Which security framework applies to your business

Frameworks are a map, not the territory. The useful question is not “which framework is best” but “which one does my market recognise, and which controls reduce real risk first”. For most Canadian and US businesses the answer has three parts.

The ones that are law

PIPEDA governs how private-sector organizations in Canada collect, use and disclose personal information. It is still the law: the bill that would have replaced it died in January 2025, and its successor, Bill C-36, was tabled in June 2026 and has not passed. PIPEDA remains in force until it does. Quebec Law 25 is fully in force and adds a designated privacy officer, breach reporting, privacy impact assessments and significant penalties for anyone handling Quebec residents’ data. PHIPA covers personal health information in Ontario, and HIPAA does the same in the US; a Security Rule overhaul was proposed in 2025 and its final rule has been pushed to 2027. In the US there is no general cybersecurity statute, but the FTC enforces “unfair or deceptive practices” against companies with inadequate security, and has done so hundreds of times.

PCI DSS is contractual rather than statutory, but it applies to every business taking cards; see PCI DSS for a small business.

The ones customers and insurers ask for

SOC 2 Type II is what SaaS companies and service providers are asked for by enterprise customers: an auditor’s report on controls over a sustained period. ISO/IEC 27001:2022 is the certifiable international standard, with 93 controls, and the one recognised outside North America; certificates against the 2013 edition expired in October 2025. Cyber insurers increasingly ask for specific controls (MFA, backups, endpoint detection) rather than a framework, and price accordingly.

The ones to build from

NIST CSF 2.0 organizes a program around six functions: Govern, Identify, Protect, Detect, Respond, Recover. It is voluntary, widely adopted, and a good structure for a board conversation. CIS Controls v8.1 is the practical starting point: 18 prioritized defensive actions, with Implementation Group 1 as essential hygiene for any organization. If you have nothing formal today, start with CIS IG1; it maps cleanly onto NIST CSF and covers most of what SOC 2 and ISO 27001 will later ask for.

How to choose

Pick the framework your market recognises, implement the controls that reduce real risk first, and keep evidence continuous rather than scrambling every audit season. Tools like Vanta and Drata make the evidence part routine. The frameworks we work with, and our position on each layer, are on Security. Direct links to the current version of every framework above, by region, are in the framework directory.