Compliance · Guide
Compliance frameworks: which ones a UK firm needs and in what order
Compliance frameworks: which ones a UK firm needs and in what order
Key takeaways
A compliance framework is a set of requirements you implement and can prove. Some are law, some customers demand, some are optional. Most UK B2B tech firms start with Cyber Essentials and ISO 27001, add SOC 2 for US buyers, and take on DORA, NIS or ISO 42001 only when a customer or regulator brings them into scope.
- UK GDPR accountability
- The ICO says organisations must have appropriate measures and records in place to be able to demonstrate their compliance with UK GDPR.
- DORA scope
- DORA, Regulation (EU) 2022/2554, has applied since 17 January 2025 to 20 types of EU financial entities and to ICT third-party service providers, according to EIOPA.
- Cyber Security and Resilience Bill
- Introduced on 12 November 2025 and still before Parliament, the Bill would reform the NIS Regulations and bring medium and large managed service providers into scope.
- Cyber Essentials
- The NCSC calls Cyber Essentials the minimum standard of cyber security recommended by the UK Government; it covers five technical controls, with Cyber Essentials Plus adding independent testing.
A financial services prospect sends its first security questionnaire, and one question asks which compliance framework you follow. Your team can name four, but nobody can say which ones you are obliged to hold, which ones the customer actually wants, and which are optional reading. The deal waits while you work it out.
This list is for founders, CTOs and heads of security at UK B2B tech firms with 25 to 250 staff selling into regulated industries. It sorts twelve frameworks into what the law requires, what customers ask for and what is optional, then gives an order to take them on so each one reuses the last.
What is a compliance framework, and which ones are on this list?
A compliance framework is a set of requirements you implement and can prove. Some are law, some customers demand, some are optional. Most UK B2B tech firms start with Cyber Essentials and ISO 27001, add SOC 2 for US buyers, and take on DORA, NIS or ISO 42001 only when a customer or regulator brings them into scope.
The selection criterion is simple: a framework is on this list if a UK firm of 25 to 250 people is likely to be asked for it by a regulator, a customer or its own board. That leaves out US-only frameworks: HIPAA, CCPA and FFIEC matter only if you serve US healthcare, Californian consumers or US banks directly.
| Framework | Type | Who it applies to | What triggers it | The proof it produces |
|---|---|---|---|---|
| UK GDPR and the Data Protection Act 2018 | Law | Any organisation processing personal data in the UK | Processing personal data | Records, policies and assessments you can show the ICO |
| FCA operational resilience rules | Regulation | Banks, building societies, insurers, PRA-designated investment firms, payment and e-money firms and other listed firms | FCA authorisation in a listed category | Self-assessment, mapping and testing against impact tolerances |
| DORA | Regulation (EU) | EU financial entities and their ICT third-party providers | An EU-regulated entity, or EU financial customers | Contract terms, ICT risk framework, incident reporting |
| NIS Regulations 2018 and the Cyber Security and Resilience Bill | Law (the Bill is before Parliament) | Essential services and digital service providers; the Bill adds managed service providers and data centres | Sector, size and service type | Security duties enforced by a sector regulator |
| EU AI Act | Law (EU) | Providers and deployers of AI systems used in the EU | Placing or using AI systems in the EU market | Risk classification, technical documentation, transparency |
| Cyber Essentials | Certification | Any UK organisation | Customer or public-sector supplier requirements | Certificate (basic, or Plus with technical testing) |
| ISO/IEC 27001 | Certification | Any organisation | Enterprise and regulated customers | Accredited certificate for a defined scope |
| SOC 2 | Attestation | Service organisations | US and multinational customers | CPA firm's report, Type 1 or Type 2 |
| ISO/IEC 42001 | Certification | Organisations that build or use AI | Customers asking how you govern AI | Certificate for an AI management system |
| ISO 22301 | Certification | Any organisation | Resilience demands from regulated customers | Certificate for a business continuity management system |
| NIST CSF 2.0 | Reference | Any organisation | Board or customer asks for a maturity view | Self-assessed profile against six functions |
| PCI DSS | Industry standard | Entities that store, process or transmit cardholder data | Card payments in your service | Self-assessment or assessor's report on compliance |
Which compliance frameworks does UK or EU law require?
UK law requires every firm that processes personal data to meet UK GDPR and the Data Protection Act 2018. Sector rules add more: FCA operational resilience for listed financial firms, DORA for EU financial entities and their ICT providers, and the NIS Regulations for essential services and larger cloud providers. The EU AI Act follows AI products into Europe.
1. UK GDPR and the Data Protection Act 2018
What it is. The UK's data protection law, enforced by the ICO. See our GDPR overview for the basics.
When it matters. From the first customer record you hold. The ICO's accountability principle says you "must have appropriate measures and records in place to be able to demonstrate your compliance."
What to do. Keep a record of processing, a data protection impact assessment process and supplier terms you can show a customer on request.
2. FCA operational resilience rules
What it is. FCA rules requiring in-scope firms to identify important business services and set impact tolerances for disruption.
