Blog

Comprehensive Cybersecurity Compliance: WISP, SOC 2, ISO 27001 & NIST

Written by Larson And Company | 10 Mar 2026

Article Summary

  • WISP Fundamentals: A Written Information Security Plan (WISP) is a formal, documented cybersecurity strategy that outlines how an organization identifies, assesses, and manages risks to protect sensitive data — an essential foundation for any internal control or compliance program.
  • Internal Control Framework Selection: Different frameworks such as SOC 2, ISO/IEC 27001, NIST, and others serve distinct purposes; the “best” framework depends on customer requirements, industry focus, compliance objectives, and resources.
  • SOC 2 vs ISO/IEC 27001: SOC 2 provides an external attestation of controls against trust criteria (security, availability, confidentiality, etc.), while ISO/IEC 27001 offers a globally recognized certification for an organization’s broader Information Security Management System (ISMS).
  • Framework Overlap & Integration: Security frameworks aren’t siloed — many controls overlap (e.g., risk assessment, access controls, monitoring), which means implementing one can support readiness for others and reduce duplication.
  • AI Risk Management Alignment: The NIST AI Risk Management Framework (AI RMF) shares governance and risk principles with SOC 2, enabling organizations to leverage existing policies and controls to manage AI‑specific risks within broader security programs.

Introduction

In today’s fast-evolving digital landscape, organizations face increasing pressure to protect sensitive data, manage risks, and demonstrate compliance to customers, partners, and regulators. Establishing a strong foundation starts with a Written Information Security Plan (WISP), which outlines your organization’s policies, procedures, and security responsibilities. From there, selecting the right internal control framework ensures those policies translate into practical, measurable actions, whether you adopt COSO, ISO, NIST, or another standard. Once internal controls are in place, organizations often evaluate external validation through SOC 2 reports or ISO/IEC 27001 certification, each offering distinct assurances to stakeholders. Finally, with emerging technologies such as AI, understanding the NIST AI Risk Management Framework and how it overlaps with existing controls becomes essential for managing novel risks effectively. This comprehensive guide walks you through how these frameworks and certifications work together, helping your organization build a holistic, integrated approach to cybersecurity, risk management, and regulatory compliance.

What Is a WISP and Why Your Organization Needs One

Running a business while protecting sensitive assets and maintaining compliance grows more challenging every year. The number and variety of threats is rapidly evolving as bad actors continue to search for and exploit security vulnerabilities. A Written Information Security Plan (WISP) is designed to address this risk and help companies achieve a robust and practical set of security controls.

What Is a WISP?

A WISP is a formal document that outlines how an organization identifies, assesses, and manages cybersecurity risks to protect sensitive data. A well written WISP includes administrative, technical, and physical safeguards tailored to your business environment.

A Brief History of WISPs

The concept of WISPs emerged in response to the growing need for structured cybersecurity frameworks:

  • 1996: HIPAA introduced the requirement for healthcare entities to implement security policies.
  • 1999: The Gramm-Leach-Bliley Act (GLBA) mandated financial institutions to protect consumer data.
  • 2003: The FTC’s Safeguards Rule required comprehensive information security programs.
  • 2021–2024: Amendments to the Safeguards Rule and IRS regulations made WISPs mandatory for tax professionals and introduced breach reporting requirements

These milestones reflect a broader trend: regulators increasingly expect organizations to proactively manage data security risks.

Who Is Required to Have a WISP?

WISPs are required for organizations that handle sensitive personal or financial data, including:

  • Tax professionals: The IRS mandates WISPs as part of the PTIN renewal process.
  • Financial institutions: GLBA and FTC Safeguards Rule compliance requires a WISP.
  • Healthcare providers: HIPAA regulations require documented security policies.
  • Businesses operating in certain states: States like Massachusetts and New York have their own WISP requirements.

Even if your organization isn’t legally required to have a WISP, implementing one can significantly reduce your risk exposure and better prepare you for security incidents.

What Should a WISP Include?

While the exact contents may vary by industry and regulatory framework, a strong WISP typically includes the following elements

  1. Purpose and Scope: Define the objectives and coverage of the plan.
  2. Roles and Responsibilities: Identify who is responsible for implementing and maintaining security controls.
  3. Risk Assessment: Outline how risks are identified and evaluated.
  4. Security Policies: Include policies for access control, data classification, encryption, and incident response.
  5. Training and Awareness: Describe employee training programs and ongoing awareness efforts.
  6. Monitoring and Auditing: Detail how systems are monitored and how compliance is verified.
  7. Incident Response Plan: Provide procedures for detecting, reporting, and responding to security incidents.
  8. Review and Updates: Establish a schedule for reviewing and updating the WISP.

