.png)
Security Assurance That Reflects Today's Realities
For more than a decade, ISO 27001 and SOC 2 have served as established approaches to organizational security assurance. Since then, threats, technology and customer expectations have changed considerably. Customers now need assurance that places greater emphasis on demonstrable security, compliance and operational resilience.
The MSO baselines build upon established assurance concepts to provide a modern, risk-informed way to evaluate whether an organization is secure, compliant and resilient. Built on the Secure Controls Framework (SCF), MSO defines three progressive control baselines aligned with differing levels of organizational complexity, risk exposure and operational capability. MSO looks past compliance on its own to evaluate whether an organization operates in a secure, compliant and resilient way.
MSO establishes reasonable expectations for secure and resilient service delivery, provides a consistent way to evaluate those expectations, and gives customers meaningful assurance that appropriate controls are operating within an organization's defined assessment boundary.
MSO is part of SCF CORE, an initiative the SCF Council created to turn the comprehensive SCF catalog into focused, actionable baselines. Like every CORE baseline, the MSO levels are derived from the Common Controls Framework (CCF) and calibrated to a specific type of organization, in this case service organizations of differing size, complexity and risk exposure.
Volunteer-Driven & Creative Commons Licensed
The MSO baselines are developed by volunteer cybersecurity practitioners and released under a Creative Commons license. There is no cost to access or implement them.
Five Principles Behind MSO
MSO is a next-generation approach to organizational security assurance. Five principles shape how the baselines are written and assessed.
Grounded In Operational Practice
MSO focuses on evidence that protections are implemented and functioning. An assessment shows the relationship among documented requirements, operating controls, technical validation and corrective actions.
Security, Compliance & Resilience Together
MSO draws on the breadth of the SCF domains. It brings cyber defense, governance, supply chain dependencies, operational continuity, recovery and artificial intelligence (AI) into one assessment baseline.
Proportionate Assurance That Grows With You
MSO offers a progressive path from essential controls to advanced capabilities. Organizations select the baseline that fits their risk profile and document why it applies.
Independent Assessment
MSO is designed for third-party conformity assessment through the SCR Conformity Assessment Program (SCR CAP). Customers receive detailed assessment results they can evaluate for themselves.
Interoperability Over Duplication
MSO complements existing contractual and framework obligations. Reusable controls and evidence reduce duplicated assessment effort across multiple frameworks.
MSO-1, MSO-2 & MSO-3
Each MSO level builds on the one before it. An organization moves up only when its services, customers and risk exposure call for it, so the expectations stay proportionate to the organization being assessed. Each level is described in its own section below.
MSO-1
Essential Secure & Resilient Practices
Establishes the essential practices customers should reasonably expect from a service provider.
MSO-2
Comprehensive Secure & Resilient Practices
Demonstrates comprehensive protection across increasingly complex services and operations.
MSO-3
Full-Spectrum Secure & Resilient Practices
Demonstrates advanced security and resilience capabilities across the enterprise.
Examples reflect the Initial Public Draft of the MSO baselines and may change as the baselines are finalized. The complete control set for each level is in the SCF download.
Essential Secure & Resilient Practices
MSO-1 is designed for organizations that provide services with relatively limited operational complexity and risk exposure. Its purpose is to establish the essential practices customers should reasonably expect from any service provider they rely on.
MSO-1 emphasizes achievable security and resilience outcomes that an independent assessor can verify. It does not mandate enterprise-class tooling. A small team can meet it with well-run practices and commonly available technology.
What MSO-1 Expects, For Example
- Documented governance with clear ownership of security, compliance and resilience responsibilities
- An accurate inventory of the technology assets, applications and data that support customer services
- Multi-factor authentication and role-based access control
- Centralized collection and review of security event logs
- Vulnerability scanning with a defined remediation process
- Data backups that are tested by restoring them
- Incident response and contingency plans that are tested
- Third-party oversight, including planning for how a vendor relationship ends
- Basic governance over the use of AI and autonomous technologies
What MSO-1 Does Not Require
MSO-1 does not require endpoint detection and response (EDR), network intrusion detection and prevention, data loss prevention, alternate processing sites or a formal internal audit function. Those expectations begin at MSO-2.
Comprehensive Secure & Resilient Practices
MSO-2 is intended for organizations with more complex environments, sensitive customer data, significant third-party dependencies and greater business continuity requirements. At this level, an organization demonstrates comprehensive protection across increasingly complex services and operations.
MSO-2 expands the MSO-1 expectations with stronger detection, data protection and continuity capabilities. It stops short of the technologies and organizational structures that belong at the enterprise level, so a growing organization can meet it without building a Fortune 2000 security program.
