Most organisations that fail their first ISO 27001 certification audit don’t fail because their security is lacking. They fail because they lack a systemic approach to their IT systems. ISO 27001:2022 is not a technology exercise. It is a governance framework, and getting certified requires your entire organisation to demonstrate that it manages information security systematically, continuously, and with documented intent. This guide provides a practical, phase-by-phase roadmap to ISO 27001 implementation, covering everything from initial scoping to certification audit preparation. Whether you are building an ISMS from scratch or modernizing a legacy system, the structure below reflects how implementation actually works in practice. The ISO 27001 Implementation Roadmap at a Glance An ISO 27001 implementation roadmap is a structured project plan that takes an organization from its current security posture to certified compliance with ISO/IEC 27001:2022. The roadmap defines phases, deliverables, roles, and timelines, giving your team a clear line of sight from day one through to the certification audit. The standard itself has two components. Clauses 4 through 10 define the mandatory management system requirements: context, leadership, planning, support, operations, performance evaluation, and improvement. Annex A provides a reference catalogue of 93 security controls, organised into four themes: organisational (37 controls), people (8 controls), physical (14 controls), and technological (34 controls). A well-structured roadmap addresses both components in a logical sequence, with risk driving every decision. Pro Tip: What Procurement Teams Actually Accept In our experience at Axipro, most sophisticated procurement teams care about three things: (1) that an independent auditor tested your controls, (2) that the criteria used are recognised and rigorous, and (3) that the report covers a recent period (ideally the last 12 months). Whether the cover page says “SOC 2” or “ISAE 3000” matters less than you think, unless the policy explicitly mandates one or the other. Always ask. Prerequisites and Planning Before You Start Define the Scope of Your ISMS Scope definition is the single most consequential decision in the entire implementation. The scope should reflect the business units, locations, processes, and information assets that are most critical to your organization and most relevant to your customers and stakeholders. A well-defined scope document should identify the boundaries of the ISMS, the interfaces and dependencies with external parties, and any intentional exclusions, with justification for each. Auditors scrutinize scope boundaries carefully. Any exclusion that appears to cherry-pick convenient systems will attract challenge. Form Your ISO 27001 Implementation Team Three roles are non-negotiable: an executive sponsor with authority to allocate resources and enforce decisions; a project manager who owns the day-to-day implementation timeline; and an information security lead who understands both the technical controls and the documentation requirements. Larger organisations may also need departmental representatives from IT, HR, legal, and operations. The most common implementation failure mode is assigning ISO 27001 entirely to the IT team. The standard requires evidence that security is embedded across the organisation. HR owns the people controls. Legal owns the contractual and regulatory requirements. Finance owns the asset valuation. If those functions are not engaged early, you will discover gaps at the worst possible time. If your organisation lacks in-house expertise, working with an experienced ISO 27001 consultant can bridge that gap efficiently. ISO 27001 Implementation Roadmap: Phase-by-Phase Breakdown Phase 1 (2 weeks): Foundation and Planning Phase The first 14 days establish the governance foundation. Key deliverables include a documented ISMS scope; an approved information security policy signed by top management; a defined organisational context covering internal and external issues, interested parties, and legal requirements; and a completed gap assessment that maps your current state against the standard’s requirements. From this list, the gap assessment is the most important document. It identifies which controls are already in place, which need to be built from scratch, and which exist informally but require documentation. Our gap analysis services are designed specifically for this phase, helping organisations cut through the ambiguity and get a clear remediation picture fast. Phase 2 (2 weeks): Implementation Phase The second 14 days focus on risk and documentation. Your team completes the formal risk assessment, identifies and values assets, maps threats and vulnerabilities, and determines risk levels against your defined risk appetite. From this, you produce a Risk Treatment Plan that specifies which risks will be mitigated, accepted, transferred, or avoided, and which Annex A controls address each risk. The Statement of Applicability (SoA) is produced during this phase. It documents all 93 Annex A controls, the justification for including or excluding each one, and the current implementation status. The SoA is typically the first document an auditor requests. It connects your risk assessment to your control selection and demonstrates that your ISMS is risk-driven rather than checklist-driven. Phase 3 (1 to 3 weeks): Audit and Approval The final phase focuses on executing the controls, training staff, and preparing for audit. Technical controls from the risk treatment plan are deployed. Operational procedures are finalised and approved. Security awareness training is delivered to all staff. An ISO 27001 internal audit is conducted to identify nonconformities before the certification body arrives. A management review is completed to demonstrate leadership engagement. This 6-week timeline is achievable for most organizations with existing security foundations and dedicated implementation resources. Rushing the process to meet an arbitrary deadline is the leading cause of audit failures and certification theatre, a situation where documented controls exist only on paper and fall apart under auditor questioning. For a detailed breakdown of where implementations go wrong, see our guide on common pitfalls in ISO 27001. 6-Week Detailed Implementation Timeline Week 1: Project Initiation Secure executive sponsorship in writing. Establish the project team and define roles. Brief key stakeholders on the standard’s requirements and business case. Set up project governance, including a steering committee and regular status reporting. Week 2: Define ISMS Scope and Context and Conduct Gap Assessment Document the organisational context using Clause 4 requirements. Identify interested parties and their requirements. Define and document the ISMS scope boundary. Obtain approval from top management. Assess current security controls
