What is the difference between a certification and an attestation report?

A certification is an accredited body’s decision that you meet a standard, documented in a certificate. An attestation report is an auditor’s opinion on your controls, with the details of what was tested. ISO/IEC 27001 works by certification: an accredited certification body audits your management system, issues a certificate for a stated scope, and keeps checking with surveillance audits until recertification. SOCSOC: security operations centre. A team, often working around the clock, whose job is to watch for and respond to attacks. 2 works by attestation: an independent auditor tests your controls against criteria and writes a report with its opinion and any exceptions, which you share under a non-disclosure agreement. In practice, a certificate is easy to verify and compare but says little about detail; a report says much more but must be read, including its scope, period, exceptions and the controls you must run yourself. Both are only as useful as their scope is relevant to the service you buy. Be wary of vendors who describe a self-assessment, a policy or a consultant’s readiness review as either. NetSenX holds neither today; SOC 2 Type I and ISO/IEC 42001 are in preparation.

← All 15 questions on Security standards: ISO 27001, SOC 2All topics