This is a huge meta-analysis of what cyber practitioners and experts actually said about each framework, positive and negative.<\/p>\n\n\n\n
Where the sentiment currently sits<\/h2>\n\n\n\n
After analysing 541 separate posts and writings on cyber security frameworks, we found that two frameworks had a net positive sentiment rating (more positive comments than negative) and low barriers to entry:<\/p>\n\n\n\n
- \n
- SMB1001 with a positive 51.9 net sentiment rating<\/li>\n\n\n\n
- NIST Cyber Security Framework (CSF) with a positive 17.5 rating<\/li>\n<\/ul>\n\n\n\n
The frameworks with the worst sentiment also attracted comments about their cybersecurity deficiencies:<\/p>\n\n\n\n
- \n
- SOC 2 with a negative 14.4 rating<\/li>\n\n\n\n
- Cyber Essentials (UK) with a negative 5.8 rating<\/li>\n<\/ul>\n\n\n\n
This graph shows the current market sentiment:<\/p>\n\n\n\n
![\"Bar](\"https:\/\/www.sandbox.backupassist.com\/app\/uploads\/sites\/3\/2026\/07\/Screenshot-2026-07-29-at-3.35.58-PM-1024x391.png\")
<\/figure>\n\n\n\nWhere this comes from<\/h2>\n\n\n\n
![\"Research](\"https:\/\/www.sandbox.backupassist.com\/app\/uploads\/sites\/3\/2026\/07\/Screenshot-2026-07-29-at-3.36.22-PM-1024x161.png\")
<\/figure>\n\n\n\n<\/p>\n\n\n\n
We gathered public commentary from a wide range of sources:<\/p>\n\n\n\n
- \n
- Reddit communities where IT and security people actually talk shop \u2014 r\/sysadmin, r\/msp, r\/cybersecurity, r\/ISO27001, r\/soc2, r\/Essential8, r\/Intune, and others \u2014 plus Hacker News threads,<\/li>\n\n\n\n
- trade press (Infosecurity Magazine, SecurityBrief Australia, Cyber Daily),<\/li>\n\n\n\n
- independent security blogs, vendor and consultancy content, and<\/li>\n\n\n\n
- the official pages of the standards bodies themselves: NCSC, ASD, NIST, the AICPA, and Dynamic Standards International.<\/li>\n<\/ul>\n\n\n\n
We used AI-assisted research to gather this at a scale and speed that we could not do by hand, then read and cross-checked the results ourselves. We also:<\/p>\n\n\n\n
- \n
- analysed who made each comment – was it anonymous, independent, or have a related commercial stake (such as having something to sell)<\/li>\n\n\n\n
- fact checked every claim that is reproduced in this article.<\/li>\n<\/ul>\n\n\n\n
All up, this draws on several hundred individual pieces of public commentary across the six frameworks.<\/p>\n\n\n\n
Headline findings<\/h2>\n\n\n\n
From our analysis of the comments, a few things stood out:<\/p>\n\n\n\n
- \n
- The frameworks fall into 2 categories: low-friction, and high-friction.<\/strong> NIST CSF and SMB1001 are free or near-free, self-assessed, and designed to get a business with nothing in place doing something. ISO 27001, SOC 2, Cyber Essentials, and Essential Eight (for regulated work) involve real cost, real paperwork, and, for the first two especially, exist mainly to satisfy someone else’s procurement checklist, not to make you more secure in isolation.<\/li>\n\n\n\n
- Total implementation costs were never mentioned.<\/strong> We found comments about external costs like licensing and auditing. But understanding the true and total cost of implementing a framework into a business is difficult, as the time of internal staff and employees was never recorded. Compounding that, the amount of work required varies widely, depending on the starting position, business size, scope and cost of consultants.<\/li>\n\n\n\n
- Promises of cyber insurance premium discounts are vague and difficult to substantiate.<\/strong> Only one framework, Cyber Essentials, has anything close to it: the UK government’s own scheme claims 92% fewer insurance claims among certified businesses. We could not find any other stories where following a framework resulted in lower insurance costs.<\/li>\n\n\n\n