Why Partner With Us?

Our IT audit team has many years of experience in SOC 1, SOC 2 , HIPAA, and compliance engagements, and we understand the complexities of achieving regulatory compliance. By partnering with us to develop your WISP, you’ll gain:

  • A customized plan aligned with your business and regulatory requirements.
  • Expert guidance from auditors who understand both technical controls and legal obligations.
  • Confidence that your organization is better prepared to address audits, security events, and emerging threats.

From a WISP to Choosing the Right Control Framework

Now that you understand the importance of establishing a Written Information Security Plan (WISP) as the backbone of your organization’s cybersecurity posture — outlining risk assessment approaches, security policies, incident response procedures, and ongoing monitoring — the next natural question is how to structure and evaluate the controls that bring that plan to life. A WISP sets the stage by documenting your security intentions and responsibilities, but organizations also need a formal internal control framework to guide implementation, prioritization, and measurement of those controls across the business. Whether you’re considering frameworks like COSO, ISO, NIST, or others, this next article helps you assess which framework aligns with your risk profile, industry expectations, and compliance goals, ensuring that your WISP doesn’t just exist on paper but drives effective, sustainable security and governance outcomes.

Which Internal Control Framework is Best?

NIST vs ISO vs SOC vs PCI vs….

Which control framework is the best to use? Can I pick and choose from multiple frameworks? Who are the key stakeholders in this process?

As a CPA and SOC practitioner, I have been asked these questions many times. The answer is, of course, it depends. However, here are some thoughts to guide you in your research. At the end, I provide a table comparing some of the more common control frameworks/rulesets.

Which control framework is the best?

What have your customers have asked for? Unless you are very proactive, you are likely beginning this search because a key customer has asked you to be compliant with XYZ framework. Although they are not the end all be all for this decision, if a customer is asking for a particular framework, this is a strong sign that the customer identified framework is the correct one to use.

What does your industry focus on? If you are proactive and beginning this search on your own – good for you! Do you provide a platform as a service, software as a service, manage a government resource? Refer to the table below for industries and focus for each framework.

How much time and monetary resources could you budget for implementation? Some frameworks are more intensive than others. Most of the frameworks cited below are for entities planning a comprehensive response to risks they identify and potentially to achieve independent attestation or certification. Between preparation, implementation, and testing, these efforts could take up to a year to achieve. If you are just looking for best practices, consider a web search instead.

Can I pick and choose from multiple frameworks?

Probably not. If your goal is compliance attestation or certification, you will need to adhere to a particular framework. If your goal is general company health and risk management, start by identifying the best fit framework. If there are acceptable/justifiable gaps between your risk assessment and objectives/criteria addressed in the framework, you may refer to multiple frameworks.

Who are the key stakeholders in this process?

There are two main reasons to adopt a control framework: customer growth/retention and risk mitigation (arguably the same reason). In response to this, your key stakeholders will be a mix of external and internal parties. The following are the main stakeholders that will be important to development of your program:

  • B2B customers who use your service – you will likely begin this process by looking at SLAs to determine your key commitments or reasons you are in business and then determining risks of achieving those objectives.
  • Governmental organizations that use your service – laws or regulations may be very specific on what you will need to adopt.
  • Company management, primarily those responsible for security, technology, customer experience and finance – these individuals will have the most insight into what risks the company faces, what current processes look like, and how best to mitigate deficiencies.
  • Company governance – the board of directors or owners will have ultimate responsibility for the security program.

Hopefully these points will help in your research. See below for a table comparing some of the more common control frameworks/rulesets. Feel free to reach out to Larson and Company with any questions!

Click here for a printable pdf of the framework comparison table.

Transitioning from Framework Choice to Certification Comparison

After exploring which internal control framework is best for your organization’s risk profile, compliance needs, and operational maturity, the next logical step is understanding how those frameworks translate into external assurance and certification. Choosing a framework helps you structure your security and control environment internally, but many organizations also need to demonstrate that structure to customers, partners, and regulators — and that’s where external attestation and certification come in. The next article digs into two of the most common ways to validate your controls in the marketplace — SOC 2 reports and ISO/IEC 27001 certification — explaining how each aligns with internal frameworks, what they prove to stakeholders, and how to decide which is the right fit for your compliance strategy.

Choosing between SOC 2 Reports and ISO/IEC 27001 Certification

When it comes to choosing between a SOC 2 report and the ISO/IEC 27001 certification, there are advantages and disadvantages to each. Each organization needs to come to a conclusion as to which fits best for the needs of their organization. Some organizations find that it is helpful to have both.