EORs are often the leaders in data security compliance. As the responsible party for payroll and HR data, the burden of SOC 2 compliance is greater for them than for other companies. But SOC 2 compliance doesn’t have to be complicated. In this article, we’ll guide EOR firms through the process with an easy, step-by-step approach. What Is SOC 2 Compliance and Why Does It Matter for EOR Providers? Understanding SOC 2 and Its Role in Employer of Record Services An Employer of Record processes payroll data, national identification numbers, bank account details, tax filings, and employment records for workers across dozens of countries. In a single month, a mid-sized EOR platform may handle more sensitive personal data than many healthcare organisations. That concentration of risk is precisely why SOC 2 compliance has moved from a nice-to-have to a procurement prerequisite for clients who take data security seriously. SOC 2 is a security auditing framework developed by the American Institute of Certified Public Accountants (AICPA). It evaluates service organisations against a set of Trust Services Criteria covering security, availability, processing integrity, confidentiality, and privacy. Unlike prescriptive frameworks such as PCI DSS, SOC 2 does not mandate a specific list of controls. Instead, it requires organisations to demonstrate that the controls they have designed and implemented actually work. For EOR providers, this flexibility is both useful and demanding. Useful because it allows controls to be tailored to the specific realities of multi-country payroll operations. Demanding because evidence of effective control operation must be documented and sustained continuously — not assembled in the weeks before an audit. Why EOR Providers Are High-Value Targets for Data Security Risks EOR platforms sit at a uniquely dangerous intersection of data sensitivity, operational scale, and third-party dependency. They act as the legal employer in multiple jurisdictions, which means they hold the kind of data that attracts two distinct threats: financially motivated attackers looking for payroll and banking credentials, and regulatory enforcement bodies scrutinising how personal data crosses borders. The attack surface is broad. EOR providers connect client company HR systems to local payroll engines, tax authorities, benefits administrators, and banking rails. Each integration is a potential entry point. A misconfigured API between an EOR platform and a client HRIS can expose employee records without any external attacker involved at all. The regulatory exposure compounds the security risk. Under the GDPR alone, penalties for serious data breaches can reach €20 million or 4% of global annual turnover, whichever is higher. For an EOR operating in Europe, Southeast Asia, and Latin America simultaneously, the regulatory surface is enormous. The Business Case for SOC 2 Compliance in the EOR Industry Enterprise clients and their procurement teams increasingly require SOC 2 Type II certification before signing EOR contracts. A successful audit signals that an EOR provider has implemented and sustained effective security controls over time — not just designed them on paper. That distinction matters enormously in a market where a single data breach can destroy client relationships overnight. SOC 2 compliance also de-risks the EOR provider itself. Organisations that have gone through the audit process typically discover and remediate control gaps they did not know existed. The internal discipline required to sustain a Type II audit programme produces a more operationally mature organisation, regardless of what any individual client requires. Pro Tip: Type 1 vs Type 2 In the EOR market, SOC 2 Type II has become the de facto security signal that enterprise procurement teams look for when vetting providers. Type I is no longer sufficient for most Fortune 1000 clients. If an EOR is starting the compliance journey today, the goal should be Type II from the outset. Which Trust Services Criteria Apply to EOR Providers? Security (Common Criteria) Security is the only mandatory Trust Services Criterion in a SOC 2 audit. It covers nine areas of control (CC1 through CC9) grounded in the COSO framework, spanning governance, risk management, access controls, system operations, change management, and incident response. For EOR providers, the security criterion is the foundation on which everything else sits. Access control is particularly critical. EOR platforms grant dozens or hundreds of internal staff access to employee PII and payroll data, often differentiated by country and client. Multi-factor authentication, role-based access, and rigorous user provisioning and deprovisioning processes are baseline expectations for any SOC 2 auditor. Availability Availability assesses whether systems perform as expected and are accessible to users when required. For EOR providers, payroll processing is time-critical. A system outage on a payroll run date does not just affect internal operations — it directly impacts employees’ ability to receive pay on time, which creates legal exposure in many jurisdictions. Availability controls for EOR providers should address capacity planning, disaster recovery, and system resilience. Demonstrable recovery time objectives and tested business continuity plans are the evidence auditors will want to see. Confidentiality Confidentiality applies to any information designated as confidential within the system, including client business information, employment contracts, salary benchmarking data, and any other data the EOR has committed to protect beyond basic legal requirements. It requires both clear data classification processes and active controls to prevent unauthorised disclosure. EOR providers often hold confidential commercial information on behalf of multiple clients who may be competitors of one another. Logical segregation of client data is therefore not only a security best practice but a direct requirement under the confidentiality criterion. Processing Integrity Processing integrity evaluates whether systems process data completely, accurately, in a timely fashion, and without unauthorised modification. This criterion is particularly relevant to payroll operations, where a calculation error can result in incorrect tax remittances, underpaid employees, or regulatory violations. Input validation controls, reconciliation procedures, and audit trails that confirm payroll data moved accurately from source to payment are the core of a processing integrity programme for EOR platforms. Privacy Privacy goes beyond confidentiality to address how personal data is collected, stored, used, retained, and disclosed in line with the AICPA’s Generally Accepted Privacy Principles. It applies when an organisation collects
ISO 27001 does not use the words “penetration test” anywhere. And yet, auditors conducting Stage 2 assessments routinely expect to see one. Understanding why that gap exists, and how to close it, is what separates organizations that sail through ISO 27001 certification from those that get caught off-guard. This guide covers what the standard actually says about security testing, which controls drive the expectation for penetration testing, what types of testing are relevant, and how to build a testing programme that genuinely supports your ISMS rather than simply ticking a compliance box. What Is Penetration Testing in the context of ISO 27001? ISO 27001 penetration testing refers to structured, simulated attacks conducted against an organization’s systems, networks, and applications in order to identify exploitable vulnerabilities before real attackers do. In the context of ISO 27001, it serves a specific purpose: providing evidence that the technical controls underpinning your Information Security Management System (ISMS) actually work under real-world conditions. The distinction matters. A vulnerability scan tells you what weaknesses exist whilst a penetration test tells you whether those weaknesses are exploitable, to what degree, and with what consequence. That difference is exactly what auditors are looking for when they ask for testing evidence. Penetration testing is not an isolated activity in