- Independently measured effectiveness data is essentially absent across all six.<\/strong> Nobody has published “businesses using Framework X get breached Y% less often.”<\/li>\n<\/ul>\n\n\n\n
Framework scorecard<\/h2>\n\n\n\n
Practitioners split roughly evenly between complaint and praise overall, with two clear outliers: SMB1001 reads the most positive of the six, and SOC 2 the most negative.<\/p>\n\n\n\n
![\"Table](\"https:\/\/www.sandbox.backupassist.com\/app\/uploads\/sites\/3\/2026\/07\/Screenshot-2026-07-29-at-3.25.27-PM-1024x486.png\")
<\/figure>\n\n\n\n<\/p>\n\n\n\n
Net sentiment is the share of sources favourable toward a framework minus the share against it, across every piece of commentary we found, positive and negative alike. Mixed and neutral-descriptive comments aren’t counted either way, the same way “no opinion” sits outside a poll’s net approval number.<\/em><\/p>\n\n\n\n
At a glance<\/h2>\n\n\n\n
Framework<\/th> What it actually is<\/th> External costs<\/th> Who it’s really for<\/th> Standout comments<\/th><\/tr><\/thead> NIST CSF<\/strong><\/td> A free, voluntary planning framework: no certificate, no audit<\/td> $0 (your time only)<\/td> Anyone who wants a structure for deciding what to fix first<\/td> + “It’s a good, solid foundation.”<\/em>
+ “A good North Star.”<\/em>
\u2212 “Little more than signposting” to more detailed standards.<\/em><\/td><\/tr>SMB1001<\/strong><\/td> A tiered, self-assessed standard built specifically for small business<\/td> ~US$95\u2013995\/yr licence fees, plus ~US$4000 audit fees<\/td> A business with little or nothing in place that wants a fast on-ramp<\/td> + “A godsend for us in sales\u2026 it ‘speaks hr’ rather than ‘speaking IT’.”<\/em>
+ “A conversation tool”<\/em> that gets a director to actually act.
\u2212 Not “a legislated or government mandated standard, whatever a marketing page implies.”<\/em><\/td><\/tr>Cyber Essentials<\/strong> (UK)<\/td> A five-control, government-backed baseline, self-assessed or externally audited<\/td> \u00a3320\u2013\u00a3600 (basic); ~\u00a31,400+ (audited)<\/td> UK businesses bidding for government\/NHS work, or wanting a recognised baseline<\/td> + “It just focuses the mind of various layers of management, and that’s a good thing.”<\/em>
\u2212 More than one practitioner used the word “lie” describing how gameable the basic tier is.
\u2212 “Cyber Essentials doesn’t cover data backups, disaster recovery planning, or full incident response procedures.”<\/em> \u2014 Dr Logic, IT support provider<\/td><\/tr>Essential Eight<\/strong> (Australia)<\/td> An eight-control, tiered maturity model from the Australian government<\/td> A$10,000\u2013$120,000+\/yr depending on maturity target<\/td> Australian government suppliers and regulated or grant-funded organisations<\/td> + “A great place to start\u2026 even the government is telling you to do security things!!!”<\/em>
\u2212 “Most web apps don’t do MFA so we can’t even hit maturity level 2.”<\/em>
\u2212 WA and NSW government audits found real-world implementation weaker than the reputation suggests, even where it’s mandatory.<\/td><\/tr>ISO 27001<\/strong><\/td> An internationally recognised management-system certification<\/td> US$5,000\u2013$80,000+<\/td> Businesses chasing enterprise or international contracts that name it explicitly<\/td> + “It forces companies to take a risk-based approach to decisions.”<\/em>
\u2212 “I would\u2026 disregard their ISO 27001 certification”<\/em> \u2014 from an auditor’s own company blog.
\u2212 “Added nothing that was actually significant for security. Only documentation.”<\/em><\/td><\/tr>SOC 2<\/strong><\/td> A US audit report on your internal controls, not a certification<\/td> US$5,000\u2013$100,000+ first year<\/td> Businesses selling to US enterprise customers who ask for it by name<\/td> + “We wouldn’t be growing like we are”<\/em> without it.
