# What is the difference between a certification and an attestation report?

A certification is an accredited body’s decision that you meet a standard, documented in a certificate. An attestation report is an auditor’s opinion on your controls, with the details of what was tested. ISO/IEC 27001 works by certification: an accredited certification body audits your management system, issues a certificate for a stated scope, and keeps checking with surveillance audits until recertification. SOC 2 works by attestation: an independent auditor tests your controls against criteria and writes a report with its opinion and any exceptions, which you share under a non-disclosure agreement. In practice, a certificate is easy to verify and compare but says little about detail; a report says much more but must be read, including its scope, period, exceptions and the controls you must run yourself. Both are only as useful as their scope is relevant to the service you buy. Be wary of vendors who describe a self-assessment, a policy or a consultant’s readiness review as either. NetSenX holds neither today; SOC 2 Type I and ISO/IEC 42001 are in preparation.

FAQ: [Security standards: ISO 27001, SOC 2](https://netsenx.com/en/faq/standards) · https://netsenx.com/en/faq/certification-vs-attestation-what-is-the-difference

## Read next

- https://netsenx.com/en/compliance
- https://netsenx.com/en/security
- https://netsenx.com/en/nis2-readiness

## Related questions

- [How do we prepare for our first ISO 27001 certification audit?](https://netsenx.com/en/faq/how-to-prepare-for-a-first-iso-27001-audit)
- [What is ISO/IEC 27001, in plain terms?](https://netsenx.com/en/faq/what-is-iso-27001)
- [What is an information security management system?](https://netsenx.com/en/faq/what-is-an-isms)
- [What is a statement of applicability in ISO 27001?](https://netsenx.com/en/faq/what-is-a-statement-of-applicability)
- [What is SOC 2, and why do customers ask for it?](https://netsenx.com/en/faq/what-is-soc-2)