Security Compliance in Simple English
Part 1: ISO 27001, SOC 2, GDPR and CASA
ISO 27001, SOC 2, GDPR and CASA come up in almost every serious customer or platform conversation. They are often mixed up. This guide explains each one in simple English, with tables and diagrams. Part 2 then shows how to use the STRIDE threat model to prepare for SOC 2 and CASA.
This is a simple overview, not legal or audit advice. Check the official texts and talk to your auditor before you decide.
Table of Contents
The Big Picture
The four are different kinds of things. One is a standard, one is an audit report, one is a law, and one is an app check. Do not compare them as if they were the same.
| Name | What it is | Who asks for it | What you get |
|---|---|---|---|
| ISO 27001 | An international standard for running information security as a managed system | Customers, partners and regulators worldwide | A certificate from an accredited auditor |
| SOC 2 | An audit of your controls against the AICPA Trust Services Criteria | Business customers, mostly in the US and in SaaS | An auditor's report (shared under NDA) |
| GDPR | An EU law that protects the personal data of people in the EU/EEA | Nobody has to ask. It is the law, if it applies to you | No certificate. You comply, or regulators can fine you |
| CASA | A security assessment of one app that wants sensitive Google user data | A Letter of Assessment (LOA) from an approved lab |
One by One
Each card has the main idea, a diagram, and example titles you will meet in real audits.
ISO 27001 · SOC 2 · GDPR · CASA
ISO 27001
“Run security as a managed system.”You run security as a process that repeats, not as a one-time project. You find your risks, choose controls for them, run those controls, and let an outside auditor check. Then you do it again and improve.
Key words
| Word | Meaning |
|---|---|
| ISMS | Information Security Management System: your policies, processes and records together. |
| Annex A | The catalogue of 93 controls you pick from. It is a menu, not a checklist. |
| Statement of Applicability (SoA) | Your list of which controls apply, and why you left others out. |
| Surveillance audit | A smaller yearly check between full audits. |
The 93 controls in four themes
| Theme | Controls | Plain meaning |
|---|---|---|
| Organizational | 37 | Policies, roles, suppliers, incidents, legal rules |
| People | 8 | Hiring checks, training, remote work, leaving the company |
| Physical | 14 | Offices, server rooms, devices, cables |
| Technological | 34 | Access, encryption, backups, logging, secure coding |
Example controls
| Example control | Simple meaning |
|---|---|
| Access control | Only the right people reach the right data. A new hire gets only what the job needs. |
| Cryptography | Encrypt data on disks and on the network. |
| Backup | Keep copies of data, and test that you can restore them. |
| Supplier security | Check that the vendors you rely on are secure too. |
| Incident management | Have a plan for a breach: who does what, and in which order. |
| Security awareness training | Teach staff to spot phishing and handle data safely. |
| Physical security | Lock server rooms. Use visitor badges. |
| Secure development | Review code, test for vulnerabilities, keep dev and production apart. |
Good to know
- The certificate covers your scope (for example one product and the team that runs it), not the whole company by default.
- A certificate is valid for 3 years, with yearly surveillance audits.
- You choose controls by risk. If you skip a control, you explain why.
- The official text is sold by ISO. Free guides describe the controls, but only the standard itself is the authority.
SOC 2
“Prove your controls to customers.”A customer asks: "How do I know my data is safe with you?" A SOC 2 report is an independent auditor's answer. It is an attestation (a signed statement from the auditor), not a certificate.
You choose which criteria apply
SOC 2 uses five Trust Services Criteria. Security is always included. You add the others if they match your promises to customers.
| Criterion | Plain meaning | Required? |
|---|---|---|
| Security | Protected against unauthorized access | Always |
| Availability | The service stays up as promised | Optional |
| Processing integrity | Data is processed correctly and completely | Optional |
| Confidentiality | Secret business data stays secret | Optional |
| Privacy | Personal data is handled properly | Optional |
Type I or Type II
- Type I: "Your controls are designed well today." Quicker. A good first step.
- Type II: "Your controls really worked over a period." The period is often 3 to 12 months, but there is no fixed minimum in the rules. Customers trust this one more.