an ISO 27001 programme. Its findings feed directly into three of the most scrutinised documents in your ISMS: the risk register, the risk treatment plan, and the Statement of Applicability (SoA). A risk listed in your register as “medium” looks very different once a tester has demonstrated they can chain it into a full domain compromise. Is Penetration Testing a Requirement for ISO 27001? No, it is not explicitly required. The standard does not mandate it by name. What ISO 27001 does require is that organisations establish and maintain a functioning ISMS, perform systematic risk assessments (Clause 6.1.2), implement appropriate controls (Clause 8), evaluate the performance and effectiveness of those controls (Clause 9), and pursue continual improvement (Clause 10). Vulnerability assessment and penetration testing supports every one of those activities with hard evidence. Two Annex A controls make it practically impossible to demonstrate compliance without some form of penetration testing: A.8.8 (Management of Technical Vulnerabilities) and A.8.29 (Security Testing in Development and Acceptance). Auditors conducting Stage 2 assessments will expect to see testing evidence mapped to both. Organisations that substitute a vulnerability scan report and call it done regularly receive non-conformances. The absence of an explicit penetration testing requirement is sometimes misread as permission to skip it. In practice, certified auditors universally expect evidence of testing that goes beyond automated scanning. Relying solely on scan reports is the fastest route to a failed audit. What ISO 27001:2022 Says About Security Testing Annex A 8.29: Security Testing in Development and Acceptance Annex A 8.29 requires organisations to define and implement security testing processes throughout the development lifecycle and before final acceptance of any system. This applies to both in-house development and outsourced or third-party software. The control is preventive in nature. Its purpose is to ensure that no application, database, or system goes into production with known, unmitigated vulnerabilities. For in-house development, the standard specifically references conducting code reviews, performing vulnerability scans, and carrying out penetration tests to identify weak coding and design. For outsourced environments, organisations must set contractual requirements that ensure suppliers meet equivalent security testing standards, accepting a supplier’s assurance without evidence is not sufficient. Annex A 8.29 does not prescribe specific tools or techniques. What it demands is that testing is risk-based, documented, and proportionate to the sensitivity and exposure of the system. A low-risk internal tool used by five people warrants a different level of scrutiny than a customer-facing payment platform. Security testing should scale with risk, and it should happen throughout development, not only at the end. Worth knowing: Annex A 8.29 consolidates two controls from ISO 27001:2013, specifically A.14.2.8 (System security testing) and A.14.2.9 (System acceptance testing), into a single, clearer requirement. The 2022 version makes the expectation of penetration testing more explicit, particularly for major releases and architectural changes. Auditors will ask to see signed penetration test reports or independent security audit summaries for recent major system updates. If such evidence does not exist, they have grounds to mark the control as non-compliant. Annex A 8.8: Management of Technical Vulnerabilities Annex A 8.8 is the vulnerability management control. It requires organisations to identify, assess, and address technical vulnerabilities in a timely manner, taking a proactive and risk-based approach rather than reacting only when something breaks. Crucially, the control explicitly lists periodic, documented penetration tests, conducted either by internal staff or by a qualified third party, as a method for identifying vulnerabilities. Automated scanners have their place, but penetration tests are recognised here as the mechanism for discovering high-risk weaknesses that scanners routinely miss: logic flaws, chained vulnerabilities, privilege escalation paths, and misconfigurations that only become dangerous in combination. Annex A 8.8 replaces two controls from ISO 27001:2013: A.12.6.1 (Technical vulnerability management) and A.18.2.3 (Technical compliance review). The 2022 version introduces a broader, more holistic approach, including the organisation’s public responsibilities, the role of cloud providers, and the expectation that vulnerability management is integrated with change management rather than treated as a separate activity. The Role of Penetration Testing in ISO 27001 Compliance Risk Assessment and Treatment ISO 27001’s risk-based model sits at the core of everything. Penetration testing feeds that model with real-world evidence rather than hypothetical assumptions. When a tester demonstrates that an attacker can move laterally from a compromised workstation to a production database in four steps, that finding transforms what was previously a theoretical risk into a documented, evidenced vulnerability with a severity rating, an exploitability score, and a required remediation action. This evidence directly informs how risks are treated. ISO 27001 requires organisations to choose one of four treatment options for each risk: mitigate, accept, avoid, or transfer. Without penetration test data, those decisions rest on estimation. With it, they rest on proof. If you haven’t yet mapped
In March 2026, a regional conflict in the Middle East did something that stress tests and tabletop exercises rarely manage to do: it took down cloud infrastructure across multiple availability zones at the same time, in the same region, without warning. AWS data centers in the UAE and Bahrain were impacted. Banking apps went offline. Payments failed. Delivery platforms stopped. And a significant portion of the affected organizations had done everything “right” by conventional standards — multi-AZ deployments, redundancy within the region, documented continuity plans. It wasn’t enough. This article breaks down what happened, what it revealed about how most organizations think about availability, and what a more resilient architecture actually looks like. If your systems run on cloud infrastructure — in any region — this case is worth understanding closely. What Happened: The March 2026 Incident Regional conflict in the Middle East caused physical and infrastructural disruption to AWS facilities across the UAE and Bahrain. Based on publicly reported information, the incident involved power outages affecting data center operations, physical damage to infrastructure facilities, connectivity loss across affected environments, and service degradation spanning multiple availability zones within the same region — simultaneously. That last point is the one that matters most. AWS designs its availability zones to be isolated from one another — separate power, cooling, and networking — so that a failure in one zone doesn’t cascade into another. Under normal failure conditions, that isolation holds. But this wasn’t a normal failure condition. It was a regional-scale disruption. The “rooms” were fine. The “building” was the problem. “Availability zones are designed to handle localized failures, not regional ones. This incident sits firmly in the second category.” The result was that organizations with multi-AZ architectures — which many rightly considered robust — still went down. There was no in-region fallback