\u2212 “Tells you that someone, somewhere, checked a box.”<\/em>
\u2212 “Completely worthless”<\/em> \u2014 one commenter’s claim that a compliant company could reportedly pass while using “welcome1234” as its password, with no MFA at all.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\nWe’ll come back to a proper verdict later. For now, here’s what practitioners actually said about each one.<\/p>\n\n\n\n
\n\n\n\nNIST Cybersecurity Framework (CSF) \u2014 74 voices<\/h2>\n\n\n\n
NIST CSF is the lowest-friction option on this list because there’s almost nothing to trip over: it’s free, voluntary, and there’s no audit or certificate at the end of it.<\/p>\n\n\n\n
What do people say is genuinely good about it? Who benefited, and how?<\/h3>\n\n\n\n
It gives people who aren’t security specialists a shared language for talking about risk.<\/strong> One consultant summed it up simply: “It’s a good, solid foundation.”<\/em> Others credit it specifically as a bridge between technical teams and leadership: a way to turn “we’re worried about ransomware” into a structured conversation about where to spend the next dollar. Several practitioners specifically praised the newest version’s addition of a “Govern” function, which formalises something that used to be scattered and implicit: who’s actually accountable for security decisions.<\/p>\n\n\n\n
What do people say is wrong with it, or not worth it?<\/h3>\n\n\n\n
It’s too high-level to tell you what to actually do.<\/strong> The most detailed complaint we found came from a practitioner who’d used it for years: “Between poorly placed subcategories\u2026 repetitive subcategories, overly specific subcategories\u2026 overly generic subcategories\u2026 there is a lot to be desired.”<\/em> Others put it more bluntly: it’s “little more than signposting”<\/em> to more detailed standards, and one virtual CISO (vCISO) said flatly it’s “too high-level to really give people\u2026 a good feeling”<\/em> when he’s trying to reassure a board.<\/p>\n\n\n\n
What surprised people \u2014 things they didn’t expect until they went through it?<\/h3>\n\n\n\n
Small businesses are often scared off the moment they open the document: it reads as intimidating despite being voluntary. One state government’s mid-stream change to its own schools’ compliance model, well after schools had started implementing the old version, drew a resigned: “I give up!\u2026 now they change it. It’s gonna be a rough year.”<\/em><\/p>\n\n\n\n
Where do practitioners disagree with each other about it?<\/h3>\n\n\n\n
Whether its vagueness is a bug or a feature. One side says the lack of specific steps is the whole problem. The other treats it as intentional design, a roadmap, not a toolbox, and argues people misuse it when they try to apply it as a checklist. When one practitioner argued the framework was unbalanced, another shot back: “CSF was built with the input of three thousand people & organizations. No I don’t see it being unbalanced.”<\/em><\/p>\n\n\n\n
What does it cost, in money and time?<\/h3>\n\n\n\n
Nothing to license, nothing to certify.<\/strong> As one MSP put it, comparing CSF to NIST’s much more detailed control catalogue, SP 800-53: “it seems that for smaller MSPs\/clients the NIST CSF with SP 800-53 controls is a free way of doing it.”<\/em> The real cost is time: several practitioners described running it on “no budget, just our time,” with one large organisation reporting roughly three years of internal work before moving to a more detailed standard.<\/p>\n\n\n\n
Who is required to have it, and by whom?<\/h3>\n\n\n\n
Nobody, formally.<\/strong> It isn’t certifiable. One practitioner’s summary of this was independently confirmed by a second, unrelated source: “NIST is a widely adopted public framework and not a standard which you can certify against.”<\/em> Some customer contracts name it as a requirement; a handful of US state education bodies have used it as an informal audit yardstick.<\/p>\n\n\n\n
What language do people reach for when they talk about it?<\/h3>\n\n\n\n
A “North Star.” A “roadmap,” with more detailed standards as “the toolbox.” The advice to “align with” it rather than “comply with” it, since there’s no such thing as CSF compliance. And a warning, repeated more than once: it’s a wide-angle tool, not a zoomed-in one. One practitioner put it sharply: “It’s about processes at the macro level, primarily so that an organization can assess where they are today and go from there to decide where to allocate more resources. Trying to use it at a tactical level is like trying to use a fisheye lens as a magnifying glass, of course it fails.”<\/em><\/p>\n\n\n\n
\n\n\n\nSMB1001 \u2014 27 voices<\/h2>\n\n\n\n