The Security criteria: CC1 to CC9
The "common criteria" are nine groups. Every SOC 2 report covers them.
| Group | Name | Plain meaning |
|---|---|---|
| CC1 | Control environment | Leadership, ethics, clear roles |
| CC2 | Communication and information | People know the rules and their duties |
| CC3 | Risk assessment | You find and rate your risks |
| CC4 | Monitoring activities | You check that controls still work |
| CC5 | Control activities | Policies and procedures exist and are used |
| CC6 | Logical and physical access | Who can reach systems, data and buildings |
| CC7 | System operations | Monitoring, vulnerabilities, incident response |
| CC8 | Change management | Changes are reviewed, tested and approved |
| CC9 | Risk mitigation | Business continuity and vendor risk |
Example things an auditor looks at
| What the auditor looks at | Simple meaning |
|---|---|
| Change management | Every code change is reviewed and approved before release. |
| User access reviews | Every quarter, someone checks who has access to what, and removes what is not needed. |
| Onboarding and offboarding | Background checks for new hires, and access removed on the last day. |
| Monitoring and logging | You record what happens, and you get alerts on strange activity. |
| Disaster recovery | A tested plan to restore service after an outage. |
| Vendor management | You review the security of your suppliers. |
Good to know
- The auditor is a licensed CPA firm. The report is private, so you share it with customers under NDA.
- There is no "pass" or "fail" stamp. The auditor gives an opinion. A clean opinion is what you want.
- The 2022 update added guidance (points of focus). It did not change the criteria.
GDPR
“Respect the personal data of people.”GDPR is a law, not a voluntary standard. It protects the personal data of people in the EU and EEA. If your company is in the EU, it covers your processing. If you are outside Europe, it still applies when you offer goods or services to people in the EU, or monitor their behaviour there (Article 3). Fines for the most serious breaches (such as breaking the principles or ignoring people's rights) can reach 20 million euros or 4% of worldwide yearly turnover, whichever is higher. Other breaches have lower limits.
The seven principles
| Principle | Plain meaning |
|---|---|
| Lawfulness, fairness, transparency | Have a valid reason to use the data. Be honest about it. |
| Purpose limitation | Use data only for the reason you stated. |
| Data minimization | Collect only what you need. |
| Accuracy | Keep data correct. |
| Storage limitation | Delete data when you no longer need it. |
| Integrity and confidentiality | Keep it secure. |
| Accountability | Be able to prove that you comply. |
Privacy by Design (Article 25)
Build privacy into the product from day one, not as a patch later. The law calls this "data protection by design and by default".
| Privacy by Design example | Simple meaning |
|---|---|
| Minimal forms | Do not ask for a birth date or phone number if you do not need it. |
| Privacy by default | Tracking and marketing emails are off until the user turns them on. |
| Pseudonymization | Use IDs instead of names in analytics, so data is harder to link to a person. |
| Retention rules | Delete inactive accounts automatically after a set time. |
People's rights
| Right | What the person says |
|---|---|
| Access | "Show me all the data you have about me." |
| Erasure | "Delete my data." (the right to be forgotten) |
| Rectification | "Fix my wrong data." |
| Portability | "Give me my data in a format I can move." |
| Objection | "Stop using my data for marketing." |
Other duties
| Duty | Plain meaning |
|---|---|
| Breach notification | Tell the authority without undue delay, and within 72 hours of becoming aware of a breach, unless it is unlikely to put people at risk. If you are late, explain why. If you are a processor, tell the controller. |
| DPIA (Data Protection Impact Assessment) | Check the privacy risks before launching something risky for people. |
| DPO (Data Protection Officer) | Some organizations must appoint one. |
| DPA (Data Processing Agreement) | A contract with vendors that handle data for you. |
What a breach looks like
Good to know
- There is no official certificate that proves you comply. GDPR does allow approved certification schemes (Article 42), but they do not replace compliance. In practice you show compliance with records: what data, why, where, how long.
- Each use of personal data needs a lawful basis, such as consent, a contract, or a legal duty.
- Sending data to a vendor or to a non-EU country has extra rules.
CASA
“Pass a security test to use Google data.”CASA is a security check for apps that want sensitive Google user data. It is run by the App Defense Alliance (ADA), an industry group under the Linux Foundation. It is not a company-wide certificate like ISO 27001 or SOC 2. It tests one specific app.
When you need it
| Scope level | Example scopes | What Google asks |
|---|---|---|
| Non-sensitive | Basic sign-in info, drive.file | Basic checks |
| Sensitive | gmail.send, calendar, contacts | OAuth app verification |
| Restricted | gmail.readonly, gmail.modify, gmail.compose, drive | Verification plus a security assessment (CASA) |
Google's rule: if you store or transmit restricted scope data on servers, you must complete a security assessment. Which scopes are restricted can change, so check Google's current scope lists. Choosing narrower scopes (for example drive.file instead of drive) can mean no CASA at all.
Google lists a few exceptions, such as personal use, apps still in testing, and internal apps for your own organization.
