Legally binding requirements with defined penalties. Non-compliance is an enforcement question, not a commercial one.
India
India's national data protection law. It applies to any organisation processing digital personal data in India, and to foreign entities offering goods or services to data principals in India.
United States
The United States framework governing protected health information. It reaches Indian organisations through Business Associate Agreements with US covered entities.
European Union / EEA
The European data protection regulation. Its extraterritorial reach makes it directly applicable to Indian organisations targeting or monitoring individuals in the EU.
India
Binding directions requiring Indian entities to report specified cyber incidents within six hours, synchronise clocks to Indian time sources, and retain logs within India.
Management system standards audited by accredited certification bodies. The certificate is external evidence that the discipline exists.
International
The international standard for information security management. Certification is the most widely recognised evidence that an organisation manages security systematically rather than incidentally.
International
The privacy extension to ISO 27001. It converts a security management system into a privacy information management system with controller and processor obligations built in.
International
The first certifiable management system standard for artificial intelligence. It gives organisations a structured, auditable way to govern AI development and deployment.
Global (contractual)
The card industry security standard. Version 4.0.1 introduces a customised approach, stronger authentication and targeted risk analyses across twelve requirements.
Reports issued by licensed practitioners on your controls. What North American enterprise buyers most commonly request.
United States (globally recognised)
An independent attestation on the design and operating effectiveness of your controls against the Trust Services Criteria. The default security evidence requested by North American enterprise buyers.
Not certifiable by design. Used to describe posture, set targets and give a board a comprehensible view of maturity.
United States (globally adopted)
A voluntary framework for describing and improving cybersecurity posture. Its six functions provide the clearest common language between technical teams and boards.
The right sequence depends on who is asking. European and Indian enterprise buyers ask for ISO 27001; North American buyers ask for SOC 2; regulators ask for DPDPA and CERT-In regardless.
| Framework | Type | Jurisdiction | Certifiable | Typical timeline |
|---|---|---|---|---|
| DPDPA 2023Data Protection Board of India | Regulation | India | No | Enacted August 2023 |
| ISO/IEC 27001ISO/IEC — certified by accredited certification bodies | Standard | International | Yes | First certification typically takes 14–20 weeks for a mid-sized organisation |
| ISO/IEC 27701ISO/IEC — certified as an extension to ISO 27001 | Standard | International | Yes | Where ISO 27001 is already held, 27701 extension typically takes 10–14 weeks |
| SOC 2AICPA — reported on by licensed CPA firms | Attestation | United States (globally recognised) | Attested, not certified | Type I typically 10–16 weeks from start to report |
| HIPAAHHS Office for Civil Rights | Regulation | United States | No | HIPAA compliance is continuous rather than certified |
| GDPRNational supervisory authorities and the EDPB | Regulation | European Union / EEA | No | GDPR has applied since 25 May 2018 |
| ISO/IEC 42001ISO/IEC — certified by accredited certification bodies | Standard | International | Yes | Certification typically takes 16–24 weeks |
| NIST CSF 2.0National Institute of Standards and Technology | Framework | United States (globally adopted) | No | A full current-state and target-state profile assessment typically takes 4–7 weeks, producing a prioritised multi-year roadmap |
| CERT-In DirectionsIndian Computer Emergency Response Team, MeitY | Regulation | India | No | In force since 28 June 2022 |
| PCI DSS v4.0.1PCI Security Standards Council | Standard | Global (contractual) | Yes | Version 4 |
Pursuing more than one? Sequence them properly.
Starting with ISO 27001 makes a subsequent SOC 2 substantially cheaper because of the management-system discipline it establishes. The reverse is not true.