SMB1001 is the other low-friction entry point on this list, and the newest of the six, built specifically to answer a complaint that comes up constantly in the research for every other framework here: that proper certification costs tens of thousands of dollars and takes months, which is simply not a realistic ask for a five-person business.<\/p>\n\n\n\n
What do people say is genuinely good about it? Who benefited, and how?<\/h3>\n\n\n\n
It’s cheap, fast, and speaks the language of the business owner, not the IT department.<\/strong> One MSP who resells it put it this way: “It’s been a godsend for us in sales, we been using it as a sales tactic because it ‘speaks hr’ rather than ‘speaking IT’.”<\/em> Even the most sceptical voices we found conceded a real use case. One UK security consultant, who runs his own MSP and doesn’t sell SMB1001 certifications, described it as “a conversation tool”<\/em>: a mechanism that gets a director to actually sit down and think about basics like backups and multi-factor authentication (MFA), which for a business with nothing in place is a genuine improvement over the status quo.<\/p>\n\n\n\n
What do people say is wrong with it, or not worth it?<\/h3>\n\n\n\n
The main criticism of SMB1001 is the lack of formal recognition.<\/p>\n\n\n\n
It’s self-assessed, and it isn’t a government mandate.<\/strong> An Australian security assessor who does sell the certification was the most precise voice we found on this point: “It is not named in the Cyber Security Act 2024 or in the Security of Critical Infrastructure rules, so it is not a legislated or government mandated standard, whatever a marketing page implies.”<\/em> We also couldn’t find a single named insurer publishing a documented premium discount tied to it, despite that claim circulating.<\/p>\n\n\n\n
This criticism is about formal recognition: whether an insurer, a government tender, or an enterprise buyer will treat the badge as meaningful. It isn’t a complaint that the underlying five basic controls are the wrong things to fix. Nobody we found argued that MFA, backups, and patching are bad advice for a small business. The irony is that this framework was built to sidestep exactly the overhead (government mandate, expensive independent audit) that this criticism says it lacks.<\/p>\n\n\n\n
In our opinion, this issue will resolve itself over the next few years. SMB1001 is the newest of all the frameworks listed here, so we expect that recognition will improve as the framework gains traction.<\/p>\n\n\n\n
What surprised people \u2014 things they didn’t expect until they went through it?<\/h3>\n\n\n\n
Thin. This is the one question where we found little first-hand material either way. The clearest note of caution: one vendor warned that businesses sometimes wrongly assume that meeting the standard means their email security work is finished, when in practice more specific configuration is still needed.<\/p>\n\n\n\n
Where do practitioners disagree with each other about it?<\/h3>\n\n\n\n
Whether the top tier is a genuine destination or just a step. One reseller told MSPs: “Gold level is where all msp’s should have their clients.”<\/em> An assessor who works across multiple frameworks pushed back directly: treat it as “the starting rung, not the destination.”<\/em> There’s also a live, contested claim about insurance: some resellers describe an insurer that “preauthorises” cover at the Gold tier; independent voices who went looking for that policy couldn’t find one publicly documented.<\/p>\n\n\n\n
What does it cost, in money and time?<\/h3>\n\n\n\n
The cheapest framework that offers certification (by a wide margin).<\/strong> DSI, the standard’s publisher, charges a licence fee to use the standard document itself, roughly US$95 to $995 a year depending on business size. Certification, actually being assessed against it, is a separate fee charged by tier, and varies by country: in Australia, published rates run from A$95 a year at the entry (Bronze) tier \u2014 self-assessed, no independent audit \u2014 up to A$5,995 for the top (Diamond) tier, where an independent party actually checks the work. In the UK, certification has been quoted from around \u00a375 a year at the entry tier up to \u00a3780 for the top tier. One MSP described the mid-tier licence as costing his clients “under $300,” and self-assessment at the entry tiers is reported to take a few days, not months.<\/p>\n\n\n\n
Who is required to have it, and by whom?<\/h3>\n\n\n\n
Nobody. It’s voluntary<\/strong>, same as NIST CSF. It isn’t named in Australia’s Cyber Security Act or critical infrastructure rules, and adoption is entirely market-driven: MSPs recommending it to clients, and businesses wanting something to show partners and customers.<\/p>\n\n\n\n
What language do people reach for when they talk about it?<\/h3>\n\n\n\n
“Godsend,” from the sales side. “Conversation tool,” from the sceptical-but-fair independent side. “The starting rung, not the destination.” And a UK series describing the tier system as a set of “Cyber Belts”<\/em>: a martial-arts-style progression from beginner to advanced.<\/p>\n\n\n\n