When it matters. If you are an FCA firm in a listed category, or you supply one. The FCA's operational resilience page lists banks, building societies, PRA-designated investment firms, insurers, enhanced-scope SM&CR firms, and payment and e-money institutions among others. In-scope firms "had until 31 March 2025" to operate their important business services within tolerance.
What to do. If you are a supplier, expect questions about your role in a customer's important business services. Have recovery times and test results ready.
3. DORA
What it is. The EU's Digital Operational Resilience Act, Regulation (EU) 2022/2554. EIOPA says it applies to "20 different types of financial entities and ICT third-party service providers" and has applied since 17 January 2025.
When it matters. If your group includes an EU-regulated financial entity, or you supply ICT services to one. Article 28 of DORA requires financial entities to manage ICT third-party risk as part of their own ICT risk management.
What to do. Map which EU customers count as financial entities. Then prepare for the contract terms Article 30 requires, including help when an ICT incident affects their service and, where you support a critical or important function, taking part in their threat-led penetration testing.
4. NIS Regulations 2018 and the Cyber Security and Resilience Bill
What it is. The Network and Information Systems Regulations 2018 cover operators of essential services and relevant digital service providers. The Cyber Security and Resilience Bill, introduced to Parliament on 12 November 2025, will "reform and add to" them, the government says. UK Parliament lists it at report stage in the House of Lords in October 2026, so it is not yet law.
When it matters. Possibly already. The ICO counts a UK cloud computing service as a relevant digital service provider, which the Regulations cover today. Micro and small businesses, with fewer than 50 staff and turnover or balance sheet below €10 million, are exempt unless part of a larger group. Looking ahead, the government's summary of the Bill says medium and large managed service providers "will be brought into scope", and regulators will be able to designate critical suppliers. The managed service provider factsheet exempts small and micro providers from that measure, though they can still be designated as critical suppliers.
What to do. If you run a cloud service above the small business threshold, check the ICO's guidance now: you may already be in scope. If you provide managed IT services and are not a small or micro business, track the Bill too.
5. EU AI Act
What it is. The EU's law on AI systems, covered in our EU AI Act overview. The European Commission says it entered into force on 1 August 2024, with prohibitions applying from 2 February 2025.
When it matters. If you build or deploy AI systems used in the EU. Article 2 reaches providers wherever they are established, and providers and deployers outside the EU when the system's output is used in the EU. After political agreement on the AI Omnibus proposal, the Commission says rules for Annex III high-risk use cases "have been extended to 2 December 2027."
What to do. Classify your AI use cases now, so you know whether any fall into a high-risk category before customers ask.
Which compliance framework will customers ask for?
Customers ask for proof they can check without auditing you themselves. For UK B2B tech firms, that usually means Cyber Essentials first, ISO 27001 for enterprise and regulated buyers, and SOC 2 when US buyers appear. ISO 42001 is the newer request, from customers who want to know how you govern the AI inside your product.
6. Cyber Essentials
What it is. The NCSC describes Cyber Essentials as "the minimum standard of cyber security recommended by the Government". It covers five technical controls. See our Cyber Essentials overview.
When it matters. Early. The NCSC notes that "a growing number of organisations require suppliers to be certified to bid for work."
What to do. Certify the basic level first, then move to Cyber Essentials Plus, which adds independent technical testing.
7. ISO/IEC 27001
What it is. The international standard for an information security management system, certified by an accredited body. Our ISO 27001 hub covers the standard itself.
When it matters. When enterprise or regulated customers want evidence that security is managed as a system, not a set of tools.
What to do. Scope it to the services your customers buy, not the whole company. Our ISO 27001 certification process guide sets out the stages.
8. SOC 2
What it is. An attestation report by a CPA firm on controls relevant to security, availability, processing integrity, confidentiality or privacy, under AICPA standards. See our SOC 2 hub.
When it matters. When US or multinational buyers ask for a SOC 2 report by name and will not accept an ISO certificate in its place.
What to do. Build it on your ISO 27001 controls rather than as a second programme. Start with Security only, and add other categories when a buyer asks.
9. ISO/IEC 42001
What it is. The certifiable management system standard for AI. Our ISO 42001 overview explains it.
When it matters. When your product uses AI and customers' questionnaires start asking how you govern models, data and outputs.
What to do. If you already run ISO 27001, extend the same management system rather than standing up a separate one.
Which frameworks are optional or apply only in narrow cases?
The last three frameworks are either voluntary or apply only in narrow cases. ISO 22301 structures business continuity when regulated customers ask about resilience. NIST CSF gives a board a maturity view without a certificate. PCI DSS applies only if card data touches your service. Each is useful, but none belongs at the start of the queue.
10. ISO 22301
What it is. The standard for a business continuity management system. See our ISO 22301 overview.
When it matters. When regulated customers ask how you would keep their service running through a disruption.
What to do. Treat it as a second step after ISO 27001, unless a customer or regulator asks for it by name.
