Which compliance framework do you actually need?

They overlap heavily. SOC 2 is the common ask from US enterprise buyers; ISO 27001 is the internationally recognised certification and the stronger signal when you sell across regions. Many companies end up with both, and a single security program can cover most of the shared ground.

No. It points you to a likely starting framework based on three inputs. Your real scope depends on your contracts, data flows, and where you operate — which is the conversation to have before you commit time and budget.

You would likely need both HIPAA, for the health data and usually through a Business Associate Agreement, and SOC 2, for the enterprise security review. The two can be run together as one program.

Once you process the personal data of people in India. Full compliance is due 13 May 2027, and the work — data mapping, consent, grievance handling — usually takes longer than teams expect.

If AI is part of your product (including wrapping a foundation model like OpenAI or Anthropic into your service), ISO 42001 is the standard enterprise buyers and AI security questionnaires increasingly reference. It certifies your AI management system — governance, risk and impact assessment, and lifecycle controls — not the model itself, and it pairs naturally with ISO 27001 or SOC 2 as an extension of the same program.