\n\n\n\nCyber Essentials (UK) \u2014 103 voices<\/h2>\n\n\n\n
Cyber Essentials produced the richest, most evenly contested body of opinion of any framework in this research: genuine, roughly even disagreement rather than a one-sided pile-on in either direction.<\/p>\n\n\n\n
What do people say is genuinely good about it? Who benefited, and how?<\/h3>\n\n\n\n
It’s a real, if narrow, baseline, and it gets management to pay attention.<\/strong> The UK government’s own figures claim 92% fewer successful insurance claims among certified businesses, plus free cyber liability insurance for businesses under \u00a320m turnover. That’s the scheme’s own marketing statistic, not an independent insurer’s, but it’s still more than any other framework here can point to. On the practitioner side, one anonymous forum poster gave what might be the single best disinterested case for any framework in this entire piece: “It just focuses the mind of various layers of management, and that’s a good thing.”<\/em> Another reported the process catching a printer vendor quietly changing security settings without telling anyone: a genuine, unprompted example of the process finding something real.<\/p>\n\n\n\n
What do people say is wrong with it, or not worth it?<\/h3>\n\n\n\n
At the basic tier, it’s a self-assessed questionnaire, and more than one practitioner used the word “lie” about how gameable that is.<\/strong> One recounted a business disabling its firewall rules specifically to pass an audit, then quietly re-enabling them afterwards. At the higher, externally audited tier (Cyber Essentials Plus), the complaint flips entirely: the requirement to patch every critical vulnerability within 14 days is called unworkable at scale by multiple, independent voices. One called it “essentially a denial-of-service attack on technical teams.”<\/em><\/p>\n\n\n\n
There’s also a real gap here: a fact about the standard, not an opinion. Here’s the National Cyber Security Centre’s own page, quoted directly, not summarised: “5 technical controls are in place. Firewalls\u2026 Secure configuration\u2026 Security update management\u2026 User access control\u2026 Malware protection.”<\/em> That’s the whole list. We read the page itself, word for word, looking specifically for backup. It doesn’t appear on it once. A business can pass Cyber Essentials with no tested, working backup in place at all.<\/p>\n\n\n\n
What surprised people \u2014 things they didn’t expect until they went through it?<\/h3>\n\n\n\n
At the higher, audited tier, the goalposts move during the process itself: daily vulnerability re-scans can surface new failures every day of the assessment window, and the scope reaches further than most businesses expect: personal phones used for work email, for instance, can pull an employee’s entire device into scope.<\/p>\n\n\n\n
Where do practitioners disagree with each other about it?<\/h3>\n\n\n\n
Two sharp, factual disagreements played out among people who should know: whether a bring-your-own-device policy changes the scope between the basic and audited tiers (one assessor called a colleague’s claim on this “wildly inaccurate”<\/em>), and whether new rules about separate admin accounts for cloud services apply narrowly or to every cloud tool a business uses, including its CRM.<\/p>\n\n\n\n
What does it cost, in money and time?<\/h3>\n\n\n\n
Unusually well corroborated, for once.<\/strong> Basic certification runs \u00a3320 to \u00a3600 depending on business size, consistent across four independent sources including the scheme’s own delivery partner. The externally audited tier runs roughly \u00a31,400 to \u00a31,500 plus VAT for a small business. One MSP put it directly: “If a company is offering Cyber Essentials for \u00a31200, this often means they will do the admin side and paperwork for you\u2026 Completing the actual work on your network or devices to get you compliant with the controls is not included in this.”<\/em><\/p>\n\n\n\n
Who is required to have it, and by whom?<\/h3>\n\n\n\n
Confirmed and specific.<\/strong> UK government procurement policy has required it for certain central government, agency, and NHS contracts since 2014, renewed annually. Beyond that, adoption is spreading into education funding and ordinary commercial supply-chain requests.<\/p>\n\n\n\n
What language do people reach for when they talk about it?<\/h3>\n\n\n\n
“Tick box exercise”<\/em> is the standing complaint. “14 days”<\/em> is the single most repeated technical flashpoint in the whole dataset. And NCSC’s own metaphor for what the scheme actually stops: the digital equivalent of “a thief trying your front door to see if it’s unlocked.”<\/em><\/p>\n\n\n\n
\n\n\n\nEssential Eight (Australia) \u2014 43 voices<\/h2>\n\n\n\n
