Use "aligned" or "maps to" when you follow a framework on your own, "self-assessed" when you answered a questionnaire yourself, "attested" only when an independent auditor issued a report, and "certified" only when a certification body issued a certificate. If no third party exists for the framework, never use the last two.
The four words
| Word | What it implies | Needs |
|---|---|---|
| Aligned or mapped | You use the framework as a guide | A mapping and evidence |
| Self-assessed | You answered the questions yourself | The completed assessment, dated |
| Attested | An independent party examined and reported | The report |
| Certified | A certification body issued a certificate | The certificate and its scope |
"Compliant" sits awkwardly between these. It can mean "we meet a legal duty", or "we pass an audit", or just "we try". A reviewer who sees it will ask what test you passed.
Three real examples
NIST Cybersecurity Framework. NIST says it does not offer certifications or endorsements of CSF related products, implementations or services, and has no plans for a conformity assessment program. So the right word here is "aligned" or "mapped". "CSF certified" cannot be true.
CSA STAR. The Cloud Security Alliance splits the program in two. Level 1 is a self-assessment using the CAIQ. Level 2 is a third-party audit, with variations that include STAR Attestation (based on SOC 2) and STAR Certification (based on ISO/IEC 27001). One program, and the words differ by level. A Level 1 listing is "self-assessed".
SLSA. The specification defines Build levels, L1 to L3, describing what the build platform guarantees. These are levels you claim for a build process, not a certificate you hold. Say "our release builds meet Build L2 as we verified", with the date, not "SLSA certified".
A quick decision flow
- Is there an independent body that audits against this standard and issues something? If no, use "aligned" or "self-assessed".
- If yes, do you hold the report or certificate today? If no, say "in progress" and give the stage, not the outcome.
- Does the document cover the product the buyer is evaluating? If not, say what it does cover.
- Is it current? State the date or period.
Wording examples
- "Our controls are mapped to the NIST CSF 2.0 functions. We review the mapping annually."
- "We published a CSA STAR Level 1 self-assessment on the registry. It has not been audited by a third party."
- "A SOC 2 examination is underway with an independent auditor. No report has been issued."
The last one matters most. An examination that has started is not a result, and a buyer who later finds the difference will question everything else you wrote.
Review before sending
Read every answer once, looking only for those four words. Ask of each: what document proves this? If you cannot name one, change the word. Add a short glossary to your answer library so every teammate uses the same terms.
Try it yourself
Click through it at your own pace, or open it full screen. It shows what a mapping is: a link between controls and requirements, not an audit result.
Safeguard's compliance and evidence automation supports preparation and does not certify anyone. Try the free scan for dependency facts you can cite.
Quick check
Can a self-assessment be called an attestation?
No. Attestation implies an independent party examined and reported. A self-assessment is your own statement.
What is safe to write while an audit is underway?
Say that an examination is in progress with an independent auditor and that no report has been issued. Do not imply an outcome.
Sources
- NIST, Cybersecurity Framework FAQs. Paraphrased.
- Cloud Security Alliance, CSA STAR. Paraphrased.
- SLSA, Build track basics, version 1.2. Paraphrased.
Last reviewed: 19 October 2026.
