or stored. This is a starting point worked out from your answers, not legal or compliance advice. Confirm it with your auditor, QSA or consultant before you act on it.

Who are your customers?

Pick all that apply. Different customers ask for different proof. Businesses ask for SOC 2 or ISO 27001, healthcare asks about HIPAA, and governments have their own programmes.

Members of the publicSmall and mid-sized businessesLarge companies (enterprise)Healthcare organisationsProviders, insurers, health techGovernment or defencePeople or businesses in the EU or UK

Do you hold or handle your customers' data for them?

For example, customers log in to software you run, or send you files to work on. A SOC 2 report exists to show customers how you look after their data.

YesNo

Has a customer, prospect or consultant asked you for any of these?

Pick all that apply. A request from a real customer usually decides what to do first.

A SOC 2 reportAn ISO 27001 certificateIncluding a tender, contract or supplier form that asks for itPCI DSS proofAn SAQ or Attestation of Compliance (AOC)A HIPAA business associate agreement (BAA)A security questionnaireNone of these yet

Do you accept payment cards, or store, process or send card data for other businesses?

Credit or debit cards. Every business that accepts cards must meet PCI DSS, and so does one that handles card data for other businesses. How you take or handle cards decides how much of it applies to you.

NoYesNot sure

Do you handle health information about people?

HIPAA applies to US healthcare providers, health plans and clearinghouses (covered entities), and to companies that handle health information for them (business associates).

NoYes: we are a healthcare provider, health plan or clearinghouseYes: we handle it for a healthcare organisationNot sure

Do you hold personal data about people in the EU or UK?

Customers, users or staff. GDPR (and the UK GDPR) applies to personal data about people there, wherever your company is.

YesNoNot sure

Do you sell, or plan to sell, to government?

Pick all that apply. Government buyers have their own programmes: FedRAMP for US federal cloud services, CMMC for US defence work, Cyber Essentials for UK public contracts.

A cloud service for US federal agenciesUS Department of Defense work, directly or as a subcontractorUK government or public-sector contractsNo

How many people work at your company?

Counting everyone, including contractors. Size changes how much process an auditor expects and what to start with.

1 to 1011 to 5051 to 200More than 200

When do you need a report or certificate?

Some reports cover a period of months, so a near deadline changes which one to get first.

Within 3 monthsWithin 6 monthsWithin a yearNo date yet