Essential Eight is the Australian government’s own baseline, built around eight technical controls scored across four maturity levels.<\/p>\n\n\n\n
What do people say is genuinely good about it? Who benefited, and how?<\/h3>\n\n\n\n
It’s a prioritised, credible starting point, especially for businesses already running on Microsoft’s stack.<\/strong> One person running a small security team put it honestly: “it is a great place to start, and allows us to point at it, while banging our heads against our customers and say ‘LOOK, even the government is telling you to do security things!!!'”<\/em> MSPs running Defender and Intune describe the integration as a genuine technical win, not just a paperwork exercise.<\/p>\n\n\n\n
What do people say is wrong with it, or not worth it?<\/h3>\n\n\n\n
For smaller businesses outside a Microsoft-centric setup, it can be genuinely out of reach.<\/strong> One IT professional was blunt: “most web apps don’t do MFA so we can’t even hit maturity level 2. We’re doing NIST 800-53 as a start instead.”<\/em> Application control and daily vulnerability scanning are the two most-cited practical blockers. And government’s own auditors, in Western Australia and New South Wales, found real-world implementation weaker than the framework’s reputation suggests, even inside the one population where it’s actually mandatory and best resourced.<\/p>\n\n\n\n
What surprised people \u2014 things they didn’t expect until they went through it?<\/h3>\n\n\n\n
Worth a brief, factual note: Australia’s cyber security agency has announced it will retire the Essential Eight over the next couple of years, in favour of a broader “Essentials” series, while confirming existing work carries over. The framework itself remains current and in force, and everything above reflects how people who are using it right now actually describe it.<\/p>\n\n\n\n
Where do practitioners disagree with each other about it?<\/h3>\n\n\n\n
Whether it’s realistic for a small business at all. One calling it “ridiculous”<\/em> for anything past the first maturity level, another arguing the fix is simple: “get rid of it, and upgrade, or you’re not getting your ML1.”<\/em> There’s also a small but genuine pedantic streak among practitioners insisting it’s “a maturity model, not a framework”<\/em>: a distinction most casual usage, including some vendors, ignores.<\/p>\n\n\n\n
What does it cost, in money and time?<\/h3>\n\n\n\n
Every dollar figure we found came from a vendor or consultancy with something to sell, and no independent practitioner gave us a number. The range runs from roughly A$10,000 to $120,000+ a year depending on target maturity level, with reaching the second maturity level typically quoted at three to nine months.<\/p>\n\n\n\n
Who is required to have it, and by whom?<\/h3>\n\n\n\n
A hard requirement only for non-corporate Commonwealth government entities<\/strong>, who must reach maturity level two under the government’s own security policy framework. Elsewhere, it’s market-driven: not-for-profits report it tied to funding conditions, and private businesses describe pressure from insurance underwriting and tender requirements rather than any law.<\/p>\n\n\n\n
What language do people reach for when they talk about it?<\/h3>\n\n\n\n
“Great place to start,” almost always followed by a caveat. “Godsend,” specifically for the Microsoft-stack integration. And, at the sharper end, “a dog and pony compliance box ticking exercise”<\/em> from someone unconvinced the process changes anything real.<\/p>\n\n\n\n
\n\n\n\nISO\/IEC 27001 \u2014 96 voices<\/h2>\n\n\n\n
ISO 27001 is the oldest and most internationally recognised framework on this list, and produced the widest cost range of any of the six.<\/p>\n\n\n\n
What do people say is genuinely good about it? Who benefited, and how?<\/h3>\n\n\n\n
It opens doors, and it forces documentation that often wasn’t happening before.<\/strong> One MSP owner described using an audit finding as genuine leverage, forcing a client to stop demanding unsafe same-day account access, something years of asking nicely hadn’t achieved: “I personally love ISO 27001. It forces companies to take a risk-based approach to decisions.”<\/em><\/p>\n\n\n\n
What do people say is wrong with it, or not worth it?<\/h3>\n\n\n\n
The most pointed criticism we found came from inside the industry that sells it.<\/strong> An auditor’s own company blog put it plainly: certificates get “granted to companies that\u2026 fall significantly short”<\/em> of the standard’s intent, and added: “I would even go as far as to say that if I was working for a company that was looking to engage with a new third party, I would disregard their ISO 27001 certification.”<\/em> Others echoed the same idea from the buyer’s side, more bluntly: it “added nothing that was actually significant for security. Only documentation.”<\/em><\/p>\n\n\n\n
