Security & Compliance Frameworks
What this section covers
A plain-language explanation of each major government and industry security framework — what it is, who it applies to, how it’s structured, and how the frameworks relate to one another. Plus a decision guide: which framework you actually need, based on the data you hold and who you sell to.
Who it’s for
Engineering leads, founders, and program staff deciding how to make a platform compliant — and what “compliant” even means for their data. No prior compliance background assumed; jargon is explained on first use.
Disclaimer. Not legal or compliance advice. Frameworks, control counts, and timelines change. Every figure here is dated and cited; verify against the authoritative source before relying on it. When stakes are high, engage a qualified assessor (3PAO / C3PAO / QSA / ISO auditor).
Figures verified 2026-05-29.
The one-sentence version
Build to FedRAMP High / NIST 800-53, and almost everything else becomes a mapping exercise. FedRAMP High is built on the most rigorous NIST control baseline; SOC 2, ISO 27001, StateRAMP, and CMMC Level 2 are largely subsets you can satisfy with the same controls and evidence. That’s why this platform’s security FRD targets FedRAMP and treats every control as an à-la-carte module.
This is a deliberate strategy, not a claim that FedRAMP is literally “required” everywhere. See Choosing your framework below for the honest nuance — purely commercial buyers usually ask for SOC 2 or ISO 27001, not FedRAMP.
The frameworks at a glance
| Framework | Who requires it | What it protects | Built on | This doc |
|---|---|---|---|---|
| FedRAMP | US federal agencies buying cloud services | Federal data in cloud (SaaS/IaaS/PaaS) | NIST 800-53 Rev 5 | FedRAMP |
| FISMA | US federal agencies & their systems | All federal information systems | NIST 800-53 / RMF | FISMA |
| NIST SP 800-53 | (the control catalog itself) | Confidentiality, integrity, availability | — | NIST 800-53 |
| NIST SP 800-63 | (the identity standard itself) | Identity proofing, authentication, federation | — | NIST 800-63 (IAL/AAL/FAL) |
| NIST 800-171 / CMMC | DoD contractors handling CUI | Controlled Unclassified Information | NIST 800-171 / -172 | NIST 800-171 & CMMC |
| DoD Impact Levels / StateRAMP | DoD (IL2–6) / US state & local govts | Defense / state-government cloud data | FedRAMP + extras | StateRAMP & DoD ILs |
| ISO/IEC 27001 | Commercial & international buyers | Information Security Mgmt System (ISMS) | — | ISO 27001 |
| SOC 2 | Commercial B2B / SaaS buyers | Trust over a service org’s controls | AICPA TSC | SOC 2 |
| HIPAA | Anyone handling US health data (PHI) | Protected Health Information | — | HIPAA |
| PCI DSS | Anyone storing/processing card data | Cardholder data | — | PCI DSS |
Choosing your framework (by data and buyer)
The framework you need is driven by two questions: what data do you hold, and who buys from you? Walk the table top to bottom — the first row that matches your situation usually governs.
| If you handle… | …and sell to… | You almost certainly need | Notes |
|---|---|---|---|
| Classified national-security data | Defense/IC | (Beyond this guide — air-gapped, IL6+) | Out of scope here. |
| Controlled Unclassified Information (CUI) | DoD / defense supply chain | CMMC Level 2 (= NIST 800-171) | Self-assessment or C3PAO assessment by contract phase. |
| Federal agency data, in the cloud | US federal agencies | FedRAMP (Low / Moderate / High) | Impact level set by FIPS 199 categorization of the data. |
| Federal agency data, on-prem / non-cloud | US federal agencies | FISMA (NIST RMF + 800-53) | FedRAMP is the cloud-specific flavor of FISMA. |
| US state / local government data | State & local agencies | StateRAMP / GovRAMP | The state-level analog of FedRAMP; reuses FedRAMP work. |
| Protected Health Information (PHI) | Healthcare / payers | HIPAA (+ usually SOC 2/HITRUST) | Sign a BAA; HIPAA is law, not a certification. |
| Payment card data (PAN) | Anyone taking cards | PCI DSS | Best avoided by never touching PAN — use a tokenizing gateway. |
| General customer/business data | Commercial enterprises (US) | SOC 2 Type II | The default ask in US B2B SaaS sales. |
| General customer/business data | International / EU enterprises | ISO/IEC 27001 | The global standard; often paired with SOC 2. |
| EU residents’ personal data | Anyone in the EU market | GDPR (regulation, not a cert) | Layer on top of your security framework. |
How they nest
Most of these frameworks share DNA. Roughly, from broadest controls to narrowest:
NIST 800-53 (full control catalog) └─ FedRAMP High (410 controls) ← strictest cloud baseline └─ FedRAMP Moderate (323) └─ FedRAMP Low / Li-SaaS (156) ≈ maps down to ISO 27001, SOC 2, StateRAMP, CMMC L2If you implement and evidence a FedRAMP Moderate/High control set, a SOC 2 or ISO 27001 audit is largely re-using the same controls with different paperwork. That is the whole reason the platform builds to FedRAMP first and maps down — do the hard one once.
The honest caveat: FedRAMP authorization itself is only meaningful for selling cloud services to US federal agencies (it requires an agency sponsor). A purely commercial company cannot “get FedRAMP” without a federal customer, and commercial buyers won’t ask for it — they ask for SOC 2 / ISO 27001. So: build to the FedRAMP control baseline from day one (cheap insurance, maps everywhere), but certify against whatever your actual buyers require.
How this maps to building software
The frameworks above are what to comply with. For how to implement the controls in a real platform — identity (IAL/AAL/FAL), encryption (FIPS 140-3), audit logging, continuous monitoring, boundary protection, and the rest — as independently-deployable modules, see:
- FRD: FedRAMP-Compliant Platform Security — the à-la-carte control-module catalog, targeting the highest assurance level.
Related resources
- Security Guidance (app-level) — XSS, CSP, sanitization, log redaction (guide pending)
- Procurement — Overview — buying compliant tools (FedRAMP/StateRAMP as a procurement gate)
- STANDARDS.md
Sources (verified 2026-05-29)
| Claim | Source |
|---|---|
| FedRAMP is built on NIST 800-53 Rev 5; baseline structure | fedramp.gov |
| NIST control catalog | NIST SP 800-53 Rev 5 |
| Digital identity (IAL/AAL/FAL) | NIST SP 800-63-4 |
| CMMC = NIST 800-171 | DoD CMMC |
| SOC 2 Trust Services Criteria | AICPA |
| ISO/IEC 27001:2022 | ISO |