Supplier certificates: what they tell you, and what they do not

When you ask a supplier how they look after security, the quickest answer they can give is a certificate or a report. That is a good start. But each one answers a narrower question than it first appears, and the details on the document matter as much as the logo.

A certificate is evidence that someone checked something, about some part of the supplier, at some point in time. Your job is to find out which part, which checks and which time, and whether that matches the service you buy.

Cyber Essentials and Cyber Essentials Plus

Cyber Essentials is a UK government-backed scheme that covers a small set of basic technical controls: firewalls, secure configuration, user access control, malware protection and keeping software up to date.

• Cyber Essentials is based on a self-assessment questionnaire that is reviewed by a certification body.
• Cyber Essentials Plus covers the same controls, with a hands-on technical check by an assessor.

What to check

• The date. Certification reflects a point in time and is expected to be renewed every year. A certificate from two years ago tells you about two years ago.
• The scope. A certificate can cover the whole organisation or a defined part of it. Make sure the part that runs your service is included.
• The certificate number and organisation name. These let you look the certificate up with the scheme. Record that you did, and when.

What it does not tell you

Cyber Essentials is deliberately basic. It does not cover how a supplier handles your data, how they manage incidents, whether they can recover from an outage, or how they choose their own suppliers. It is a sensible minimum, not the whole picture.

ISO/IEC 27001

ISO/IEC 27001 is an international standard for an information security management system: the way an organisation identifies its risks, chooses controls and keeps improving. A certificate is issued by a certification body after an audit, followed by regular surveillance audits.

What to check

• The scope statement. This is the most important line on the certificate. It says which parts of the organisation, which locations and which services are covered. A certificate covering “head office IT” says little about a hosted service run elsewhere.
• The certification body and accreditation. Check who issued it, and whether that body is accredited. In the UK, accreditation is usually by UKAS.
• The dates. Certificates run on a cycle with surveillance audits in between. Check the certificate is current.
• The Statement of Applicability. If the service matters, ask for it. It lists which controls the supplier applies and which they have excluded, and why.

What it does not tell you

ISO 27001 shows a supplier has a working management system for information security. It does not mean every control is strong, or that a control you care about is in scope.

SOC 2 reports

A SOC 2 report is an independent auditor’s report on a service organisation’s controls, against criteria covering security and, optionally, availability, processing integrity, confidentiality and privacy. It is a report rather than a certificate, and it is often shared only under a non-disclosure agreement.

• Type I looks at whether controls are designed suitably at a point in time.
• Type II also tests whether they operated effectively over a period, often six to twelve months. Type II is the more useful of the two.

What to check

• The period covered. If the period ended many months ago, ask for a bridge letter covering the gap.
• The auditor’s opinion and exceptions. Read the exceptions section. A clean opinion with exceptions is still worth understanding.
• Your side of the bargain. Reports list complementary controls the customer is expected to operate, such as managing your own users’ access. These are your responsibility.
• What is carved out. Services the supplier relies on, such as a hosting provider, may be excluded from the report.

Whatever the document, record what you relied on

The most common problem is not a weak certificate. It is not being able to say, later, which certificate you looked at, what its scope was, and what you concluded. Keep the file, note the version, write down what you checked and why you were satisfied, or not.

In Vendwise, suppliers record the scheme, number, issuer, scope and dates when they upload a certificate. The number is shown as stated by the supplier until one of your reviewers checks it, and every review and decision points at the exact version it relied on.