Compliance Framework
also called SOC 2, ISO 27001, PCI DSS
A published set of control requirements an organisation is assessed against, which turns security posture into evidence somebody else will check.
The frameworks an architect meets most often, and what each is actually about: SOC 2 — an attestation over controls relevant to security, availability, confidentiality, processing integrity and privacy, and the usual price of entry for selling to US enterprises. ISO 27001 — certification of an information security management system, more process-oriented. PCI DSS — prescriptive requirements for anything touching cardholder data. HIPAA, DORA, sector regimes.
What matters architecturally is not the checklist but the two structural consequences. Scope determines cost: every system that touches regulated data falls in scope and inherits the full control set, which is why isolating cardholder data behind a tokenisation boundary — so most of the estate never sees a card number — is an architecture decision that removes work from dozens of systems.
And controls must produce evidence continuously. An auditor asks for proof that access was reviewed, that changes were approved, that logs were retained, across the whole period. A control that exists but leaves no trace fails the audit. Designing for evidence — immutable audit logs, pipeline-enforced approvals, automated access reviews — is far cheaper than reconstructing it annually.