left to use. Business Impact: What Actually Went Offline The impact was not subtle. Banking platforms experienced downtime that prevented customers from accessing accounts or completing transactions. Payment processors were unable to process transactions. Mobility and delivery platforms halted operations entirely. Customer-facing applications became unavailable across the board. This wasn’t degraded performance or slower load times. It was a full loss of availability for any system that lived entirely within the affected region. The AWS Well-Architected Framework acknowledges that regional failures, while rare, are a defined risk category — and designing for them requires a fundamentally different approach than designing for AZ failures. Organizations with multi-region architectures kept operating. Everything else stopped. That single architectural decision — single-region versus multi-region — was the difference between availability and a complete outage. What Risks Actually Materialised This incident didn’t create new risks. It exposed ones that were already there, quietly embedded in architectural choices and compliance assumptions that had never been stress-tested at this scale. Regional Single Point of Failure The most common pattern among affected organizations: applications, databases, and backups all deployed within a single region. When that region became unavailable, there was no secondary environment to take over. No warm standby, no traffic rerouting, no automated failover. Just downtime. This is the architectural equivalent of backing up your data to a drive sitting next to your laptop. It works until it doesn’t. The Limits of Availability Zone Redundancy Availability zones are a powerful tool — but they’re a tool designed for a specific class of failure, and understanding that class matters. Think of an availability zone as a separate floor in a building. If one floor has a problem, you move to another floor. But if the entire building loses power — or becomes inaccessible — floor redundancy doesn’t help. You needed another building entirely. That’s what a region is. And this incident took down the building. Pro tip: When mapping your architecture against a business continuity plan, explicitly define your regional failure scenario. “What happens if this entire region becomes inaccessible for 24 hours?” is a question that exposes gaps that AZ-level planning will never catch. Infrastructure-Level Disruption Is Not Solvable at the Application Layer Power outages. Connectivity loss. Physical damage. These are not conditions that clever application architecture can work around if your infrastructure is entirely contained within the affected geography. No amount of microservices design, caching strategy, or auto-scaling helps when there’s no power reaching the data center. This is an important framing shift for engineering teams who own availability: some failure modes require infrastructure-layer responses, not code-layer ones. The Compliance Gap: Controls on Paper vs. Controls in Practice Perhaps the most uncomfortable implication of this incident. In many environments — particularly those undergoing ISO/IEC 27001:2022 certification or SOC 2 audits — availability controls are documented but don’t reflect the actual system architecture. Redundancy is listed as a control. It’s just redundancy within a single region, which, as this event demonstrated, is insufficient for regional-scale disruptions. The control passes an audit. It fails a real incident. This is the exact gap that compliance frameworks are designed to close — and that audit processes sometimes fail to catch. Cloud Hosting and SOC 2 Compliance Requirements Choosing AWS or Azure doesn’t hand you a SOC 2 compliance. It hands you a shared responsibility model, which means your provider secures the physical infrastructure and you secure everything running on top of it — including whether your architecture can actually deliver on your availability commitments. Auditors know this distinction well. When they evaluate your Availability criteria, they’re looking at your controls, not your provider’s SOC 2 report. What that means in practice: your recovery objectives need to be real numbers tied to a real architecture, not placeholders in a policy document. Your failover plan needs test records behind it. And your cloud provider should appear in your vendor risk register with an annual review of their own audit reports. A single-region deployment with no tested failover isn’t compliant in any meaningful sense. It’s a documentation exercise waiting to be disproved. The March 2026 incident made this concrete. Organizations that had documented availability controls but confined their entire infrastructure to
Around the year 2019, The DoD found a problem. Contractors were self-attesting to NIST SP 800-171 compliance, signing off on security postures that, in many cases, existed only on paper. Sensitive defense information was leaving the supply chain through vulnerabilities that everyone had technically promised to close. That failure gave rise to CMMC, and understanding how these two frameworks relate, where they overlap, and where they diverge is now a contractual necessity for every organization in the Defense Industrial Base. This guide cuts through the confusion and provides a precise, current account of how CMMC 2.0 and NIST SP 800-171 compare and coexist. What Is NIST SP 800-171? NIST Special Publication 800-171 is a set of cybersecurity requirements developed by the National Institute of Standards and Technology for the protection of Controlled Unclassified Information (CUI) in non-federal information systems and organizations. It was first published in 2015 and most recently updated with Revision 3 in May 2024. The framework covers 14 families of security requirements in its current Revision 2 form, spanning access control, audit and accountability, incident response, configuration management, identification and authentication, and more. Revision 3 restructures this into 17 families, reducing the number of top-level requirements from 110 to 97 while introducing three new domains: Planning, System and Services Acquisition, and Supply Chain Risk Management. Do not let the lower requirement count mislead you. According to NIST, Revision 3 increases the number of determination statements, the specific verification actions required during an assessment, by 32 percent. NIST 800-171 is not a certification. It is a compliance standard built on a self-assessment model. Organizations determine their own score, document it in their System Security Plan (SSP), and report it to the DoD’s Supplier Performance Risk System (SPRS). That self-reporting architecture is precisely what CMMC was designed to fix. Worth Knowing: NIST SP 800-171 applies broadly across federal contracting, not just the DoD. Any non-federal organization handling CUI in support of a federal agency, including NASA, GSA, and others, may be required to comply. CMMC, by contrast, is exclusively a DoD program. What Is CMMC 2.0? The Cybersecurity Maturity Model Certification is the Department of Defense’s formal certification program for cybersecurity compliance across the Defense Industrial Base. CMMC 2.0 was finalized in October 2024 and became effective December 16, 2024, with enforcement rolling out in phases through 2028. Where NIST 800-171 describes what security controls an organization should implement, CMMC adds a verification layer: it requires that compliance be independently confirmed before a contract is awarded. CMMC uses a three-level maturity