The frameworks your buyers actually ask about.

SOC 2 is an audit report defined by the American Institute of Certified Public Accountants (AICPA). It demonstrates that a service organization has controls in place against five Trust Services Criteria — security, availability, processing integrity, confidentiality, and privacy. Most US enterprise buyers ask for it before signing.

Type I tests whether controls are designed appropriately at a point in time. Type II tests whether those controls operate effectively across a period, typically 3 to 12 months. Most enterprise buyers eventually require Type II.

ISO/IEC 27001 is the international standard for an information security management system (ISMS). It is certifiable by accredited bodies through a Stage 1 (documentation) and Stage 2 (implementation) audit, followed by surveillance audits each year and full recertification every three years.

ISO/IEC 42001 is the first international standard for an artificial intelligence management system (AIMS). Published in 2023, it specifies how to develop, deploy, and govern AI responsibly across an organization. It is increasingly requested by enterprise buyers and regulators evaluating AI vendors.

The NIST Cybersecurity Framework 2.0 is a voluntary, outcome-based framework published by the US National Institute of Standards and Technology. The 2.0 update added Govern as a sixth top-level function alongside Identify, Protect, Detect, Respond, and Recover. It is not a certification — it is a maturity model.

NIST AI RMF is a voluntary framework for managing risks across the AI lifecycle: Govern, Map, Measure, and Manage. It is the practical baseline US enterprise buyers and US regulators most often reference when asking about AI risk practices. It is not a certification.

It depends on where your deals are. If most of your enterprise pipeline is US-based, start with SOC 2. If you sell into Europe or APAC, ISO 27001 will move more deals. Many companies eventually carry both — the operating model behind them is largely shared, so the second is meaningfully cheaper than the first.