This is a quick guide to the compliance frameworks IntelliGRC manages, what they are, who they're for, and why they matter.
CMMC & NIST 800-171
DefenseCMMC (Cybersecurity Maturity Model Certification) is the Department of Defense (DoD)’s framework for verifying that defense contractors adequately protect Controlled Unclassified Information (CUI). It builds directly on NIST 800-171, a set of 110 security requirements published by the National Institute of Standards and Technology. Together, they define the security baseline every organization in the Defense Industrial Base must meet to win and maintain DoD contracts.
SOC 2
Trust & SecuritySOC 2 (System and Organization Controls 2) is an auditing standard developed by the American Institute of CPAs® that evaluates how a service organization manages customer data. It’s organized around five Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. A SOC 2 report is often the first thing enterprise buyers and partners ask for as proof that your security practices hold up under independent scrutiny.
ISO 27001
Global StandardISO/IEC 27001 is the internationally recognized standard for establishing, implementing, and maintaining an Information Security Management System (ISMS). It takes a risk-based approach requiring organizations to identify threats, select appropriate controls from its Annex A catalog, and continuously improve their security posture. Certification is granted by accredited third-party auditors and is widely accepted across industries and borders.
HIPAA
Healthcare
HIPAA (Health Insurance Portability and Accountability Act) is a U.S. federal law that sets the rules for protecting individuals’ health information. Its Privacy Rule governs how Protected Health Information (PHI) can be used and disclosed, while the Security Rule mandates administrative, physical, and technical safeguards for electronic PHI. Non-compliance can result in significant financial penalties and reputational damage.
NIST CSF
Cybersecurity BaselineThe NIST Cybersecurity Framework (CSF) is a voluntary, risk-based set of guidelines organized into six core functions: Govern, Identify, Protect, Detect, Respond, and Recover. Unlike prescriptive mandates, the CSF is designed to be flexible, letting organizations of any size or sector assess their current posture, set target maturity levels, and prioritize improvements. It also serves as a common language that maps cleanly to other frameworks.