Standards
Standards represent compliance frameworks and regulations that organizations must adhere to. Openlane supports a wide range of industry standards including System and Organization Controls 2 (SOC 2), ISO 27001, National Institute of Standards and Technology (NIST) frameworks, and industry-specific regulations.
What is a Standard?
A Standard in Openlane represents a formal compliance framework, regulation, or set of guidelines that defines security, privacy, or operational requirements. Standards provide the foundation for compliance programs by defining the controls and requirements that organizations must implement.
Standards are established by industry associations, government bodies, or regulatory agencies. Some carry legal force, such as GDPR and HIPAA, while others are voluntary frameworks that customers and auditors expect, such as SOC 2 and ISO 27001.
Compliance Significance
In a compliance program, the standard is where requirements come from: it defines the controls you implement, the criteria auditors assess against, and the certification or attestation you can earn (an ISO 27001 certificate, a SOC 2 report) to demonstrate compliance to customers.
Types of Compliance Standards
Compliance standards typically address information security, privacy, risk management, and governance aspects of an organization. Here is a breakdown of the types of compliance standards:
| Type | Description | Examples |
|---|---|---|
| Regulatory compliance | Mandated by law; compliance with these frameworks is not optional | GDPR, HIPAA, PCI DSS |
| Industry-specific compliance | Developed by industry associations as a set of best practices for a particular industry | NIST cybersecurity for the technology sector, Federal Information Security Modernization Act (FISMA) for federal agencies |
| Operational compliance | Focused on ensuring reliability, integrity, and efficiency of an organization's operations and processes | SOC 2, ISO 27001, Control Objectives for Information and Related Technologies (COBIT) for IT and governance |
Supported Frameworks
| Framework | Type | Focus | Official Source |
|---|---|---|---|
| SOC 2 | Attestation standard | How service organizations handle customer data, against the five Trust Services Criteria | AICPA |
| ISO 27001 | Certification standard | Building and certifying an Information Security Management System (ISMS) | ISO |
| NIST 800-53 | Framework (control catalog) | Security and privacy controls for federal systems and beyond | NIST |
| NIST CSF | Framework | Voluntary, flexible cybersecurity risk management organized around core functions | NIST |
| NIST SSDF | Framework | Secure software development practices and supply chain attestation | NIST |
| NIST 800-171 | Framework (control requirements) | Protecting Controlled Unclassified Information (CUI) in nonfederal systems | NIST |
| GDPR | Regulation (EU law) | Personal data of people in the EU, wherever the organization operates | EU |
| HIPAA | Law | Protected health information (PHI), via the Privacy and Security Rules | HHS |
| PCI DSS | Attestation standard (contractual) | Cardholder data security across merchants, processors, and service providers | PCI SSC |
| CMMC | Certification standard (regulatory) | Cybersecurity maturity for the US defense industrial base | DoD |
| CIS Benchmarks | Framework | Configuration baselines for operating systems, cloud providers, and applications | CIS |
| CCM | Framework | Cloud-specific control matrix from the Cloud Security Alliance | CSA |
| SAMM | Framework (maturity model) | Software assurance maturity across the development lifecycle | OWASP |
| SOX | Law | Financial reporting integrity for US public companies | Congress |
| ISO 42001 | Certification standard | Building and certifying an AI Management System (AIMS) | ISO |
| DORA | Regulation (EU law) | Digital operational resilience for financial entities and their information and communications technology (ICT) providers | EU |
| FedRAMP | Authorization program (US federal) | Security authorization for cloud services used by federal agencies | FedRAMP |
| HITRUST | Certification standard | Certifiable Common Security Framework (CSF) harmonizing many frameworks, with tiered e1/i1/r2 assessments | HITRUST Alliance |
| Essential Eight | Framework (maturity model) | Baseline mitigation strategies mandated for Australian government entities | ACSC |
| APRA CPS 230 | Regulation (Australian prudential standard) | Operational risk, continuity, and service provider management for APRA-regulated entities | APRA |
| Microsoft SSPA | Contractual program | Security and privacy requirements for suppliers processing Microsoft data | Microsoft |
Also commonly encountered but not yet documented here: FISMA (US federal information security law).
Working with Standards in Openlane
Every framework above follows the same pattern in Openlane. Clone a standard's controls from the catalog into your organization, or create a program that adds them automatically and bundles them for an audit period. When you add a second framework, import and map your existing controls to the new requirements instead of building a parallel set: one well-implemented control can satisfy several frameworks at once, and the mappings are what make that count toward each of them.
Most framework pages also include an Example Evidence page listing the artifacts that typically satisfy manually evidenced control areas.
How do you choose the right compliance framework for your business?
We recommend weighing the following factors when deciding which frameworks to pursue:
| Factor | Consideration |
|---|---|
| Industry | The frameworks your business should follow will depend on your industry. For example, HIPAA is mandatory for healthcare while Payment Card Industry Data Security Standard (PCI DSS) is for those who handle credit card data. |
| Geography | If you process personal data from the EU, or have personal data collected from California, you will need GDPR and California Consumer Privacy Act (CCPA) compliance, respectively. |
| Customer requirements | Customers are data sensitive and may require compliance with specific standards as a prerequisite for doing business. For example, enterprises require their vendors to be SOC 2 compliant. |
| Legal requirements | The nature and jurisdiction of your business is another factor. Healthcare industries are required to be HIPAA compliant; companies handling data of EU citizens are required to be GDPR compliant. |
| Competitive advantage | International and widely recognized standards can differentiate your business and drive enterprise-level deals, setting you apart from competitors and showing invested parties your commitment to security and privacy. |
You can speak to key stakeholders like IT, legal, HR, and business heads to understand your business obligations and requirements. Once you have identified the relevant compliance standards and regulatory requirements for your business, develop a roadmap for implementation.
Keep in mind that compliance is not a one-time effort. Even with a single regulation to maintain, the work is continuous, and a simple oversight can result in severe consequences.
Beyond fines, what are the consequences of noncompliance?
While hefty fines and penalties get most of the attention, noncompliance carries a cascade of other consequences for your organization.
In severe cases noncompliance can lead to lawsuits and regulatory enforcement actions, and even when you prevail, defending them is expensive. Regulators can also impose orders that restrict how your organization operates, including barring specific business practices.
Noncompliance limits growth. Many businesses require frameworks like SOC 2 or ISO 27001 as a prerequisite for doing business with them, and data breaches and cyberthreats, which usually stem from noncompliance, erode the trust your existing customers have placed in you while hindering your ability to acquire new ones. Lacking a framework that buyers require also lengthens procurement cycles and can disqualify you from vendor selection entirely.