Buyers use framework names loosely. Before you spend money, find out which scheme they mean and what they will accept. Cyber Essentials is a UK scheme, C5 is a German cloud catalogue, TISAX is for the automotive supply chain, SOC 1 serves financial reporting, STAR is cloud assurance, and the CSF is a voluntary outcome framework.
One line each
Cyber Essentials: developed by the NCSC with IASME as delivery partner, built on five technical controls. First question: base level or Plus?
C5: a BSI catalogue of minimum cloud security criteria, examined by an auditor you pick. First question: which version, and which report type?
TISAX: governed by ENX, based on the ISA catalogue, results shared through the ENX Portal. First question: which assessment objective and level?
SOC 1: an AICPA examination of controls relevant to customers' financial reporting. First question: is this for their financial statement audit?
CSA STAR: a registry built on the Cloud Controls Matrix, with a self-assessed Level 1 and an audited Level 2. First question: which level?
NIST CSF 2.0: a framework of outcomes with Organizational Profiles. First question: do they want a profile, or just alignment?
A way to decide
- Where is the buyer? A UK public or supply chain tender often points to Cyber Essentials. German cloud buyers may mention C5. We cannot name which buyers require what. Ask.
- What industry? Automotive suppliers meet TISAX. Finance heavy services meet SOC 1.
- What do they want proof of? Controls in place, an audited report, or a roadmap.
- How much time do they give you? A published self-assessment is faster than an audit.
What can you reuse
Many controls repeat across these: asset inventory, access control, patching, logging, supplier management. Build one evidence set and map it, rather than starting each from zero. See one evidence set for many frameworks.
Wording to avoid
Several of these are attestations, assessments or self-declarations rather than certifications. Cyber Essentials is a certification scheme. C5 and SOC reports come from auditors, and BSI does not check C5 reports. State exactly what you hold.
Quick check
Is a buyer asking for TISAX also asking for ISO 27001?
Not necessarily. TISAX is based on the ISA catalogue. Ask what they accept.
Which framework should I do first?
The one your largest or most likely buyer names. If none, a baseline such as the CSF or Cyber Essentials is a reasonable start.
Sources
- NCSC Cyber Essentials overview
- BSI C5 criteria catalogue
- ENX TISAX overview
- AICPA SOC suite of services
- CSA Cloud Controls Matrix
- NIST CSF 2.0 (CSWP 29)
Last reviewed: 19 October 2026.