What surprised people \u2014 things they didn’t expect until they went through it?<\/h3>\n\n\n\n
The sheer literalness of what gets audited. One person who led a mid-size company through certification recalled the process demanding a formal naming standard for network jack plates across every office, followed by colour-coded ethernet cables for 700 desks: a level of specificity nobody expects going in. A second, more common surprise: maintaining the certification turns out to be harder than earning it the first time.<\/p>\n\n\n\n
Where do practitioners disagree with each other about it?<\/h3>\n\n\n\n
Genuinely, and at length: which comes first, ISO 27001 or SOC 2.<\/strong> One practitioner argued flatly that SOC 2 is the lighter first step and ISO comes later, once the business has outgrown it. Another said the opposite is true: “ISO27001 is usually a stepping stone to SOC2.”<\/em> A third group ties the choice to geography instead: European buyers want ISO, American buyers want SOC 2. And even that resolution doesn’t fully hold, since sources disagreed about which of the two an internationally-facing US startup should chase first. There’s no consensus here, and any advice claiming otherwise is overstating what practitioners actually agree on.<\/p>\n\n\n\n
What does it cost, in money and time?<\/h3>\n\n\n\n
The widest range of any framework in this research.<\/strong> Turnkey setups for very small companies start around US$5,000\u20136,000. A typical 40-person business should expect somewhere in the $10,000\u201325,000 range all-in. Mid-size companies doing it properly report $50,000\u201380,000, and one combined ISO 27001 plus SOC 2 program at a 200-person SaaS company ran under $200,000 over 18 months, before a subsequent US federal compliance program, at which point, in that person’s words, cost “went through the roof.”<\/em><\/p>\n\n\n\n
Who is required to have it, and by whom?<\/h3>\n\n\n\n
Never a legal requirement in any jurisdiction we found, always procurement.<\/strong> UK government frameworks now increasingly name it alongside Cyber Essentials, and one contractor summed up the compounding effect directly: “some are requiring ISO27001 and ISO9001\u2026 these costs essentially wipe out a lot of SMB’s from being on Government frameworks.”<\/em><\/p>\n\n\n\n
What language do people reach for when they talk about it?<\/h3>\n\n\n\n
“Checkbox exercise”<\/em> is the single most repeated phrase across all three of our source sets. One practitioner’s summary of the whole document set: “a bunch of documents that sit in a folder on a sharepoint.”<\/em> Another, more generously: “the mother of all InfoSec Standards.”<\/em><\/p>\n\n\n\n
\n\n\n\nSOC 2 \u2014 118 voices<\/h2>\n\n\n\n
SOC 2 is a US audit report, not a certification: a distinction practitioners correct constantly, and one that matters more than it sounds.<\/p>\n\n\n\n
What do people say is genuinely good about it? Who benefited, and how?<\/h3>\n\n\n\n
It’s the literal price of entry for a lot of US enterprise sales conversations.<\/strong> One practitioner’s experience was blunt: without it, “we wouldn’t be growing like we are, as the larger companies wouldn’t talk to us at all.”<\/em> Several people also credited the process itself, not the report, with forcing genuine operational discipline that had been overdue for years.<\/p>\n\n\n\n
What do people say is wrong with it, or not worth it?<\/h3>\n\n\n\n
It measures documentation during a specific window, not ongoing security.<\/strong> One vendor’s own writing on this was the clearest summary we found: “a SOC 2 report tells you that security controls existed during a limited audit window\u2026 It does not tell you they’re good\u2026 It tells you that someone, somewhere, checked a box.”<\/em> The bigger, more repeated complaint is about the audit market itself: a genuine race to the bottom, where a cheap “rubber stamp” auditor can be had for a fraction of what a rigorous one costs, and buyers who know the market can tell the difference from the report alone.<\/p>\n\n\n\n
One anonymous commenter put the harshest version of that argument on record: “SOC 2 is completely worthless. Focuses heavily on documentation and almost ignores practical security measures. A SOC 2 compliant organization could be using ‘welcome1234’ for all of their user passwords with no MFA and still pass.”<\/em><\/p>\n\n\n\n
What surprised people \u2014 things they didn’t expect until they went through it?<\/h3>\n\n\n\n
Governance demands can blindside a genuinely small team: one eight-person startup found itself facing expectations it had no realistic way to meet. Others discovered mid-process that nothing in their environment had ever been formally authorised in the way the audit assumed. Thomas Ptacek, the well-known independent security researcher at Fly.io, was candid about what actually worried his auditors most: not a technical gap, but the possibility that “some developer on our team might ‘go rogue’ and install malware in our hypervisor build.”<\/em><\/p>\n\n\n\n