model, with each level corresponding to the sensitivity of the data handled and the rigor of the required assessment. CMMC is enforced through DFARS clause 252.204-7021. Phase 1 of the rollout began November 10, 2025, and the DoD estimates that approximately 65 percent of the Defense Industrial Base will be affected. Major primes including Lockheed Martin and Boeing have already issued directives requiring CMMC documentation from their supply chains, in some cases ahead of official DoD deadlines. How CMMC and NIST 800-171 Connect CMMC 2.0 does not replace NIST 800-171. It is built on top of it. CMMC Level 2, the level most defense contractors will encounter, directly mirrors the 110 requirements in NIST SP 800-171 Revision 2. CMMC Level 3 extends that baseline by adding 24 enhanced requirements drawn from NIST SP 800-172. Think of it this way: NIST 800-171 is the technical standard, and CMMC is the auditing and enforcement mechanism. Implementing 800-171 is a prerequisite for CMMC Level 2 certification. The critical difference is that 800-171 compliance is self-declared, while CMMC compliance is independently verified. Both frameworks require a System Security Plan and a Plan of Action and Milestones (POA&M) for identified gaps. Assessment results from third-party or government-led CMMC assessments are recorded in eMASS, the DoD’s Enterprise Mission Assurance Support Service, while self-assessment results continue to be recorded in SPRS. Key Differences Between CMMC and NIST 800-171 Attribute NIST SP 800-171 CMMC 2.0 Purpose Technical standard for CUI protection Certification program verifying CUI protection Who It Applies To Any non-federal entity handling CUI DoD contractors and subcontractors handling FCI or CUI Maturity Levels None, flat set of 110 requirements Three levels (Foundational, Advanced, Expert) Assessment Model Self-assessment and self-attestation Self-assessment (L1), C3PAO (L2), DIBCAC (L3) Where Results Are Recorded SPRS SPRS (self-assessments), eMASS (C3PAO/DIBCAC) POA&M Restrictions No closure deadline or item limit Limited open items; must close within 180 days Contract Consequence Contractually required; limited enforcement mechanism Required for contract award; False Claims Act exposure Current Revision in Use Rev. 2 (CMMC use); Rev. 3 published May 2024 Aligned to Rev. 2 for Level 2 assessments Cloud Requirements FedRAMP Moderate equivalent minimum FedRAMP Moderate (L2); FedRAMP High (L3) Applies to Non-DoD Agencies? Yes No, DoD only Is Compliance Mandatory? Both frameworks are contractually required for DoD contractors handling CUI through the DFARS 252.204-7012 clause. The critical difference is consequence. NIST 800-171 compliance has been contractually required for years, but the self-attestation model created minimal accountability. CMMC adds teeth: without the required certification level, organizations cannot be awarded or retain DoD contracts. Under the False Claims Act, falsely certifying CMMC compliance can expose both the organization and signing individuals to treble damages. Does It Use a Maturity Model? NIST SP 800-171 does not use a maturity model. It presents a flat set of requirements that either are or are not implemented. CMMC structures compliance into three ascending levels, with each level carrying specific assessment requirements and targeting a different category of sensitive information. Does It Require a Third-Party Assessor? NIST 800-171 is self-assessed. CMMC Level 1 is also self-assessed annually. For CMMC Level 2, the picture is more complex: some contracts allow self-assessment, but most high-priority contracts require assessment by a Certified Third-Party Assessment Organization (C3PAO). CMMC Level 3 requires a direct audit by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC), a government body. Scope: What Data Does Each Framework Protect? Both frameworks center on CUI protection, but there is an
The CMMC is vast in coverage and can easily become overwhelming. It includes 110 security controls for each level, excluding level 1, which has only 15, with many encryption controls required throughout. This guide breaks down exactly what the four core encryption controls demand, how they apply across certification levels, and where assessors consistently find gaps that could have been caught months earlier. Whilst most of these controls are straightforward, one stands out on the Defense Industrial Base Cybersecurity Assessment Center’s list of most commonly failed controls: SC.L2-3.13.11, which mandates FIPS-validated cryptography for protecting Controlled Unclassified Information (CUI). This is not because it is technically complex. It is because most contractors misunderstand what it truly requires. The mistake is almost always the same: assuming that using AES-256 is enough. It is not. CMMC encryption requirements are about validated modules, not algorithms, and that distinction is what fails organisations that believed they were ready. What Are the CMMC Encryption Requirements? CMMC 2.0 is the Department of Defense’s framework for verifying that contractors protect sensitive defense information. It operates on three certification levels: Level 1, Basic protection of Federal Contract Information (FCI) Level 2, Protection of CUI in alignment with NIST SP 800-171 Level 3, Protection of the most sensitive CUI against advanced persistent threats Encryption requirements live primarily at Level 2 and above. With CMMC, the requirement for FIPS 140 validation now applies to every member of the Defense Industrial Base (DIB), an estimated 215,000 companies, that handles CUI. Every system that performs encryption and touches CUI must use FIPS-validated cryptography. That is a significant shift: previously, FIPS validation was largely reserved for vendors selling directly to federal agencies. The timeline is active. The CMMC Acquisition Rule became effective November 10, 2025, with Phase 2, mandatory C3PAO assessments for Level 2 contracts, beginning November 10, 2026. The 4 Core CMMC Encryption Controls Explained Three controls form the backbone of CMMC’s encryption requirements. Understanding each one separately matters, because failing any of them has direct consequences on your assessment score. Control Name What It Requires Applies To SC.L2-3.13.11 FIPS-Validated Cryptography Cryptographic modules must hold a valid NIST CMVP certificate Any system that handles CUI SC.L2-3.13.8 CUI in Transit Cryptographic mechanisms must protect CUI across all transmission channels Networks, email, file transfers, APIs SC.L2-3.13.16 CUI at Rest CUI stored on any system must be encrypted Servers, workstations, databases, backups SC.L2-3.13.10 Cryptographic Key Management Keys must be generated, stored, and revoked in a controlled, documented process All systems using encryption to protect CUI MP.L2-3.8.7. CUI on Media Encryption must extend to physical and removable media USB drives, external disks, backup tapes, laptops SC.L2-3.13.11: Employ FIPS-Validated Cryptography to Protect CUI This is the headline control and the most misunderstood. A common mistake is confusing cryptographic algorithms with cryptographic modules. The CMMC requirement is about the module, not just the algorithm. You can run AES-256 across your entire environment. If the module implementing it has not been validated through NIST’s Cryptographic Module Validation Program (CMVP), you are not compliant. The algorithm is not the certificate. Pro Tip During an assessment, you will be asked to provide the FIPS certificate number for each product that handles CUI, not a