# Security compliance

> Proving to customers and regulators, with an outside audit, that you follow security rules.

- Level: Intermediate
- Topics: Security
- URL: https://tidbit.legios.com.ar/security-compliance/
- In Spanish: [Cumplimiento de seguridad](https://tidbit.legios.com.ar/es/security-compliance/)

**Security compliance** means meeting a published set of security rules and being able to prove it. A company says "we protect your data"; compliance is the paperwork and the outside check that back that sentence up. Big customers, especially banks, hospitals and governments, often refuse to buy software from a vendor that cannot show it.

Two frameworks come up constantly. **SOC 2** is an American standard from the AICPA, the US accountants' association: an independent auditor examines a company's controls (who has access to what, how changes are reviewed, how backups and incidents are handled) and writes a report. A Type I report looks at a single day; a Type II report checks that the controls actually worked over several months. **ISO 27001** is the international standard: a company builds a management system for information security, and an accredited body certifies it, with yearly follow-up audits. Others apply to specific data, like PCI DSS for card payments or HIPAA for US health records.

Compliance is not the same as being secure. It shows that sensible processes exist and are followed, which forces a company to do a lot of good things: inventory its systems, review access, train staff, log and test. But a company can pass an audit and still be breached. Startups usually meet this when their first large customer sends a security questionnaire, and these days whole tools and services exist to help them collect the evidence.

## An analogy

A restaurant's health inspection. The certificate on the wall does not guarantee tonight's dinner is perfect, but it proves someone independent checked the kitchen, the fridge temperatures and the handwashing, and will come back to check again.

## Keep in mind

- Compliance means following a known standard and proving it with an independent audit.
- SOC 2 is an auditor's report on your controls; Type II covers months, not one day.
- ISO 27001 is an international certification renewed through regular audits.
- Passing an audit is not a guarantee of being secure; it shows processes exist and are used.

## Go deeper

- [ISO/IEC 27001 (ISO, official)](https://www.iso.org/standard/27001)
- [ISO/IEC 27001 on Wikipedia](https://en.wikipedia.org/wiki/ISO/IEC_27001)
- [System and Organization Controls (SOC) on Wikipedia](https://en.wikipedia.org/wiki/System_and_Organization_Controls)

## Related terms

- [Framework](https://tidbit.legios.com.ar/framework/): A ready-made skeleton for an app: it sets the structure and calls your code.
- [Backup](https://tidbit.legios.com.ar/backup/): A separate copy of your data, kept so you can get it back when the original is lost.
- [Cybersecurity](https://tidbit.legios.com.ar/cybersecurity/): Protecting computers, networks and data from theft, damage and disruption.
- [TLS certificate](https://tidbit.legios.com.ar/tls-certificate/): The ID card a website shows your browser to prove it is who it claims to be.