How to Check a Vendor's Security Certifications: 10 Sources

Start with the vendor’s trust centre, because that is where the claim lives, then verify it somewhere the vendor does not control. That second step is the one most buyers skip, and it is the only part that produces evidence rather than marketing. A certificate is a PDF, and a PDF proves nothing about whether the certification is still live, whether the body that issued it was accredited, or whether the scope covers the service you are buying.

The awkward part is that verification works completely differently depending on the framework. Several schemes maintain a public, searchable register that settles the question in under a minute. Others deliberately have none, because the artefact is a private report rather than a certificate. Knowing which situation you are in before you start saves the loop where a security team spends a fortnight looking for a directory that was never going to exist.

1. 1Decide which certification the decision actually turns on. A checklist of every framework in existence wastes everyone's time. Write down the one or two that your legal, security or procurement team will genuinely block a purchase over, and treat the rest as context rather than as gates.
2. 2Record the claim in the vendor's own words. Copy the exact sentence from their trust centre with the date you read it. Vendors write compliant, aligned, certified and audited to mean very different things, and the difference between them is the whole question.
3. 3Check the version and the dates before anything else. A certificate naming a superseded version of a standard is not evidence of anything current. Neither is an attestation whose reporting period ended eighteen months ago. Both take five seconds to spot and both are common.
4. 4Verify it in the register that owns that scheme. Each framework has exactly one authoritative place to check, and for several of them there is no register at all. Establish which situation you are in before you go looking, because that decides whether you can verify independently or have to ask.
5. 5Read the scope statement, not the badge. Scope is where certifications quietly fail to cover the thing you are buying. Confirm that the certified scope names the product, the entity and the locations that will actually process your data, rather than a parent company's head office.
6. 6Request the report where no public register exists. For attestation-based frameworks the report is the artefact and there is nothing public to check. Ask for the current one, and ask separately for the general-use summary if signing an agreement first is a problem for you.
7. 7Store the answer with an expiry date attached. Every certification expires and most run on an annual cycle. Record what you verified, where, on what date, and when it next needs rechecking. Without that last field the file silently becomes wrong rather than obviously out of date.

Every framework a vendor can put on its website belongs to one of three groups, and the group decides what evidence you are entitled to expect. Getting this wrong is the single most common failure in supplier security review: teams ask for a register that does not exist, or accept a screenshot for something they could have confirmed independently in seconds.

Assume the certificate is genuine and read it anyway, because the two things that most often make a certification irrelevant are printed on it. The first is the version of the standard. The transition to the 2022 revision of the information security standard closed on 31 October 2025 after a three-year window, so any certificate still naming the 2013 version has lapsed no matter what its own expiry date says. That check takes five seconds and it still catches vendors.

The second is the scope statement, which is the sentence nobody reads. Scope names the activities, services, locations and legal entity the certification covers, and it is written by the organisation being certified. A certificate whose scope reads along the lines of corporate information technology services at the head office is perfectly valid and tells you nothing about the platform that will hold your data. Read scope against three questions: does it name the product, does it name the legal entity you are contracting with, and does it name the locations where processing happens.

Dates come third and there are usually three of them. Issue date, expiry date and, for management-system certificates, the date of the most recent surveillance audit. Certificates of this kind typically run for three years with lighter audits in between, so a certificate two years into its cycle with no surveillance record is worth a question. For attestation reports the equivalent field is the reporting period, and the gap between the end of that period and today is time nobody has examined.

1. Their trust centre or security page

The starting point and the least reliable thing on this list, because the vendor writes it and there is no obligation to keep it current. Copy the claims verbatim with the date you read them, note which have a document attached and which are text only, and note whether the page carries any dates at all. Trust centres built on compliance automation platforms usually show a live document list and a request flow, which is a good sign in itself. A security page that names five frameworks and offers no artefact for any of them is a marketing page.

2. The certificate document itself

Ask for the PDF rather than a screenshot or a badge. What you are extracting is five fields: the standard and its version, the certification body, the accreditation body whose mark appears on it, the scope statement, and the validity dates. Those five fields are also exactly what you need to verify it independently in the next step, which is why a vendor supplying a cropped image rather than a document is making verification harder in a way worth noticing.