vendor’s claim that they “support AES-256.” Have those certificate numbers documented before the assessment starts. SC.L2-3.13.8 and SC.L2-3.13.16: CUI in Transit and at Rest SC.L2-3.13.8 requires cryptographic mechanisms to protect CUI during transmission, covering all communication channels: network connections, email, file transfers, and API communications. SC.L2-3.13.16 requires protection of CUI at rest. Neither control names a specific algorithm, but the FIPS validation requirement from 3.13.11 applies across both. SC.L2-3.13.10: Establish and Manage Cryptographic Keys Encryption without key management is security theatre. This control requires that keys be generated, stored, and revoked in a controlled, documented way. A compromised key renders all your encryption irrelevant regardless of algorithm strength. MP.L2-3.8.7: Control Access to CUI on Media This control extends encryption requirements to physical and removable media. CUI stored on a USB drive, an external hard disk, or a backup tape must be protected. Contractors who focus on network-level encryption and forget about the laptop bag sitting in a car park consistently fail this one. CMMC Encryption Requirements by Certification Level Level 1 covers organisations handling only FCI. The controls are foundational and do not explicitly mandate encryption, though it remains a recommended practice. This changes sharply at Level 2. Under the CMMC scoring methodology: 5 points deducted if no cryptography is employed 3 points deducted if cryptography is present but not FIPS-validated Maximum score: 110 | Minimum passing threshold: 88 Getting SC.L2-3.13.11 wrong costs points you cannot afford to lose. Level 3 introduces additional requirements aligned with NIST SP 800-172, including enhanced key management controls, stricter access controls on cryptographic infrastructure, and greater scrutiny of the supply chain around cryptographic tools. Pro Tip According to research by Merrill Research and CyberSheath, only 4% of defense contractors are fully prepared for CMMC certification based on third-party assessment criteria, while 75% believe they are compliant based on self-assessment. The gap is widest in technical controls, with encryption and key management among the most common failure points. What Is FIPS-Validated Cryptography and Why Does It Matter? FIPS stands for Federal Information Processing Standards. FIPS 140, developed by NIST, sets the benchmark for cryptographic modules intended to protect sensitive information. It requires that cryptographic modules be tested by accredited third-party laboratories and certified by NIST, a process managed through the Cryptographic Module Validation Program (CMVP). FIPS 140-2 vs. FIPS 140-3 FIPS 140-3 is the newer standard, published March 22, 2019, and aligns with the international ISO/IEC 19790:2012(E) standard. Both remain acceptable under current CMMC requirements. FIPS 140-3 introduces stricter requirements around physical security, key management, and testing methodologies, and will likely become the primary standard as the framework evolves. If your vendor holds a current FIPS 140-2 certificate and that module remains on NIST’s active modules list, you are covered for now, but plan your migration path. Acceptable Encryption
In March 2026, an anonymous whistleblower published what may be the most detailed exposé of compliance fraud the technology industry has ever seen. The target: Delve, a Y Combinator-backed startup valued at $300 million that promised to get companies SOC 2 certified in days using AI. The allegation: that Delve had been fabricating audit evidence, generating auditor conclusions before any auditor reviewed client data, and getting unaccredited Indian certification mills to rubber-stamp the results. If you work in tech and care about security compliance, or if you were a Delve customer, this story matters to you. What Actually Happened Delve was founded in 2023 by MIT dropouts Karun Kaushik and Selin Kocalar. The pitch was compelling: use “agentic AI” to compress months of painful compliance work into a few days. By mid-2025, the company had raised $32 million in Series A funding, claimed over 1,000 customers in 50 countries, and had become one of the most talked-about names in the compliance automation space. Then, in December 2025, an email went out to hundreds of Delve clients. It alleged that Delve had leaked a publicly accessible Google spreadsheet containing hundreds of confidential audit reports, and that those reports were fraudulent. Delve’s CEO dismissed it as “an AI-generated email with falsified claims.” That denial turned out to be harder to sustain than expected. In March 2026, the anonymous account Deepdelver published a detailed technical analysis of the leaked database. The findings were striking. Across 533 leaked reports covering 455 companies, the same auditor conclusion language appeared word for word, including an identical grammatical error. Auditor conclusions and test results had been generated before any client even provided their company information. The auditors signing off were not the US-based CPA firms Delve had advertised, but Indian certification mills operating through empty shell addresses. Inc. Magazine covered the initial story in detail. Read the full article here. Will Affected Companies Lose Their SOC 2 Certification? The short answer is no, not automatically. SOC 2 reports are issued by independent CPA firms, not by compliance platforms. Delve was the evidence collection and preparation tool. The auditor signed off separately. There is no central SOC 2 registry, no revocation authority, and no body that automatically invalidates a certificate because the platform used to prepare it has been accused of fraud. The certificate exists. It is technically still valid. But a certificate is only as credible as the evidence behind it. If the controls it claims were in place were never actually implemented, if the board meeting minutes were identical boilerplate, if the penetration test never happened, if the device security screenshots were one-off manual uploads rather than evidence of continuous monitoring, the certificate is not a record of real compliance. It is a document waiting to be challenged. The moment a Delve client goes to renew with a reputable auditor, that auditor will look at the evidence. They will find gaps. That renewal failure is when the certificate effectively collapses, and it almost always happens at the worst possible time. Review our SOC 2 compliance checklist to understand exactly what a legitimate audit requires. The Three Situations Every Delve Client Is In Right Now Not every Delve client faces the same risk. Understanding which situation you are actually in is the most important thing you can do right now. Situation 1: Your controls are real, just poorly documented. Your underlying security practices are solid. Delve’s platform generated sloppy evidence around them, but the controls themselves exist. A gap assessment, a cleanup, and a fresh audit with a reputable firm is all you need. Manageable. Situation 2: You have gaps between what your certificate claims and what exists. Some controls were implemented, some were not. The Delve platform made it very easy to click through pre-populated forms and never notice the difference. These gaps are fixable — but only if you find them before your next renewal, your next enterprise customer review, or your next M&A process does. For a deeper understanding of what a proper gap analysis involves, see our detailed guide to gap analysis. Situation 3: