Readiness, report, certificate: how to read a compliance claim

Compliance language compresses three very different states into one word. Readiness means a company has done the internal work and believes it would pass. A report means an auditor has examined the controls and written an opinion. A certificate means an accredited body has audited the management system and issued one. A procurement questionnaire that asks “are you SOC 2?” collects all three answers as a yes, which is why the answer is worth asking a second question about.

Here is our own position at that resolution. SOC 2 Type I readiness work is complete and no report has been issued; an external penetration test and then the auditor’s report are the next two steps. SOC 2 Type II has not started, because Type II requires an observation window that opens only after Type I. ISO 27001 has a management system in place and a completed Statement of Applicability, and no accredited body has audited us. Those lines sit on our trust page in the same words.

A second track runs alongside the audited one, and we label it separately. We build to the NIST secure software development framework and are assembling a self-attestation to the CISA common form. Every build produces a signed bill of materials and signed provenance binding the artifact to the exact commit and pipeline that made it. Dependencies and secrets are scanned on every change, and infrastructure changes pass a policy gate before merge. All of that is our own assessment on our own authority, and it carries that label everywhere it appears.

Buyers of governance software have a sharper reason to care about this than most. The product’s job is to hold a record that survives someone else’s scrutiny. A vendor who states their own position at full resolution is showing you what the record will look like once it is yours.

Each stage moves on the day the framework says it moves, and the date goes on the page with it.