3. IAF CertSearch and national accreditation bodies

The accreditation forum runs a global database of accredited management-system certifications, and it is the answer to whether an ISO certificate is real. Search by organisation name or certificate number; the entry shows the standard, the scope, the certified locations, the certification body and the accreditation body. The standards organisation itself neither certifies companies nor accredits certification bodies, so a certificate issued outside an accredited scheme has no independent backing at all. Where the database has no entry, the national accreditation body in the certification body’s country holds the definitive record.

4. The FedRAMP Marketplace

A fully public, searchable database of cloud service offerings with a federal designation, carrying three statuses: ready, in process and authorised. It is authoritative and the vendor has no ability to embellish it, which makes it one of the cleanest sources in this whole cluster. It is also the only place on this page where the interesting entry is often the one that is not finished yet, since an in-process listing is a dated public commitment to a market months before the outcome.

5. Visa’s Global Registry of Service Providers

If the vendor touches cardholder data as a service provider, this is the list. Inclusion means an independent qualified assessor completed an on-site assessment against the payment card industry standard and the provider met the network’s programme requirements, revalidated every twelve months. Read the registered service categories rather than just the presence of the name: a provider can be validated for one service and not for the one you are buying, which is the same scope trap in a different register.

6. The CSA STAR Registry

Free, public, and unusually rich, because entries carry the completed cloud security questionnaire rather than a badge. That gives you the vendor’s own written answers on encryption, key management, subprocessors, incident response and data location, which is far more useful for a comparison than a certificate. The one thing to check on every entry is the level: a self-assessment is the vendor grading its own work, and it sits in the same registry as third-party attestations.

7. The UK Cyber Essentials certificate search

A searchable register of organisations holding a current certificate under the UK government-backed scheme, showing the level, the issue and expiry dates and the scope. Two practical notes. The certificate is valid for twelve months, so this is one of the few registers where a lapse shows up quickly. And the register’s own terms restrict it to checking certification, so use it to verify a supplier you are genuinely assessing rather than as a research dataset.

8. The attestation report, or its general-use summary

Where no register exists, the report is the evidence and there is no substitute for reading it. Go to the exceptions section first, because that is where the auditor records controls that did not operate as described, and it is the part a vendor summary never mentions. Then check the reporting period, the criteria in scope, and whether subservice organisations were carved out, which quietly moves part of the risk somewhere you have not assessed. If signing an agreement is a blocker, the general-use summary version of the same examination is written to be distributed publicly.

9. Their status page and published incident history

A certification describes controls; an incident history describes what happened. Read the status page archive for the pattern rather than the count: how quickly incidents were acknowledged, whether post-incident reviews are published, and whether the same subsystem keeps appearing. Regulatory breach notifications, where they exist in your jurisdiction, are the harder version of the same evidence. This is also the section where certifications and reality most visibly diverge, which is why a security review that stops at the certificate list is incomplete.

10. Your own security questionnaires and buyer feedback

The most valuable source here and the one nobody treats as a source. Every enterprise deal you run generates a security questionnaire, and over a year those questionnaires tell you exactly which frameworks your buyers block on, which have started appearing that did not before, and which competitor failed which control. Ask your sellers to record the reason whenever security or procurement removed a vendor from a shortlist. That is a genuine competitive gap in either direction, and it arrives free.

Supplier review asks whether a certification is real. Competitive research asks a different question: why did they decide to obtain that one, at that cost, now. These programmes take months and real money, so the list is a record of deliberate market choices rather than a compliance checkbox, and it is unusually honest because none of it can be claimed without a paper trail.

The gap is worth as much as the presence. If your buyers require something a competitor does not hold, that advantage lasts as long as their audit cycle rather than as long as a release cycle, which makes it one of the more durable claims you can put in front of a customer. Keep it factual and dated, keep it beside the rest of the comparison in your feature parity matrix, and re-verify it before every enablement update, because this is exactly the kind of claim that becomes wrong without anyone noticing.

