Cybersecurity Compliance Guide: SOC 2, ISO 27001, HIPAA & PCI DSS Explained

Cybersecurity compliance requirements are converging. Most mid-market companies face at least two frameworks simultaneously — SOC 2 from enterprise customers, ISO 27001 from international partners, HIPAA if they touch healthcare data. Understanding what each framework actually requires (vs. what compliance consultants tell you it requires) is the first step toward an efficient program.

SOC 2 Type II: The Enterprise Sales Requirement

SOC 2 Type II is the dominant compliance requirement for US SaaS companies selling to enterprise customers. Type I is a point-in-time assessment; Type II evaluates controls over a 6-12 month observation period.

SOC 2 Trust Services Criteria relevant to security monitoring:

• CC6.1 (Logical and physical access): Controls over authentication, access provisioning, and access reviews
• CC6.6 (Logical access from untrusted networks): Network boundary controls, remote access monitoring
• CC7.1 (System monitoring): Continuous monitoring of system operations for anomalies
• CC7.2 (Evaluation of system performance): Monitoring that system components function as intended
• CC7.3 (Evaluation of security events): Evaluation and response to identified security events
• CC7.4 (Response to identified incidents): Incident response procedures and documentation

What auditors actually look for: logs of security events, records showing events were investigated (not just generated), incident tickets with timelines, and evidence of access review processes.

ISO 27001: The International Standard

ISO 27001 is the international information security management standard, increasingly required by European customers and organizations in regulated industries globally. It's a full ISMS (Information Security Management System) standard — more comprehensive than SOC 2.

Key Annex A controls for security monitoring:

• A.12.4 (Logging and monitoring): Event logging, protection of log information, administrator and operator logs, clock synchronization
• A.16.1 (Management of information security incidents): Incident reporting, response procedures, evidence collection, lessons learned
• A.9.2 (User access management): User registration, access provisioning, privileged access management, periodic access reviews

HIPAA Security Rule: Healthcare Data

If you create, receive, maintain, or transmit electronic Protected Health Information (ePHI), HIPAA Security Rule applies. Key requirements:

• 164.308(a)(1) — Risk Analysis: Conduct regular risk assessments of ePHI systems
• 164.308(a)(5) — Security Awareness: Training program and access controls
• 164.308(a)(6) — Incident Procedures: Documented incident response policies and procedures
• 164.312(b) — Audit Controls: Hardware, software, and procedural mechanisms that record and examine activity in systems that contain ePHI

PCI DSS v4.0: Payment Card Data

PCI DSS v4.0 (effective March 2024) tightened requirements for security monitoring:

• Requirement 10 (Log and Monitor): Audit logs for all system components, daily log review, retain logs for 12 months
• Requirement 11 (Test Security): Penetration testing, intrusion detection, and file integrity monitoring
• Requirement 12 (Support with Policies): Security awareness program, incident response plan

Cross-Framework Compliance Efficiency

The good news: security monitoring evidence generated by ZonForge Sentinel — investigation records, incident timelines, access anomaly logs — satisfies the monitoring requirements across all four frameworks simultaneously. One platform, four compliance programs.

Frequently Asked Questions