Standards & frameworks

Certifiable standard, regulation, framework or attestation?

The difference decides what you can be certified for, who decides, and whether you have a choice. Certifiable ISO management systems, EU regulations and directives, voluntary frameworks, attestation programmes and contractual requirements are different things. Here is each one in plain terms, with the services we provide for it.

Where most clients start

ISO management systems

Our core. Certifiable, and able to run together as an integrated system.

ISO 27001

Current: ISO/IEC 27001:2022 + Amd 1:2024

Information security management systems - implementation, internal audit and maintenance.

What it is: Voluntary international standard - certifiable
Who certifies or supervises: Accredited certification bodies
Who it applies to: Any organisation protecting information; often a customer or tender requirement.

ISO 27001 services ISO Internal Audits ISO 27001 Internal Audit Integrated system audits Supplier audits Outsourced audit programmes

Last verified 16 October 2026 against ISO - ISO/IEC 27001.

ISO 9001

Current: ISO 9001:2026 (transition from 2015 until 30 Sep 2029)

Quality management systems, including the move to ISO 9001:2026.

What it is: Voluntary international standard - certifiable
Who certifies or supervises: Accredited certification bodies
Who it applies to: Any organisation, products or services; often a customer or tender requirement.

ISO 9001 services ISO Internal Audits ISO 9001 Internal Audit Integrated system audits Supplier audits Outsourced audit programmes

Last verified 16 October 2026 against Global ACI - ISO 9001:2026 transition and ISO - ISO 9001.

ISO 42001

Current: ISO/IEC 42001:2023

AI management systems - inventory, risk and impact assessment, lifecycle governance.

What it is: Voluntary international standard - certifiable. Not legally mandatory.
Who certifies or supervises: Accredited certification bodies
Who it applies to: Organisations that develop, provide or use AI systems.

ISO 42001 services ISO Internal Audits ISO 42001 Internal Audit Integrated system audits Outsourced audit programmes Nonconformity follow-up

Last verified 16 October 2026 against ISO - ISO/IEC 42001.

Integrated management systems

Not a standard of its own: two or more of the standards above run as one system on their shared structure, each still certified - and audited - against its own requirements.

EU regulation

Law, supervised by authorities. Whether it applies depends on your sector, size and country.

DORA

ICT risk, incident reporting, resilience testing and ICT third-party risk for financial entities - and their suppliers.

What it is: EU regulation - not certifiable
Who certifies or supervises: National competent authorities and the European Supervisory Authorities
Who it applies to: Financial entities listed in Article 2, depending on their legal classification; ICT providers mostly through their contracts with those entities.

DORA services vCISO Fractional GRC Lead

Last verified 16 October 2026 against EUR-Lex - Regulation (EU) 2022/2554 and European Commission - Digital operational resilience.

NIS2

Applicability under national law, risk-management measures and incident reporting.

What it is: EU directive, applied through each Member State's law - not certifiable
Who certifies or supervises: National competent authorities
Who it applies to: Essential and important entities in listed sectors, depending on the sector, entity, size and the national law that applies.

NIS2 services vCISO Fractional GRC Lead

Last verified 16 October 2026 against European Commission - NIS2 and EUR-Lex - Directive (EU) 2022/2555.

GDPR & ISO 27701

GDPR programmes and ISO/IEC 27701:2025 privacy management systems.

What it is: GDPR is EU law; ISO/IEC 27701:2025 is a voluntary, certifiable privacy management standard
Who certifies or supervises: Data protection authorities supervise GDPR; certification bodies certify ISO 27701
Who it applies to: Organisations processing personal data of people in the EU/EEA.

GDPR & ISO 27701 services

Last verified 16 October 2026 against ISO - ISO/IEC 27701.

Voluntary frameworks, attestation and contractual requirements

NIST CSF 2.0 is voluntary and has no certificate; SOC 2 is an attestation by a CPA firm; CMMC is a contractual requirement. Mostly asked for by US buyers and contracts.

NIST CSF 2.0

Current and target profiles across Govern, Identify, Protect, Detect, Respond and Recover.

What it is: Voluntary framework - no certification scheme exists
Who certifies or supervises: No one certifies; used for self-assessment and reporting
Who it applies to: Any organisation; common with US buyers.

NIST CSF 2.0 services vCISO

Last verified 16 October 2026 against NIST - Cybersecurity Framework.

SOC 2

Readiness for a CPA firm's SOC 2 examination against the Trust Services Criteria.

What it is: Attestation report - not a certification
Who certifies or supervises: Licensed CPA firms issue SOC 2 reports
Who it applies to: Service organisations whose US customers ask for it.

SOC 2 services vCISO Fractional GRC Lead

Last verified 16 October 2026 against AICPA - SOC 2.

CMMC & NIST SP 800-171

Scoping, SSP and POA&M support and readiness for US defence supply-chain assessments.

What it is: US Department of Defense contractual requirement
Who certifies or supervises: Self-assessment, C3PAOs or DCMA DIBCAC, depending on level
Who it applies to: Contractors and subcontractors handling FCI or CUI under DoD contracts.

CMMC & NIST SP 800-171 services

Last verified 16 October 2026 against DoD CIO - CMMC and Federal Register - 32 CFR Part 170.

Not sure which applies to you?

Tell us your sector, country and what a customer or regulator has asked for. We will say which standards matter and which do not.

Discuss your requirements

Kellwick is an independent consulting and internal audit practice. We are not a certification body and do not issue ISO certificates. Certification decisions are made only by accredited certification bodies.