11. NIST CSF 2.0
What it is. A risk management framework from NIST. CSF 2.0 was released on 26 February 2024 and is "designed for all audiences, industry sectors and organization types". See our NIST CSF overview.
When it matters. When the board wants a maturity picture, or a US customer frames questions by its six functions.
What to do. Use it to report maturity, not as a second control set.
12. PCI DSS
What it is. The payment card industry's data security standard, now in its v4.x series.
When it matters. The PCI Security Standards Council says it applies to entities that "store, process, or transmit cardholder data". Whether you must validate is set by payment brands and acquirers.
What to do. Keep card data out of your environment where you can, through a payment provider, to shrink scope.
How to use this list
Use this list in three passes. First, mark every law and regulation that applies to you, because those are not optional. Second, mark what your current and target customers ask for in questionnaires and contracts. Third, treat everything else as reference. The order you take them on matters more than the count.
Six factors decide which frameworks reach your list:
- Sector. Financial services brings FCA rules and, through EU customers, DORA.
- Regulators. Whoever authorises or supervises you sets the rules you cannot skip.
- Customers. Questionnaires and contracts name the certificates and reports they accept.
- Data. Personal data brings UK GDPR; card data brings PCI DSS.
- AI use. AI in your product brings ISO 42001 requests and, if used in the EU, the AI Act.
- Geography. US buyers bring SOC 2; EU customers or entities bring DORA and the AI Act.
For a B2B tech firm. Cyber Essentials, then ISO 27001 scoped to the product, then SOC 2 if US buyers ask, then ISO 42001 if AI is in the product. UK GDPR runs alongside from day one.
For a regulated firm. Start with your regulator's rules: FCA operational resilience, DORA if you have EU entities, and UK GDPR. Then use ISO 27001 and ISO 22301 as the management systems that run them.
How does overlap between frameworks cut the effort?
Most security frameworks ask for the same control areas in different words: governance and risk assessment, access control, asset management, supplier management, incident response, business continuity, change management, and logging and monitoring. Build each area once, with one owner and one evidence trail, and each new framework becomes a mapping exercise, not a new project.
ISO 27001 is the usual base because its management system gives you the risk assessment, internal audit and management review that other frameworks assume. SOC 2, ISO 42001 and ISO 22301 then add criteria or clauses on top. Regulations such as DORA and the FCA rules add reporting duties and testing, but they lean on the same controls.
Evidence collected automatically from your systems serves every framework at once. Evidence assembled by hand before each audit serves one.
What are the most common compliance framework mistakes?
The most common compliance framework mistakes are chasing a framework no buyer asked for, certifying a scope wider than the services customers buy, and running each framework as a separate project with its own owner, tools and evidence. Each one adds cost without adding trust, and the last one multiplies the audit work every year.
- Chasing the badge. Choose frameworks from questionnaires and contracts, not from competitors' websites.
- Scoping too wide. A whole-company scope adds audit days for systems no customer relies on.
- Running parallel programmes. Two frameworks with two control sets is double the evidence for the same risk.
Compliance is not the goal. Being able to prove it, on demand, is.
Frequently asked questions
A regulation is law, enforced by a regulator such as the ICO or the FCA. A compliance framework is a structured set of requirements, which may implement a regulation or may be voluntary, such as ISO 27001 or NIST CSF. Many firms use a voluntary framework as the system that proves they meet the regulation.
Usually fewer than it thinks. List the frameworks named in your contracts, your open questionnaires and your regulators' rules. That list is what you need now. Anything outside it is a choice, and one you should be able to tie to a buyer or a board request.
Largely, but not completely. The parts that do not carry over are the framework-specific ones: the Statement of Applicability for ISO 27001, the system description in a SOC 2 report, the technical tests for Cyber Essentials Plus, and each regulator's incident reporting rules. Plan those as separate pieces of work.
No. A certificate or attestation report shows that an independent party checked a defined scope at a point or over a period. Compliance is the ongoing state between audits, which is why continuous evidence collection matters more than the certificate.
Domain engine
Compliance reference directory.
Every guide in this domain, grouped by level — fundamentals, intermediate and advanced. Open any entry for its core practices, implementation steps and the evidence it produces.
01Fundamentals2 guides
02Intermediate8 guides
Compliance reporting: what a B2B tech firm reports to customers, the board and investorsAudit readiness: how to be ready for any security or compliance auditCompliance risk assessment: rank the obligations your customers and regulators hold you toCompliance training for tech suppliers: what customers and auditors expect, who needs it, and how to prove itCompliance monitoring: run a programme that keeps customer and audit promisesCyber security audit: what it covers and how to prepareCompliance policy: what a B2B tech supplier's policy must coverCompliance audit: every audit a B2B supplier faces, and how to run them from one evidence base
Compliance Accelerator
Ready to meet every framework with one set of controls?
Work with a Trust Architect to map your obligations, choose the right frameworks in the right order, and build a programme that satisfies auditors and enterprise buyers alike.