1. 1Match the legal entity. The certificate names a company. Confirm it is the entity on your contract rather than a parent, a national subsidiary or a company acquired two years ago and still certified separately.
2. 2Confirm the standard version. A superseded version means the certificate is not current regardless of its printed expiry date, and this is the fastest disqualifying check available.
3. 3Read the scope statement aloud. If it does not name the product or service you are buying, the certification does not cover it. Ask for the scope in writing rather than accepting a verbal assurance that it is included.
4. 4Check the accreditation, not just the body. Anyone may issue a certificate. What makes it meaningful is that the issuing body is accredited for that scheme, which the register tells you and the certificate alone does not.
5. 5Close the reporting gap. For an attestation, note the end of the reporting period and ask what covers the months since. A bridge letter from the vendor is the standard answer, and its absence is worth recording.
6. 6Screenshot the register entry. Register entries change. If a certification decides a purchase or supports a sales claim, keep a dated copy of what you saw rather than a link that will show something different later.

Unusually for this subject, the main risk here is a document you signed rather than a trade secret you stumbled into. Security evidence is usually handed over under an agreement, and that agreement, not the law of confidential information, governs what you may do with it afterwards.

• A report received under an agreement stays inside that purpose. Attestation reports are restricted-use documents supplied to named parties, and they normally arrive with a confidentiality undertaking attached. Receiving a competitor’s report as a prospective customer and then circulating it internally as competitive material is a breach of the agreement your own company signed, quite separately from any question of ethics.
• Do not request evidence under a false purpose. Running a security review of a rival while presenting as a genuine buyer is misrepresentation, and it is worse here than elsewhere because it usually involves signing something. Everything on the registers in this page is available without pretending to be anyone.
• Respect a register’s own terms. Some public registers restrict use to verifying a certification you have a reason to check, and explicitly exclude research and marketing uses. Read the terms of the register you are using rather than assuming that public means unrestricted.
• Keep your own claims inside the evidence. Say what the register says, on the date you checked it. Do not translate an absent certification into a statement about a competitor’s security, and do not describe your own status in stronger terms than your certificate’s scope supports. Comparative claims about security are among the easiest to challenge and among the most damaging to get wrong.

• Whether the product is actually secure. A certification confirms that a management system or a set of controls was assessed against criteria, on a date, within a scope. Proxy: the incident history, the exceptions section of the report, and whether they publish post-incident reviews.
• The contents of any restricted report. If you are not a customer or a specified party, you have no route to it and no entitlement to one. Proxy: the general-use summary, and the public cloud security questionnaire where the vendor has filed one.
• When a certification lapsed. Registers show current status, not history, and a trust page simply stops mentioning it. Proxy: archived copies of their security page, compared at intervals.
• Which certification is coming next. Audit programmes are not announced until they complete, with the federal marketplace as the notable exception. Proxy: compliance and security hiring, which leads a new programme by two or three quarters and is covered under competitor hiring.
• What the certification cost them, or how painful it was. Never disclosed, and it varies enormously by scope. Proxy: the gap between a first compliance hire and the first published certificate, which is a usable estimate of programme length.

Drive the review from expiry dates rather than from a calendar. Keep one row per organisation and per framework with the scope, the version, where you verified it, the date you checked and the date it runs out, then review each row on its own expiry. A single quarterly sweep will always be too late for something and too early for everything else.

Three events justify looking immediately. A security incident at the vendor, because scope and certification status sometimes change quietly afterwards. Any renewal or expansion of your contract, since the entity and the services in scope may both have moved. And an acquisition on either side, which is the change most likely to leave a certificate technically valid and practically irrelevant. For competitors rather than suppliers, a quarterly read of their trust page is enough, with an archived copy kept each time so that a disappearance is visible later.

What decays here is silent by design. A trust page that gains a framework announces it; a trust page that loses one simply stops listing it, with no date, no notice and no trace unless somebody kept a copy. Certificates expire on their own schedule rather than on yours, attestation periods end quarters before anyone asks for the next report, and a competitor’s new authorisation is usually first visible on a register nobody on your team has a reason to visit. The cost lands in a specific place: a seller repeats a certification gap that closed four months ago, in front of the one buyer who checked.

Watching a set of quiet pages and registers for changes that arrive a few times a year is the sort of work that gets dropped first and missed last, which is why competitive intelligence platforms exist. Flares keeps competitor product and compliance pages under continuous observation, so an added or dropped certification arrives as a dated signal rather than as a surprise in a deal review. What no platform can do is judge the scope. Whether a certificate actually covers the service a buyer is worried about is a reading exercise on a specific document, and it stays with the person who has to defend the answer.