Significant controls were never implemented. This creates real commercial, contractual, and in some cases legal exposure. It is particularly serious for companies that handle health data under HIPAA or process EU resident data under GDPR, and for any company that has won government or federal contracts on the basis of these certifications. All three situations look identical from the outside right now. Your certificate exists. Your trust page is live. Nothing has visibly broken. The only way to know which situation you are in is to actually look The Consequences Nobody Is Fully Reporting Most coverage of this story has focused on Delve itself. The more important story is what happens to Delve’s clients over the next 12 months. The enterprise customer risk. Delve’s questionnaire AI was answering vendor security questionnaires on behalf of clients, claiming controls, MDM systems, penetration tests, backup restoration simulations, that the platform demonstrably never verified. Delve clients were making specific false representations to their own enterprise customers during procurement. If any of those customers later suffers a breach and traces it back to a vendor that misrepresented its security posture, the liability chain is clear. This is one of the common pitfalls in SOC 2 that organisations rarely anticipate until it is too late. The HIPAA exposure is more serious than reported. The Deepdelver report identifies multiple Delve clients that process protected health information for millions of US citizens. Under HIPAA, penalties for compliance violations escalate from fines to criminal charges depending on whether the violation was knowing or unknowing. The critical legal threshold here is December 2025. Companies that received the breach notification email and took no meaningful action after that point have a documented timestamp of when they were put on notice. The distinction between unknowing and knowing violation may hinge on that date. GDPR creates cross-border exposure. Under Article 83 of the GDPR, fines can reach 4% of global annual revenue
If you work with the U.S. Department of Defense in any capacity, CMMC compliance is not optional. It is the price of admission. And if you are not prepared, it could cost you your contracts, your reputation, and your seat at the table in the defense industrial base. This guide breaks down everything you need to know about CMMC compliance clearly, honestly, and without the jargon overload. What Is CMMC Compliance? CMMC stands for Cybersecurity Maturity Model Certification. It is a framework developed by the U.S. Department of Defense (DoD) to ensure that defense contractors and subcontractors adequately protect sensitive government information from cyber threats. In plain terms: if you handle federal data, especially sensitive technical or operational information, the DoD wants proof that your cybersecurity practices are up to standard. Not a promise. Actual, verified proof. CMMC compliance means meeting a defined set of cybersecurity practices and, depending on your level, having those practices certified by an accredited third-party assessor, also known as a C3PAO (Certified Third-Party Assessment Organization). It is structured, tiered, and increasingly enforced, particularly since the final CMMC rule was formally codified into federal acquisition regulations in December 2024. Why CMMC Compliance Matters for Defense Contractors The defense sector is one of the most targeted industries for cyberattacks. According to IBM’s Cost of a Data Breach Report, the average cost of a data breach reached $4.45 million in 2023, and breaches involving government data carry consequences far beyond the financial hit. Foreign adversaries, particularly nation-state actors, have been systematically targeting defense contractors to steal intellectual property, weapons designs, and operational intelligence. The DoD created CMMC specifically to close the gaps in the Defense Industrial Base (DIB) cybersecurity posture. For defense contractors, CMMC compliance matters for three hard reasons: Contract eligibility. CMMC requirements are embedded directly into DoD contract solicitations. If you do not meet the required CMMC level, you cannot bid. Full stop. Legal and regulatory liability. Under the False Claims Act, misrepresenting your cybersecurity compliance when submitting to a federal contract can result in significant legal exposure, treble damages, and penalties. Supply chain trust. Even if you are a subcontractor, your prime contractor is responsible for ensuring your compliance. Failure on your part puts their contracts at risk too. The History and Evolution of CMMC From CMMC 1.0 to CMMC 2.0: What Changed? CMMC was first introduced in 2020 as CMMC 1.0, a five-level model that drew heavily from existing NIST frameworks. It was ambitious but widely criticized for being overly complex, expensive to implement, and difficult to scale, especially for small and medium-sized businesses in the defense supply chain. In response to industry feedback, the DoD released CMMC 2.0 in November 2021, streamlining the model significantly. The five levels were reduced to three. The most notable change was the elimination of unique CMMC-specific practices, bringing the framework into direct alignment with NIST SP 800-171 and NIST SP 800-172. CMMC 2.0 also introduced a critical flexibility provision: certain Level 2 contractors may be permitted to perform annual self-assessments rather than requiring a third-party audit, depending on the sensitivity of the information they handle. The final CMMC rule was published in the Federal Register in December 2024, officially codifying CMMC 2.0 into the Defense Federal Acquisition Regulation Supplement (DFARS). How CMMC Relates to NIST SP 800-171 and DFARS NIST SP 800-171 is the foundational document underpinning CMMC Level 2. It outlines 110 security practices across 14 control families designed to protect Controlled Unclassified Information (CUI) in non-federal systems. DFARS clause 252.204-7012 has long required defense contractors to comply with NIST SP 800-171 on a self-attestation basis. The core problem? Self-attestation created significant inconsistency and allowed non-compliant contractors to fly under the radar. CMMC changes that by adding mandatory third-party verification for a large portion of the DIB, bringing real accountability into the equation for the first time. The Three Levels of CMMC 2.0 Explained CMMC 2.0 organizes compliance into three progressive levels. Each level corresponds to the type of information your organization handles and the sophistication of threats you may face. CMMC Level 1: Foundational Who it applies to: Contractors who handle Federal Contract Information (FCI) but not CUI. Requirements: 17 basic cybersecurity practices drawn from FAR clause 52.204-21. Assessment method: Annual self-assessment with an executive affirmation submitted to the Supplier Performance Risk System (SPRS). Level 1 is the baseline. Think good cyber hygiene, things like using antivirus software, controlling who has access to systems, and keeping your software updated. Not glamorous, but non-negotiable. CMMC Level 2: Advanced Who it applies to: Contractors who handle Controlled Unclassified Information (CUI). Requirements: All 110 practices from NIST SP 800-171, organized across 14 domains. Assessment method: Either triennial third-party assessment by a Certified Third-Party Assessment Organization (C3PAO) or annual self-assessment, depending on contract criticality. This is where the majority of the defense contractor