Compliant, certified, aligned: which claim you can actually make

Certified means somebody independent looked and issued a document you did not write. Compliant means you looked and reached a favourable conclusion about yourself.

Both can be true. Only one is evidence, and the gap between them is exactly the thing a customer is trying to close when they ask for your certificate.

A certificate carries specifics that make it checkable: the standard and its edition, a scope statement, issue and expiry dates, a certificate number, the certification body, and the accreditation symbol of the body that accredits them. "We are compliant" carries none of those, which is why it cannot do the same commercial work however sincerely it is meant.

Because it is ambiguous in a way that resolves in your favour to a casual reader and against you to a careful one.

Written honestly, it usually means "we have implemented the standard and believe we meet it". Read by a procurement reviewer, it lands somewhere very close to certified — and when they ask for the certificate and there is none, the conversation is no longer about security. It is about whether your claims can be relied on, which is a much worse conversation to be having with someone mid-way through a vendor assessment.

The risk compounds when the phrase migrates. A line on a website is marketing; the same line in a questionnaire response is a representation; the same line in a contract is a warranty. Nobody plans that progression, and it happens by copy-paste.

"Aligned with ISO/IEC 27001" is the honest and entirely respectable phrasing for an organisation that has built the management system and not yet certified. It says what you did, claims no external assessment, and nobody has ever been caught out by it.

Better still, be specific about where you are, because specificity reads as confidence rather than hedging. "We operate an ISMS aligned to ISO/IEC 27001 and are in our Stage 1 audit in November" tells a buyer far more than either "compliant" or "certified" would, and it gives them a date to plan around. Procurement teams deal with in-progress suppliers constantly; what they cannot work with is a claim that turns out to be softer than it sounded.

If you have controls but no management system, say that too. "We have implemented controls mapped to Annex A; we have not built a certifiable management system" is a real answer, and it is the answer a competent reviewer will reach anyway once they ask for your Statement of Applicability.

Four appear regularly and all of them signal to an informed reader that the writer has not checked.

"SOC 2 certified" — SOC 2 is an attestation examination performed by a licensed CPA firm, producing a report containing an opinion. There is no certificate and no certification body.

"GDPR certified" or "DPDP certified" — compliance with a statute is a legal conclusion reached against the law, not a document anyone issues. You can be certified to ISO/IEC 27701, which builds the records that make demonstrating compliance straightforward, but that is a different sentence and worth writing as one.

"IAF certified" or "IAF approved" — the International Accreditation Forum neither certifies organisations nor accredits certification bodies. It runs the arrangement between accreditation bodies.

And "ISO certified", unqualified. ISO publishes many standards and certifies nothing itself. Name the standard, the edition and the certification body; the unqualified version is the phrasing used by people who bought a certificate without asking who stood behind it.

Worth knowing, because it is more than most suppliers assume. A certificate number and a certification body are checkable in minutes through the body itself, its accreditation body’s register, or IAF CertSearch. Enterprise procurement teams do this routinely, and increasingly do it before the first call rather than during contracting.

They also read the scope statement, which is where most overclaiming actually unravels — not through a false certificate, but through a real one that covers a different part of the business from the service being bought.

So the practical advice is narrower than "be honest". It is: make the claim you can support, name the standard and edition, publish the scope, and if you are not certified say aligned and give a date. All four of those are easier than managing the alternative.