The international standard for an information security management system. It certifies the system you run to manage security, not a fixed checklist of technical controls.
What it proves
An accredited body audited the programme and issued a certificate covering a stated scope. Certificates run on a three year cycle with surveillance audits in between, so it is a continuing obligation rather than a one off exercise.
What it does not
The scope can be narrow. A certificate covering one product line or one office says nothing about the rest of the company, and the certificate itself tells you which.
Ask for
The certificate PDF, the Statement of Applicability, and the name of the certification body. Check the scope statement and that the body is accredited. The 2022 edition is the current one.
906 of 1,653 listed companies show it, 620 independently confirmed
A report by a licensed CPA firm on controls relevant to security, and optionally availability, confidentiality, processing integrity and privacy. The most common credential in SaaS.
What it proves
An independent auditor tested the controls and wrote up what they found, including anything that failed. A clean opinion on a Type 2 is a meaningful signal.
What it does not
It is not a certification and there is no pass mark. Two SOC 2 reports can describe very different control environments, and the company chooses which trust services criteria are in scope.
Ask for
The full report, not the badge. Read the auditor's opinion, the list of exceptions, the period covered, and which criteria were included.
164 of 1,653 listed companies show it, 68 independently confirmed
A SOC 2 that attests the controls were suitably designed at one point in time.
What it proves
The design of the control environment was examined on a given date.
What it does not
It says nothing about whether the controls actually worked. It is a snapshot, and it is often the first report a young company produces.
Ask for
The date, and when the Type 2 is expected.
318 of 1,653 listed companies show it, 254 independently confirmed
A SOC 2 that attests the controls operated effectively across a period, typically three to twelve months.
What it proves
Controls were tested repeatedly over time. This is the version most procurement teams want.
What it does not
A short first period is weaker than a full year, and the report can still contain exceptions.
Ask for
The observation period and the exceptions section. If the period ended a while ago, ask for a bridge letter.
1,270 of 1,653 listed companies show it, 1,039 independently confirmed
A public summary of a SOC 2 attestation, written for general distribution.
What it proves
The company holds a SOC 2 and is willing to say so publicly.
What it does not
It carries none of the detail. There are no control descriptions and no exceptions.
Ask for
The underlying SOC 2 report if you need to assess anything specific.
174 of 1,653 listed companies show it, 110 independently confirmed
An attestation on controls relevant to a customer's financial reporting.
What it proves
It matters when the vendor processes something that lands in your financial statements, such as payroll or billing.
What it does not
It is not a security report. A SOC 1 tells you very little about how data is protected.
Ask for
A SOC 2 as well, if security is the concern. Types 1 and 2 mean the same thing here as for SOC 2.
39 of 1,653 listed companies show it, 10 independently confirmed
Cloud specific security guidance, audited as an extension to an ISO 27001 certificate.
What it proves
The cloud side of the security programme was examined against controls written for cloud services.
What it does not
It does not stand on its own. It presumes the ISO 27001 certificate it extends.
Ask for
The parent ISO 27001 certificate and its scope.
97 of 1,653 listed companies show it, 19 independently confirmed
Protection of personal data in public clouds, audited as an extension to ISO 27001.
What it proves
Personal data handling in cloud services was in scope of the audit.
What it does not
Like 27017, it extends a certificate rather than replacing one, and it is narrower than a privacy management system.
Ask for
The parent certificate, and ISO 27701 if privacy management is the real question.
89 of 1,653 listed companies show it, 21 independently confirmed
The standard for business continuity management systems.
What it proves
There is an audited programme for keeping the service running through disruption.
What it does not
It covers continuity planning, not security.
Ask for
Recovery time and recovery point objectives for the service you are actually buying.
15 of 1,653 listed companies show it, 6 independently confirmed
The quality management system standard, used across almost every industry.
What it proves
There is an audited system for consistent delivery and continuous improvement.
What it does not
It is not a security or privacy credential and is often misread as one on a trust center.
Ask for
A security standard if security is what you are assessing.
71 of 1,653 listed companies show it, 43 independently confirmed
The Cloud Security Alliance's assurance registry for cloud providers.
What it proves
Level 1 is a published self assessment against the CAIQ questionnaire. Level 2 adds a third party audit.
What it does not
The two levels are very different and the badge alone does not say which one you are looking at.
Ask for
The STAR level, and the registry entry so you can read the questionnaire responses.
90 of 1,653 listed companies show it, 11 independently confirmed
The UK government backed baseline covering five technical controls.
What it proves
A genuine floor for basic hygiene such as patching, access control and firewalls, and often required for UK public sector work.
What it does not
It is a baseline by design and deliberately shallow. The standard tier is a verified self assessment.
Ask for
Whether it is Cyber Essentials or Cyber Essentials Plus. Plus adds hands on technical testing.
99 of 1,653 listed companies show it, 54 independently confirmed
A certifiable framework that harmonises healthcare security requirements with other standards.
What it proves
A prescriptive and demanding assessment, widely expected by US healthcare buyers.
What it does not
The assessment tiers differ a great deal in depth, from the lightweight e1 to the two year r2.
Ask for
The assessment type and the validity dates.
35 of 1,653 listed companies show it, 17 independently confirmed
The automotive industry's information security assessment, run through the ENX Association.
What it proves
Assessed against automotive sector requirements, usually a prerequisite for supplying manufacturers.
What it does not
Results are shared through the ENX exchange rather than published, and assessment levels vary.
Ask for
The assessment level and objectives, shared through the exchange.
33 of 1,653 listed companies show it, 6 independently confirmed
The NIST Cybersecurity Framework, a voluntary structure for organising a security programme.
What it proves
The company has a recognisable way of describing its security posture.
What it does not
There is nothing to certify. Alignment is self declared, and every organisation aligns differently.
Ask for
Evidence of the controls behind the claim, or a certification that covers them.
54 of 1,653 listed companies show it
The Australian Signals Directorate's eight mitigation strategies, scored by maturity level.
What it proves
A practical, well specified set of controls with a defined maturity scale.
What it does not
Self assessment is common, and the maturity level carries the meaning rather than the name.
Ask for
The maturity level claimed, and who assessed it.
9 of 1,653 listed companies show it
An awareness list of the most critical web application security risks.
What it proves
The engineering team knows the common classes of application vulnerability.
What it does not
It is a list, not a standard, and nothing can be certified against it.
Ask for
Penetration test results and how findings are remediated.
12 of 1,653 listed companies show it
Minimum Viable Secure Product, a short vendor security baseline checklist.
What it proves
A quick, comparable snapshot of baseline controls.
What it does not
It is intentionally minimal and self reported.
Ask for
A fuller attestation or certification for anything material.
3 of 1,653 listed companies show it
Google's Cloud Application Security Assessment, required for apps accessing sensitive Google user data.
What it proves
The application passed the tier of review Google required for its API scopes.
What it does not
It is specific to the Google ecosystem and says nothing about the wider organisation.
Ask for
An organisational credential such as SOC 2 or ISO 27001.
11 of 1,653 listed companies show it