Which standard applies?

SOC 2 is a framework designed for service providers that handle customer data, focusing on the principles of security, availability, processing integrity, confidentiality, and privacy. While it is relevant for assessing data management practices, it does not serve as a comprehensive standard for managing information security at an organizational level like ISO/IEC 27001.

The CCPA is a state-specific law that enhances privacy rights and consumer protection for residents of California. Although it addresses data privacy issues, it does not provide a framework for managing an overall information security management system as ISO/IEC 27001 does.

The Payment Card Industry Data Security Standard (PCI-DSS) focuses specifically on securing credit card transactions and protecting cardholder data. While important for organizations that handle payment information, it is not a general standard for comprehensive information security management like ISO/IEC 27001.