Frameworks · 3
Global compliance framework library
For each framework: is it a report, a certificate or a legal duty; who issues it; who it applies to; how long it takes; and what comes after.
At a glance
Report, certificate or legal duty?
All called “compliance”, yet issuers, triggers and ongoing duties differ completely.
| Framework | Outcome | Issuer / regulator | Region | Typical timeline |
|---|---|---|---|---|
| SOC 2 | Attestation report | Independent CPA firm (AICPA standards) | Mainly North America; widely accepted globally | Type 1: ~2–4 months; Type 2 adds a 3–12 month period |
| ISO/IEC 27001 | Certification | Accredited certification body (e.g. CNAS, UKAS, ANAB accredited) | Global; especially valued in Europe and APAC | Commonly 4–9 months to certification |
| GDPR | Legal obligation | EU/EEA data protection authorities | EU / EEA (UK GDPR in the UK) | A baseline programme commonly takes 2–4 months |
Security assurance & certification
2Security & assuranceAttestation report
SOC 2
A practical guide to report type, scope, evidence and the role of the independent CPA in a SOC 2 engagement.
- Issuer
- Independent CPA firm (AICPA standards)
- Timeline
- Type 1: ~2–4 months; Type 2 adds a 3–12 month period
Security & assuranceCertification
ISO/IEC 27001
Understand the ISMS, certification scope, risk management, operating evidence and independent certification body responsibilities.
- Issuer
- Accredited certification body (e.g. CNAS, UKAS, ANAB accredited)
- Timeline
- Commonly 4–9 months to certification
Next step
Your buyer is waiting. Start with a clear scope.
A 30-minute scoping call: confirm whether the buyer needs a report, certificate or questionnaire answers, what is in scope, and a realistic timeline.