What MSO-2 Adds, For Example
- Endpoint detection and response (EDR) and network intrusion detection and prevention
- Data loss prevention and centralized management of mobile devices
- Alternate storage and processing sites for essential services
- A defined risk appetite, risk tolerance and documented risk treatment decisions
- An internal audit function and separation of duties
- Succession planning and backup coverage for vital security, compliance and resilience staff
- Secure development practices, including API security and DevSecOps
- Testing and evaluation of AI systems before and after deployment
What MSO-2 Does Not Require
MSO-2 does not require a dedicated security operations center (SOC), a formal threat hunting program, a zero trust architecture or post-quantum cryptography planning. Those expectations are reserved for MSO-3.
Full-Spectrum Secure & Resilient Practices
MSO-3 is built for enterprise-class organizations, providers that support critical operations, and organizations facing complex threats or heightened contractual and regulatory expectations. At this level, an organization demonstrates advanced security and resilience capabilities across the enterprise.
MSO-3 covers the full spectrum of advanced capabilities expected of large enterprises, such as Fortune 2000 companies, and of the providers they depend on for critical services.
What MSO-3 Adds, For Example
- A security operations center, threat hunting and extended detection and response (XDR)
- Zero trust architecture and cloud access security broker (CASB) controls
- Penetration testing and internal and external vulnerability assessments
- Isolated recovery environments and failover capability
- Continuous control monitoring with key performance and key risk indicators
- Post-quantum cryptography readiness and crypto-agility planning
- Governance over AI agents, including sandboxing and kill switch controls
- Software and hardware bills of materials
Which MSO Level Fits Your Organization?
The right MSO level depends on what an organization does for its customers and what could go wrong if it failed. Organizations start with MSO-1 and move to a higher level when one or more of the factors below apply. Whichever level is selected, the organization documents why it applies so that customers and assessors can understand the decision.
Operational Complexity: How many systems, locations, cloud environments and integrations support the services you deliver.
Data Sensitivity: Whether you store or process sensitive, regulated or high-value customer data.
Third-Party Dependencies: How much your services rely on suppliers, subcontractors and other service providers.
Continuity Expectations: How quickly customers expect your services to recover after a disruption.
Contractual & Regulatory Requirements: Whether customer contracts or regulators expect a specific level of protection.
Threat Exposure: Whether your organization or your customers are likely targets for capable, persistent attackers.
Choosing A Level For A Vendor
Customers can also use these factors to decide which MSO level to require from a vendor, based on the risk that vendor introduces.
A Modern Alternative That Works With SOC 2 & ISO 27001
Organizations looking for a SOC 2 alternative or an ISO 27001 alternative often already hold one of those reports or certificates. MSO is designed to complement them rather than force a choice. It gives customers a broader, integrated view of security, compliance and operational resilience.
The SCF maps its controls to the AICPA Trust Services Criteria used for SOC 2 and to ISO 27001. Organizations can use existing SOC 2 and ISO 27001 evidence when preparing for an MSO assessment, subject to mapping and assessment requirements. Controls and evidence that are already in place do not need to be rebuilt.
When SOC 2 Or ISO 27001 Is Still Required
MSO does not automatically replace a SOC 2 report or an ISO 27001 certificate. Where a contract specifically requires one of those, it is still required. MSO becomes a replacement when customers accept an MSO conformity assessment as adequate third-party assurance.
Reuse Evidence
Map existing SOC 2 and ISO 27001 evidence to MSO controls before the assessment begins.
Close The Gaps
Address resilience, supply chain and AI expectations that a narrower assessment may not cover.
One Control Set
Manage overlapping requirements across frameworks through a single set of SCF controls.
Independent Assessment Through SCR CAP
MSO is designed to support independent third-party conformity assessments through the Secure, Compliant & Resilient Conformity Assessment Program (SCR CAP). For service providers, this creates a path to a service provider security certification that customers can examine in detail.
Accredited Third-Party Assessment Organizations (3PAOs) evaluate each control using the examine, interview and test methodology. Assessors look for evidence that controls are implemented and operating as intended, in addition to reviewing documented policies.
What Customers Receive
- A Report on Conformity (ROC), made up of a Technical Assessment Report and an Executive Assessment Report
- A defined assessment boundary, so customers know which services, locations and systems were in scope
- A finding for each control: satisfactory, deficient, compensating or not applicable
- A Statement of Applicability that explains which controls apply and why
Making MSO Assessments Count With Customers
MSO assessments deliver the most value when customers formally accept them. The MSO Assurance Acceptance Initiative works with organizations that manage large vendor ecosystems so they can formally recognize MSO assessments for appropriate third-party risk categories.
What The Initiative Is Building
Organizations that accept MSO assessments give their vendors a clear reason to adopt MSO. Service providers can then show that recognized customers accept MSO as a demonstration of security and resilience under defined conditions.
- An assessment acceptance policy that procurement and third-party risk management (TPRM) teams can adopt
- A mapping package from MSO to the SOC 2 Trust Services Criteria and ISO 27001 that identifies coverage and gaps without claiming automatic equivalence
- A sample MSO Report on Conformity and executive assurance summary that customers can evaluate
- Risk-based rules for deciding when MSO-1, MSO-2 or MSO-3 is sufficient for a vendor
%20(white).png)