# Goal This epic will serve as the collection point for global community requests for third-party attestations and certifications. ## What Are Common Security Audit Standards? Many SaaS security standards require an external audit for validation. While some apply broadly to the industry, many are more sector or region specific, pertaining directly, for instance, to healthcare or financial institutions or local government. Below is a short list of some of the most-discussed security standards: * **[ISO/IEC 27001](https://en.wikipedia.org/wiki/ISO/IEC_27001)**: ISO/IEC 27001 specifies a management system that is intended to bring information security under management control and gives specific requirements. Organizations that meet the requirements may be certified by an accredited certification body following successful completion of an audit. * **[FedRAMP](https://en.wikipedia.org/wiki/FedRAMP)**: The Federal Risk and Authorization Management Program (FedRAMP) is a US government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. * [**SOC**](https://en.wikipedia.org/wiki/System_and_Organization_Controls): System and Organization Controls (SOC), defined by the American Institute of Certified Public Accountants (AICPA), is the name of a suite of reports produced during an audit. It is intended for use by service organizations (organizations that provide information systems as a service to other organization) to issue validated reports of internal controls over those information systems to the users of those services. * **[HITRUST](https://hitrustalliance.net/)**: HITRUST, in collaboration with private sector, government, technology and information privacy and security leaders, has established the HITRUST CSF, a certifiable framework that can be used by any organization that creates, accesses, stores or exchanges sensitive information.