In security compliance, how do certification (ISO/IEC 27001), attestation (SOC 2) and self-assessment differ in who evaluates and what results?

## Three ways to reach a compliance conclusion Candidates often say "we are SOC 2 certified". Interviewers use that phrase to test whether the candidate knows what their organization actually holds. The three models differ in **who evaluates**, **what standard of evidence applies** and **what document results**. | Model | Who evaluates | What results | Examples | |---|---|---|---| | **Certification** | An independent certification body, itself accredited | A certificate stating conformity with a standard, maintained by periodic audits | ISO/IEC 27001; CMMC Level 2 (C3PAO) and Level 3 (DIBCAC) certification assessments | | **Attestation** | A CPA practitioner under the AICPA attestation standards | A report containing the practitioner's opinion against stated criteria | SOC 2 examination against the Trust Services Criteria | | **Self-assessment** | The organization itself | Its own results, affirmed by a responsible official | CMMC Level 1 and Level 2 (Self); PCI DSS Self-Assessment Questionnaire | ## Attestation in more detail The AICPA's attestation standards (the SSAEs) govern examination, review and agreed-upon procedures engagements. Under them: - the CPA performing an attestation engagement is called a **practitioner**; - in an **examination engagement**, the practitioner expresses an **opinion** on subject matter, or on an assertion about the subject matter, in relation to an identified set of **criteria**; - in a SOC 2 examination, those criteria are the **Trust Services Criteria**, and the practitioner evaluates whether controls were **suitably designed and operated effectively** to meet the entity's service commitments and system requirements. The output is a **report for its intended users**, not a public badge. The reader must read it: the scope, the period, the tested controls and any exceptions are the content. ## Certification in more detail Certification is a **conformity assessment**. For ISO/IEC 27001, an independent certification body audits the information security management system and, if it conforms, issues a certificate that is kept alive by periodic audits over its cycle. The certificate states *that* the organization conforms; it does not publish detailed test results. The CMMC rule shows the same pattern in a government programme: Level 2 (C3PAO) and Level 3 (DIBCAC) are called **certification assessments**, performed by authorized or accredited third parties, and the rule requires the accreditation body to meet ISO/IEC 17011 and to accredit assessment organizations to ISO/IEC 17020. ## Self-assessment in more detail Self-assessment trades independence for cost and speed: - Under **32 CFR 170**, a Level 1 or Level 2 (Self) assessment is performed by the organization, scored and submitted, and a senior official **affirms** compliance at each assessment and annually. - Under **PCI DSS**, eligible entities complete a **Self-Assessment Questionnaire (SAQ)** rather than a Report on Compliance by a Qualified Security Assessor. The affirmation matters (the CMMC rule requires one after certification assessments too, not only self-assessments): a false self-assessment is the signing official's problem, which is why self-assessment is not a lighter duty, only a cheaper process. ## What each tells a customer - A **certificate** says an independent body found conformity with a standard at its last audit. - An **attestation report** says what controls existed, how a practitioner tested them and what exceptions were found, over a stated period or at a point in time. - A **self-assessment** says what the organization concluded about itself, backed by its own official's signature. ## Choosing which to pursue The choice is usually driven by who is asking. Buyers who want to see how controls were tested tend to ask for an attestation report they can read; buyers who want a recognized badge across many markets tend to ask for a certificate; government programmes decide for you, as CMMC does by assigning self-assessment or third-party assessment per contract. Cost, lead time and how much detail the organization is willing to share with customers all enter the decision, and many organizations end up holding more than one. ## Common mistakes - **"SOC 2 certified."** SOC 2 is an attestation; the correct phrase is "we have a SOC 2 report" or "a SOC 2 examination". - **Treating a certificate as proof of every control.** Certification speaks to conformity with the standard's requirements within the certified scope, not to controls outside it. - **Treating self-assessment as optional rigour.** Where a regime allows it, it still carries formal affirmation and consequences for misstatement. A strong answer separates the three by evaluator and output, uses the words *certificate*, *opinion* and *affirmation* correctly, and explains why a buyer might ask for one rather than another.