How it works
- The lab tests your app against the CASA specification. It is a short list of testable requirements, built on the OWASP ASVS.
- When the assessment is approved, you get a Letter of Assessment (LOA) and Google verifies your app.
- You must be reassessed at least every 12 months after the LOA approval date.
Assurance levels
The ADA uses two assurance levels. The platform (here, Google), not you, decides which one applies to your app. Both are done with an ADA-approved lab.
| Level | Plain meaning |
|---|---|
| AL1 | You give evidence for each test case, and an approved lab reviews it. The lab does not test your app directly |
| AL2 | The approved lab tests your app directly against every requirement |
What the lab checks
The spec has six areas:
| Area | Example requirement in simple words |
|---|---|
| Authentication | Logins resist brute force. No default passwords on public pages. |
| Session management | Session cookies are Secure and HttpOnly. Logout really ends the session. No tokens in URLs. |
| Access control | Least privilege on the server. Users cannot read other users' data by changing an ID (IDOR). Safe OAuth: PKCE, checked redirect and state. Admin pages use MFA. |
| Communications | TLS everywhere, trusted certificates, no weak crypto. |
| Data validation | Protection against injection, XSS and SSRF. Uploads are limited to expected types and cannot run. |
| Configuration | Libraries without known holes. Debug mode off in production. No credentials in logs. Server-side secrets stored safely. |
Is CASA only for Google?
In practice, Google is the main place you will meet CASA, through its OAuth verification. But CASA is not a Google product. The ADA is an industry group under the Linux Foundation. Other platforms run their own separate app-review programs.
These rules change from time to time. Read the current Google and ADA pages before you plan. This is a simple overview.
CASA and SOC 2 or ISO 27001
Google does not accept SOC 2 or ISO 27001 instead of CASA. But many controls overlap, so having them helps. The ADA also has a CASA Accelerator: you share your existing certifications with your chosen assessor, who can use them to tailor your requirements. The public page does not list which certifications count, so ask your assessor whether your SOC 2 or ISO 27001 qualifies.
↑ Back to contentsHow They Fit Together
| ISO 27001 | SOC 2 | GDPR | CASA | |
|---|---|---|---|---|
| Type | Standard | Audit report | Law | App assessment |
| Optional? | Yes | Yes, but customers often demand it | No. Mandatory if it applies | Required for Google restricted scopes |
| Focus | Security management | Proof of controls | Personal data and rights | Security of one app |
| Scope | Your ISMS | Your service and system | All personal data you process | One app |
| Proof | Certificate | Auditor's report | Records. Regulators can fine you | Letter of Assessment (LOA) |
| Repeats | Yearly checks, re-audit at 3 years | Usually yearly (Type II period) | Always on | At least every 12 months |
The security controls overlap a lot. Doing one well makes the others easier. This table shows where one control lands in each framework.
| One control | ISO 27001 | SOC 2 | GDPR | CASA |
|---|---|---|---|---|
| Strong login and MFA | Access control | CC6 | Art. 32 security | Authentication, admin MFA |
| Encryption | Cryptography | CC6 | Art. 32 / Art. 25 | Communications, secrets |
| Logging and alerts | Logging, monitoring | CC7 | Prove accountability | No credentials in logs |
| Code review and testing | Secure development | CC8 | Art. 25 and 32 | Data validation |
| Incident plan | Incident management | CC7 | 72-hour notice | Not the focus |
| Vendor checks | Supplier security | CC9.2 | DPA with processors | Not the focus |
Which One Do You Need?
Start from your situation, not from the names.
If all answers are "no", you may need none of these four yet, though other laws may apply. Many small teams still follow the basic controls early, because the habits are cheaper to build before the first audit.
Common Mistakes
- Treating it as a one-time project. All four are repeated. Auditors look for habits, not a clean week.
- Buying tools first. Tools help, but you still need owners, policies and records.
- Mixing up SOC 2 and ISO 27001. SOC 2 proves controls to customers in a report. ISO certifies your management system.
- Thinking a certificate means GDPR compliance. It helps with security (Article 32), but GDPR also needs a lawful basis, rights handling, and records.
- Asking for too many Google scopes. Narrower scopes can mean no CASA at all. Check which of your scopes are restricted.
- Writing policies nobody follows. The auditor will ask people how they work, not only what the document says.
What Comes Next
All four frameworks ask a similar question: do you know how your system can be attacked, and what you did about it? A simple way to answer it is threat modeling.
In Part 2, I explain the STRIDE framework and show how to use it as evidence for SOC 2 and CASA.