Insights
Written by people who run these programs.
At a glance
- Author
- Eric Parsley
- Latest
- HIPAA plus HITRUST plus ISO 42001 · July 8, 2026
- Topics
- SOC 2, ISO 27001, ISO 42001, CMMC, HIPAA, HITRUST
- Format
- ~2 min reads
SOC 2 vs ISO 27001: what your buyer actually cares about.
Two frameworks, two audiences, and a sequencing decision most founders make backwards.
ISO 42001 is where SOC 2 was in 2019.
The AI management system certificate is still rare enough to be a differentiator. That window closes.
The CMMC deadline is real. The path is not linear.
Five phases, one boundary decision, and the reason "just do CMMC" is the wrong instruction for most suppliers.
How to buy compliance consulting.
What to ask, what pricing structure signals, and the four things that should end a conversation.
HIPAA plus HITRUST plus ISO 42001: the healthcare AI matrix.
Three frameworks, heavy overlap, and a sequencing decision worth several months.
Start with a conversation.
Thirty minutes on the calendar, an honest read on where you stand, and a plain answer on what your next framework actually takes.