NIST CSF 2.0, SOC 2 and CMMC: which course fits your role?

Three references, three different outcomes

Before choosing a course, be clear what your organization has to produce, because each of the three ends somewhere different.

NIST CSF 2.0: a program and a report

The NIST Cybersecurity Framework organizes cybersecurity risk management outcomes across six Functions: Govern, Identify, Protect, Detect, Respond and Recover. It is voluntary, and NIST says it "does not offer certifications or endorsements of CSF-related products, implementations, or services". An organization assesses itself, or engages an assessor, and gets a report on its current and target outcomes, not a certificate. Our NIST Cybersecurity Framework guide walks through the Functions, and our NIST CSF certification guide covers what people and organizations can hold instead.

SOC 2: an examination and a report

SOC 2 is an examination of a service organization's controls against the AICPA's Trust Services Criteria, performed by a licensed, independent CPA firm under attestation standards. It results in a report, Type I or Type II, not a certification. The job inside the organization is readiness: implementing the controls, collecting the evidence and keeping it current between reports. Our SOC 2 vs ISO 27001 comparison and our SOC 2 training for individuals guide cover the detail.

CMMC: a contracting assessment program

The Cybersecurity Maturity Model Certification is the Department of Defense's program for assessing the cybersecurity of its contractors, with its own levels, requirements and assessment ecosystem. The underlying requirement for most contractors is the DFARS 252.204-7012 clause, which requires them to implement NIST SP 800-171 for covered defense information.

Status as at 8 November 2026. On 13 July 2026 the Department suspended CMMC Phase II, which had been due to take effect on 10 November 2026 and would have required third-party assessments for contractors handling controlled unclassified information. Phase I remains in effect: self-assessments, the DFARS clause, NIST SP 800-171 and SPRS postings continue. A 60-day review followed, with comments closed on 14 August 2026, and no end date for the suspension was given. Check the Department of Defense CIO's CMMC page for the current position before planning assessment work.

What a course gives you, and what it does not

An honest map matters more than a flattering one. None of these courses claims an equivalence between frameworks, and none of them produces the organization's outcome.

What transfers

• Risk-based control selection. Choosing controls from a catalog because of the risk they treat, and recording why. The CSF, SP 800-53, the Trust Services Criteria and ISO/IEC 27001 Annex A all work this way.
• Evidence. A SOC 2 examination, a CMMC self-assessment and an ISO/IEC 27001 audit all turn on whether the evidence supports the stated control. The courses teach you to build and judge that evidence.
• Audit method. Planning, sampling, findings and follow-up are the same discipline whichever framework the controls come from.
• Governance. CSF 2.0 added Govern as a Function. Management review, roles and continual improvement in an ISMS are the same idea.

What does not

• The organization's outcome. A credential belongs to a person. The SOC 2 report comes from a CPA firm, CMMC status comes through the Department of Defense's program, and an ISO/IEC 27001 certificate comes from a certification body after an audit.
• Assessor authority. No PECB credential authorizes anyone to issue a SOC 2 report or to perform a CMMC assessment.
• A contract's exact requirement. Contracts name specific publications and revisions. The NIST course covers SP 800-171; the revision your contract requires is in the contract.

How to choose: five questions

1. What does your organization have to produce? A CSF report, a SOC 2 report, a CMMC self-assessment or an ISO/IEC 27001 certificate each point to a different course above.
2. Do you make the controls work, or check whether they do? Making them work points to an implementer course; checking points to the Lead Auditor.
3. Which publications does your contract or customer name? SP 800-171 and DFARS 252.204-7012 point to the NIST course; the Trust Services Criteria point to the SOC 2 course; ISO/IEC 27001 points to the Lead Implementer.
4. Do customers outside the US ask for a certificate? Then the ISO/IEC 27001 Lead Implementer belongs on the team, whatever else you run.
5. Are you starting out? Take the ISO/IEC 27001 Foundation first, or go straight to a Lead course and sit the exam for the Provisional level.

Next steps

Every course is priced in US dollars and includes the PECB exam voucher, two exam attempts and the certification fee.