Where do practitioners disagree with each other about it?<\/h3>\n\n\n\n
Cheap versus quality auditors, repeatedly and sharply.<\/strong> One side of the argument treats a low-cost audit as fine: a box is a box. The other treats it as actively dangerous, arguing that a report from a shoddy auditor should be dismissed on sight by any buyer paying attention, and that real cost typically runs three to five times what the cheap quotes suggest.<\/p>\n\n\n\n
What does it cost, in money and time?<\/h3>\n\n\n\n
Never reconciled to one number, by design of the market itself.<\/strong> One founder’s account is a useful anchor: “Consultants quoted us $35,000 and 8 months. Vanta wanted $12,000\/year\u2026 We’re 6 people\u2026 It was a nightmare.”<\/em> Broader reporting across the sources we found ranges from around $5,000 at the very cheap end to $100,000-plus first-year all-in for a properly scoped audit.<\/p>\n\n\n\n
Who is required to have it, and by whom?<\/h3>\n\n\n\n
Never a legal requirement.<\/strong> One vendor’s own explainer is unambiguous: “No legal mandate.”<\/em> Demand is entirely customer-driven, concentrated in the US, and regulated or contract-sensitive industries push harder than most.<\/p>\n\n\n\n
What language do people reach for when they talk about it?<\/h3>\n\n\n\n
“Attestation, not certification”<\/em> is the correction we saw repeated, independently, more than anywhere else in this research. Practitioners clearly get asked about this constantly and clearly get tired of correcting it. Beyond that: “rubber stamp,”<\/em> “website sticker,”<\/em> and Thomas Ptacek’s own essay title, which doubles as a fair one-line summary of the whole framework: “SOC2: The Screenshots Will Continue Until Security Improves.”<\/em><\/p>\n\n\n\n
\n\n\n\nA note on who’s talking<\/h2>\n\n\n\n
Roughly three in ten of the people and sources quoted across this research have a commercial stake in the framework they’re discussing: they sell implementation, certification, or a competing service. We checked, framework by framework, whether that changed what they said. It generally did: sources with something to sell were consistently more positive than sources with nothing to sell.<\/p>\n\n\n\n
![\"Cybersecurity](\"https:\/\/www.sandbox.backupassist.com\/app\/uploads\/sites\/3\/2026\/07\/Screenshot-2026-07-29-at-3.25.44-PM-1024x267.png\")
<\/figure>\n\n\n\n<\/p>\n\n\n\n
That’s not a reason to ignore commercially-connected voices. Some of the sharpest, most precise criticism in this piece came from people who sell these services for a living.<\/p>\n\n\n\n
Our view, upon reviewing the data and speaking to people in the cyber industry, is that the implementers will tend to gravitate towards the frameworks that are easiest to implement and have the maximum benefit for their clients. Or in other words they will abandon frameworks that are too complex, too expensive or don’t deliver real cyber benefits for their clients and instead move towards more practical and actionable frameworks. Understanding that behaviour helps explain why in particular the SMB 1001 framework has so many positive comments in particular from the practitioners implementing that standard. Anecdotally (and outside of this research), we know of many MSPs who fall into this category \u2014 they tried implementing NIST CSF or ASD Essential Eight, discovered it was either too vague or too “enterprise”, and then switched to a different framework.<\/p>\n\n\n\n
Do you even need a framework?<\/h2>\n\n\n\n
The core dilemma is this: getting certified in cybersecurity is a bit like taking a driving test. You have to tick all the boxes, but does it actually mean you’re a good and safe driver?<\/p>\n\n\n\n
- Total implementation costs were never mentioned.<\/strong> We found comments about external costs like licensing and auditing. But understanding the true and total cost of implementing a framework into a business is difficult, as the time of internal staff and employees was never recorded. Compounding that, the amount of work required varies widely, depending on the starting position, business size, scope and cost of consultants.<\/li>\n\n\n\n
- The frameworks fall into 2 categories: low-friction, and high-friction.<\/strong> NIST CSF and SMB1001 are free or near-free, self-assessed, and designed to get a business with nothing in place doing something. ISO 27001, SOC 2, Cyber Essentials, and Essential Eight (for regulated work) involve real cost, real paperwork, and, for the first two especially, exist mainly to satisfy someone else’s procurement checklist, not to make you more secure in isolation.<\/li>\n\n\n\n