community lands, and where most of the compliance effort (and cost) is concentrated. If your organization touches CUI in any meaningful way, Level 2 is almost certainly your target. CMMC Level 3: Expert Who it applies to: Contractors supporting the DoD’s most critical programs, handling CUI that presents higher-risk threat vectors, often involving advanced persistent threats (APTs). Requirements: 110+ practices from NIST SP 800-171 plus select practices from NIST SP 800-172. Assessment method: Government-led assessment conducted by the Defense Contract Management Agency (DCMA). Level 3 is the top tier. If you are here, you already know what you are dealing with, and so do your adversaries. CMMC Level Information Type Practices Required Assessment Type Level 1: Foundational FCI 17 (FAR 52.204-21) Annual self-assessment Level 2: Advanced CUI 110 (NIST SP 800-171) C3PAO or self-assessment Level 3: Expert CUI (high-value) 110+ (NIST SP 800-172) Government-led (DCMA) Who Needs to Be CMMC Compliant? Prime Contractors Any organization that holds a DoD contract involving FCI or CUI must comply with the applicable CMMC level. Prime contractors are typically well-resourced enough to navigate the process, but that does not make them exempt from the hard work, or from the
The “SSAE 18 vs SOC 2” debate typically surfaces when buyers, vendors, and even internal teams are all talking about the same general assurance problem, but using the wrong labels. A procurement team asks, “Do you have SSAE 18?” A founder says, “We’re going for SSAE 18 certification.” A customer security team asks for an “SSAE 18 SOC 2 report.” Everyone is circling the same planet, but not always landing on the right terminology. SSAE 18 and SOC 2 are not competing things. They are related, but they are not interchangeable. The AICPA defines SOC 2 as an examination and report on controls at a service organization relevant to security, availability, processing integrity, confidentiality, or privacy. SSAE 18, by contrast, is the attestation standard framework under which these kinds of engagements are performed. That distinction matters because buyers often ask for the wrong artifact. If you answer the wrong question, you can waste months preparing the wrong report. Quick Answer: SSAE 18 Is a Standard; SOC 2 Is a Report The simplest accurate explanation is this: SSAE 18 is the professional attestation standard; SOC 2 is the report deliverable. The standard tells the auditor how to perform the engagement. The report is what your customers actually read. The AICPA states that SSAE No. 18 was issued as part of its attestation clarity project, which clarified and recodified attestation standards. The same organization also explains that SOC reports are part of the AICPA’s broader SOC suite of services used to communicate controls at service organizations. So when someone says, “We need SSAE 18,” what they usually mean is one of two things: either they want a SOC 1 report for financial-reporting-related controls, or they want a SOC 2 report for security and broader system controls. How SSAE 18 Relates to SOC 1, SOC 2, and SOC 3 SOC 1 addresses controls at a service organization that are relevant to a user entity’s internal control over financial reporting. The AICPA positions SOC 1 specifically for management of user entities and their financial statement auditors. SOC 2 addresses controls relevant to the Trust Services Criteria (TSC): Security, Availability, Processing Integrity, Confidentiality, and Privacy. It is designed for customers and other specified users who need detailed information about system controls. SOC 3 covers the same trust services subject matter as SOC 2, but in a general-use format with less detail, so it can be freely distributed. (Think of it as the marketing-friendly version.) In plain English: SSAE 18 sits underneath the engagement methodology; SOC 1, SOC 2, and SOC 3 are the reporting formats and scopes that come out of it. What Is SSAE 18? SSAE 18 stands for Statement on Standards for Attestation Engagements No. 18. It is an AICPA-issued attestation standard used in examinations, reviews, and agreed-upon procedures for nonissuers. The AICPA describes SSAEs as applicable to the preparation and issuance of attestation reports for nonissuers, and specifically notes that SSAE No. 18 completed the attestation clarity project through clarification and recodification. Who Issues SSAE 18 and Who Performs the Engagement The AICPA Auditing Standards Board (ASB) issues SSAE standards. The actual engagement, however, is performed by an independent CPA firm or service auditor. That division of labor is important. Your company does not “self-issue” SSAE 18. A CPA firm performs an attestation engagement under that standard and then issues the related report. Insider Tip When a buyer asks whether you are “SSAE 18 certified,” they are using market shorthand, not technical language. The better response is: “We have a SOC 2 Type 2 report issued by an independent CPA firm under the applicable attestation standards.” What SSAE 18 Replaced (SSAE 16 / SAS 70 Context) Historically, the service-organization reporting world moved from SAS 70 to SSAE 16, and then to SSAE 18. The AICPA’s clarity and convergence work eliminated the old SAS 70 framing, established the SOC-branded reports, and recodified the underlying attestation standards into SSAE 18. The standard was introduced in 2016 and implemented in 2017 as part of this evolution. (For international context, SSAE 18’s closest equivalent is ISAE 3402, issued by the International Auditing and Assurance Standards Board.) That is why older buyers may still talk in legacy language. They remember SAS 70. Mid-generation buyers remember SSAE 16. Today’s market usually asks for SOC 1 or SOC 2, but sometimes with yesterday’s vocabulary still attached. Which Engagements Fall Under SSAE 18 Within the SOC context, SSAE 18 governs how the practitioner performs examinations that lead to reports such as SOC 1, SOC 2, and SOC 3. The AICPA’s SOC suite overview frames these offerings as assurance reports used to help assess and address outsourcing risk. What Is a SOC 2 Report? A SOC 2 report is an independent attestation report on controls at a service organization relevant to the Trust Services Criteria. The AICPA defines SOC 2 around the five criteria categories: Security, Availability, Processing Integrity, Confidentiality, and Privacy. SOC 2 exists because businesses increasingly outsource critical systems to cloud and SaaS providers, and they want a way to evaluate whether those providers have appropriate controls in place. We’ve written an in-depth guide on what SOC 2 is, which you can read here. What SOC 2 Evaluates (Controls Aligned to Trust Services Criteria) SOC 2 evaluates whether the service organization’s system and controls are suitably designed—and, in a Type 2 engagement, whether they operated effectively over a review period—against the applicable TSC. Security is always part of SOC 2, while Availability, Processing Integrity, Confidentiality, and Privacy are included based on the nature of the service and customer commitments. If you’re unsure which criteria apply to your organization, a gap analysis is a smart first step. SSAE 18 vs SOC 2: Side-by-Side Comparison Category SSAE 18 SOC 2 What it is Attestation standard Report deliverable Issued by AICPA Auditing Standards Board Independent CPA firm (after the engagement) Primary purpose Governs how the engagement is performed Communicates results about controls relevant to TSC Scope Broad attestation framework Security and
