Attestation and Certification
Also known as: attestation, certification, SOC 2 attestation, ISO certification, compliance certification
Attestation is a formal written declaration (typically by management or a third-party auditor) that specified controls or requirements have been implemented and are operating effectively.
Certification is an independent, formal confirmation by an accredited body that an organization meets the full requirements of a standard or framework. While both provide assurance to customers and regulators, they differ in independence and authority: an attestation can be self-issued (management attestation) or auditor-issued (as with SOC 2), while a certification always comes from an independent, accredited body.
Attestation and Certification, explained at three levels
At home
When a security company says they are 'SOC 2 attested', it means an independent auditor has examined their controls and formally stated that the controls exist and work. When a company says they are 'ISO 27001 certified', it means an accredited certification body has assessed their whole security management system and formally awarded them a certificate. Both provide assurance that security controls are genuine, but the certification process is more thorough and the certificate is issued by a formally accredited body.
At work
In practice, attestation and certification serve similar commercial purposes (demonstrating security credibility to customers and prospects) but their mechanics differ. A SOC 2 Type II attestation report is issued by a licensed CPA firm examining specific Trust Service Criteria over a defined observation period. An ISO 27001 certificate is issued by an accredited certification body that has assessed the full Information Security Management System. Customers in North America most commonly ask for SOC 2 attestation; customers in Europe and regulated global markets most commonly ask for ISO 27001 certification.
At home
Management attestations are a separate category: internal statements by executives declaring that controls are in place. SOX Section 302 requires CEOs and CFOs to personally certify the accuracy of financial statements and the effectiveness of disclosure controls: this is a management attestation backed by criminal penalties for knowing misstatements. PCI DSS requires an executive officer of the organization to sign an Attestation of Compliance (AOC): a formal document declaring that the organization has met the standard's requirements as assessed by a QSA or through self-assessment.
At work
Third-party attestation reports (like SOC 2) include an independent auditor's opinion on whether the subject matter (management's description of the system and the controls) is fairly presented and whether the controls operated effectively. The report has three sections: management's assertion (what the organization claims), the service auditor's report (the CPA firm's opinion), and the system description and control testing results. A qualified opinion means the auditor found a material problem, such as controls that did not operate effectively during the observation period; minor exceptions can still appear in an unqualified (clean) report.
At home
Certification schemes require an organization to demonstrate conformity to all applicable requirements of a standard, not just selected criteria. ISO 27001 certification requires the full ISMS (risk assessment, Statement of Applicability, management review, internal audit, and all required controls) to be in place. Certification bodies are accredited by national accreditation bodies (UKAS in the UK, ANAB in the US) to ensure they apply consistent assessment standards. Certifications are time-limited: ISO 27001 certificates are valid for three years, with annual surveillance audits required to maintain them.
At work
From a practitioner standpoint, the choice between pursuing SOC 2 attestation or ISO 27001 certification (or both) depends on the organization's customer base and market. A North American SaaS vendor serving enterprise customers typically prioritizes SOC 2 Type II. A vendor selling to European enterprises or regulated industries globally typically prioritizes ISO 27001, sometimes alongside SOC 2. The two frameworks share significant control overlap, and a well-integrated compliance program can satisfy both with a single evidence collection process, reducing audit burden.
Real-world examples
At home
Sophie was comparing two cloud payroll providers. One had a SOC 2 Type II attestation report (issued by a CPA firm, covering a 12-month observation period); the other had a self-assessment questionnaire filled in by their own team. Sophie chose the one with the third-party attestation: it meant an independent auditor had verified the claims, not just the company itself.
At work
The compliance team at Northgate Financial required all critical vendors to hold either ISO 27001 certification or a SOC 2 Type II attestation report issued within the last 12 months. When a key payment processing vendor's ISO 27001 certificate expired without renewal, the compliance team issued a remediation notice: the vendor had 90 days to provide a renewed certificate or a current SOC 2 Type II report.
Common confusions
- Attestation and certification are not interchangeable terms, even though both are sometimes loosely called 'compliance certifications'. An attestation is a formal statement (by management or an auditor) that controls exist and work. A certification is a formal declaration by an accredited body that an organization meets all requirements of a standard. SOC 2 is an attestation engagement; ISO 27001 is a certification scheme.
- A SOC 2 attestation report is not a certificate. There is no physical certificate issued for SOC 2, and there is no central registry confirming which vendors hold current SOC 2 reports. The report itself is the deliverable: typically a confidential document shared under NDA. This contrasts with ISO 27001, where a certificate is publicly issued and can be verified through the certification body's registry.
- Achieving attestation or certification does not mean an organization is fully secure. Both provide point-in-time or period-specific assurance about specific controls within a defined scope. A vendor with a clean SOC 2 Type II report for their production environment may have significant security gaps in development environments or subsidiary systems outside the audit scope.
For analysts
In BA artefacts, attestation and certification requirements appear as vendor qualification criteria and as evidence requirements for compliance audits. When writing vendor selection requirements, be specific: 'SOC 2 Type II report covering Security and Availability criteria, with observation period ending within the last 12 months' is more useful than 'SOC 2 certified'. When documenting requirements for an internal system subject to audit, specify which attestation or certification evidence the system must generate or support: for example, access certification records that satisfy ISO 27001 Annex A.5.18.
History & origin
The distinction between attestation and certification has its roots in financial auditing and legal practice. In auditing, an 'attestation engagement' (governed by AICPA AT-C standards) is a service where a CPA provides assurance on a subject matter that is the responsibility of another party: the SOC 2 report is a modern example. Certification as a formal mark of conformity has its roots in product safety testing (Underwriters Laboratories marks, CE marking) and expanded to management systems with ISO 9001 certification (first published 1987) and later ISO 27001. The term 'attestation' gained broader use in the SOX era (post-2002), where CEOs and CFOs are required to personally attest to the accuracy of financial statements.