SOC 2 is a report that is issued by a certified public accounting firm. The framework for the report is issued by the American Institute of Certified Public Accountants (AICPA). A SOC 2 report has different principles that can be attested on, which are: Security, Availability, Processing Integrity, and Confidentiality or Privacy. The SOC 2 report is required to include Security but may include any other combination of these principles. SOC reports are not a certification; you cannot be SOC certified.

There are two different types of SOC 2 reports. Type 1 is an audit that is performed at a point in time. This means that when the company is audited, all of the requirements are met. This doesn’t mean the requirements have been met in the past or will be met in the future. Type 2 is an audit where testing is performed over a certain time period. This means you can rely on a SOC 2 Type 2 report to provide comfort that the audited company meets the principle (Security, Availability, etc.) requirements for a certain period of time. This provides for significantly more assurance than a Type 1 report.

ISO/IEC 27002 is a security standard published by International Organization for Standardization (ISO) and by the International Electrotechnical Commission (IEC). It is by this standard of requirements that organizations are certified to ISO/IEC 27001.

ISO/IEC 27001 is a certification that is best known for verifying that the requirements to the information security management system (ISMS) are met. According to ISO, “An ISMS is a systematic approach to managing sensitive company information so that it remains secure. It includes people, processes and IT systems by applying a risk management process.” This standard is recognized internationally and is provided at a point in time. This means that when the company is inspected, all of the requirements are met. This does not mean they have been met in the past or will be met in the future. This report can provide comfort to those using the inspected company that they have met, at the time of their last inspection, requirements to be ISO/IEC 27001 certified.

In summary, the ISO/IEC 27001 is an internationally recognized certification over the information security management system at a point in time. A SOC 2 report is based on principles chosen by management and is more flexible in that it can be at a point in time (Type 1) or for a period of time (Type 2) and can cover multiple areas depending on the organizational needs.

Bridging Certification Choices to Emerging AI Risk Standards

Now that you’ve learned how SOC 2 reports and ISO/IEC 27001 certification offer independent ways to validate your organization’s security and control environment to customers and regulators, it’s time to look at how those established compliance practices interact with emerging risk domains. As artificial intelligence becomes more integral to business operations, organizations must not only maintain strong controls — as evidenced through SOC 2 or ISO 27001 — but also understand how to manage the unique risks introduced by AI systems. The next article explores the NIST AI Risk Management Framework, showing where its principles and guidance overlap with SOC 2 controls and how you can leverage your existing compliance investments to address AI‑specific governance, risk assessment, and monitoring challenges without reinventing the wheel.

NIST AI Risk Management Framework Overlap with SOC 2

The National Institute of Standards and Technology (NIST) released its Artificial Intelligence Risk Management Framework (AI RMF) on July 26, 2024. This framework provides a voluntary roadmap for organizations seeking to identify, assess, and mitigate risks associated with AI systems while promoting responsible and trustworthy AI development. Simultaneously, organizations have been increasingly engaged in System and Organization Controls (SOC) reporting, particularly SOC 2, which evaluates controls related to security, availability, processing integrity, confidentiality, and privacy.

Both the AI RMF and SOC reporting serve to protect organizations and their stakeholders from technological and operational risks. While the AI RMF focuses specifically on managing risks related to AI systems, the SOC 2 framework provides a robust foundation for managing system controls more generally, covering many of the same core areas that are critical for AI, such as security, privacy, and governance. Organizations already familiar with SOC 2 can leverage their existing policies and procedures—such as those for risk assessment, governance, monitoring, and system development lifecycle (SDLC)—to effectively implement the AI RMF.

Organizations that already comply with SOC 2 will find they have a strong starting point for many of the requirements set out by the AI RMF.

Overview of the NIST AI RMF

  1. Govern: This function focuses on organizational policies and practices for AI risk management. It stresses the importance of establishing legal, regulatory, and operational frameworks, along with setting clear roles and responsibilities across the AI lifecycle. Organizations should develop robust governance frameworks for managing AI risks, with policies that address risk assessment, monitoring, and the system development lifecycle (SDLC). Policies developed as part of the SOC audit process, such as those for governance, risk assessment, and monitoring, will support the AI RMF’s Govern function.
  2. Manage: Managing AI risks involves taking concrete steps to address identified risks, mitigate potential harms, and adjust systems as they evolve. Organizations should develop continuous feedback loops, ensuring that AI systems are regularly evaluated for emerging risks and opportunities. As part of this, the SDLC should account for ongoing monitoring of system performance against trustworthiness benchmarks.
  3. Map: Mapping is about understanding the context in which AI systems operate, identifying stakeholders, and documenting risks related to the AI system. This function encourages organizations to assess the potential impacts of AI systems and understand how they fit into broader business goals. The SOC 2 framework already requires a structured approach to assessing risks, and this maps closely to the AI RMF’s guidance, which emphasizes continuous risk assessment throughout the AI lifecycle.
  4. Measure: The Measure function emphasizes evaluating the performance and trustworthiness of AI systems. Organizations are encouraged to track the system's effectiveness, accuracy, and compliance with defined standards over time. SDLC policies and processes will need to incorporate new assessments of system output. This includes developing specific metrics to determine system fit and function and evaluating whether the AI system meets trustworthiness standards such as fairness, transparency, and accountability.

Preparing for AI's Organizational Impact

Beyond technical changes, organizations will also need to revisit human resource and training practices as AI systems evolve. The rapid pace of AI development demands that HR policies ensure ongoing industry awareness and continuous learning. Training programs should focus not only on AI system operation but also on the ethical and regulatory aspects of AI, helping employees stay up to date with the latest advancements and risks.

In conclusion, while the NIST AI RMF introduces new frameworks for managing AI risks, organizations that already comply with SOC 2 will find alignment between the two systems. Leveraging existing SOC controls to implement the AI RMF can help organizations build trustworthy, secure, and accountable AI systems, ensuring they are better prepared for the risks associated with AI.

Sources:

AICPA Guide: (SOC 2) Reporting on an Examination of Controls at a Service OrganizationRelevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy (Updated As of October 15, 2022)

NIST Resources, including:

NIST AI RMF Playbook

NIST AI RMF Roadmap

NIST Perspectives

In today’s rapidly evolving digital landscape, implementing a Written Information Security Plan (WISP) is no longer optional—it’s a critical step for protecting sensitive data, maintaining compliance, and mitigating organizational risk. By clearly defining roles, responsibilities, policies, and procedures, a WISP provides a structured approach to cybersecurity that aligns with regulatory requirements and industry best practices. Leveraging established frameworks such as SOC 2, ISO/IEC 27001, and the NIST AI Risk Management Framework allows organizations to tailor controls to their specific needs while preparing for emerging risks, including those associated with AI technologies. Ultimately, a well-designed WISP not only strengthens security and operational resilience but also builds trust with clients, regulators, and stakeholders, positioning the organization for long-term success. 

Conclusion

Building a resilient and trustworthy organization requires more than just isolated policies or certifications — it demands a cohesive strategy that integrates planning, internal controls, and external validation. Starting with a WISP establishes clear security expectations, while choosing the right internal control framework ensures those expectations are actionable and measurable. Whether you pursue SOC 2 reporting or ISO/IEC 27001 certification, these external validations provide tangible proof of your organization’s commitment to security and governance. Adding the NIST AI Risk Management Framework into the mix allows organizations to extend these practices to emerging AI risks, leveraging existing controls while addressing new challenges. By combining these tools, your organization can demonstrate compliance, reduce risk, and build stakeholder confidence — creating a modern, sustainable security and governance program. Take the next step by reviewing your current policies and frameworks to identify where enhancements, certifications, or AI-specific controls can strengthen your security posture today.

For additional guidance, contact the Larson SOC Team Click to schedule a free 2 hour consultation to discuss your company's needs.

Frequently Asked Question About Choosing the right security framework

What is a WISP and why does my organization need one?
A WISP (Written Information Security Plan) is a documented set of administrative, technical, and physical controls that helps organizations identify threats, mitigate cybersecurity risks, and meet regulatory obligations, especially when handling sensitive personal or financial data.

How do SOC 2 reports and ISO/IEC 27001 certification differ?
SOC 2 is an attestation report by a CPA firm that validates security and other trust criteria over controls, whereas ISO/IEC 27001 is a formal certification for an organization’s ISMS covering a broader set of internationally recognized security practices.

Can one framework help with compliance across multiple standards?
Yes. Many frameworks have overlapping control objectives, so documents like WISPs and controls implemented for SOC 2 or ISO 27001 can be aligned or mapped to reduce duplicated effort and streamline compliance.

Why should organizations care about the NIST AI Risk Management Framework?
The NIST AI RMF helps organizations systematically manage risks related to AI systems; because it overlaps with established security and governance practices in frameworks like SOC 2, it can be integrated into existing compliance programs to address emerging AI risks.

How should I choose the best internal control framework?
Selecting a framework depends on your industry, customer demands, regulatory environment, risk profile, and resource capacity — frameworks like SOC 2, ISO/IEC 27001, and NIST all provide valuable structures but differ in scope, market recognition, and implementation effort.